------------------------------------------------------------------
--- Changelog.all ----------- Wed Jul  8 03:19:37 UTC 2026 ------
------------------------------------------------------------------
------------------------------------------------------------------
------------------  2026-7-8  -  Jul 8 2026  -------------------
------------------------------------------------------------------

++++ Aeon-release:

  - automatically generated by openSUSE-release-tools/pkglistgen

++++ Kalpa-release:

  - automatically generated by openSUSE-release-tools/pkglistgen

++++ MicroOS-release:

  - automatically generated by openSUSE-release-tools/pkglistgen

++++ openSUSE-release:

  - automatically generated by openSUSE-release-tools/pkglistgen

------------------------------------------------------------------
------------------  2026-7-7  -  Jul 7 2026  -------------------
------------------------------------------------------------------

++++ GeoLite2:

  - Updated to 2026.07.07
    * Returned Russian and Crimean IPs in later versions.

++++ asdf:

  - Update to version 0.20.0:
    * chore: release 0.20.0 (#2276)
    * feat: add warning to `asdf info` output when `ASDF_TOOL_VERSIONS_FILENAME` value is invalid (#2293)
    * docs: revise ko-kr documentation (#2288)
    * chore: bump the docs group in /docs with 2 updates (#2290)
    * chore: bump golang.org/x/net from 0.53.0 to 0.55.0 (#2291)
    * chore: bump actions/checkout from 6 to 7 (#2287)
    * chore: bump actions/cache from 5 to 6 (#2289)
    * docs: update nushell setup instructions (#2285)
    * chore(docs): bump @types/node from 25.6.0 to 25.9.1 in /docs in the docs group (#2284)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1 (#2280)
    * chore: upgrade to golang 1.26.3 (#2282)
    * fix: shallow clone plugin repositories for faster installs (#2256)
    * fix: update nushell completion code so it works on latest version of nushell (#2275)
    * docs: clarify what `<command>` means in `asdf env` (#459) (#2274)
    * chore(docs): bump the docs group in /docs with 2 updates (#2273)
    * chore(docs): bump postcss from 8.5.1 to 8.5.12 in /docs (#2272)
    * chore(deps): bump googleapis/release-please-action from 4 to 5 (#2271)

++++ cargo-audit-advisory-db:

  - Update to version 20260707:
    * Assigned RUSTSEC-2026-0204 to crossbeam-epoch
    * Add advisory for invalid pointer dereference in fmt::Pointer impl for crossbeam_epoch::{Atomic,Shared}
    * Bump actions/cache from 5.0.5 to 6.1.0
    * Assigned RUSTSEC-2026-0203 to tree-sitter-perl-next
    * Add tree-sitter-perl-next unmaintained advisory (#3039)
    * Assigned RUSTSEC-2026-0202 to cxx
    * Add advisory for cxx let_cxx_string unsoundness (#3037)
    * Assigned RUSTSEC-2026-0201 to fulgur
    * Add advisory for fulgur: blank-page DoS via non-painting replaced elements
    * Assigned RUSTSEC-2026-0200 to fulgur

++++ conscrypt:

  - Added patch:
    * boringssl.patch
    + Allow building with newer boringssl

++++ cosign:

  - update to 3.1.1 (bsc#1267044,
    CVE-2026-25680,CVE-2026-42502,
    CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
    bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
    CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
    CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
    CVE-2026-46597, CVE-2026-46598,
    bsc#1261811, CVE-2026-33815):
    * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
    * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
    * Initialize PKCS11 slots Before Getting Token Info in
    * Sign exclusively via sigstore-go in
    * bundle create: Prevent IgnoreTlog when bundle contains SET in
    * Require bundle output or registry upload in
    * fix(load): pass NameOptions to name.ParseReference in
    * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
    * Deprecate Flags for v4: Certificates in
    * Deprecate flags signing config in
    * Deprecate flags bundle in
    * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
    * Add bundle upgrade command in
    * Deprecate Flags for v4 in
    * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
    * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
    * feat(cli): add Rekor v2 flag to cosign signing-config create
    * Fix crash verifying timestamps when no timestamp was verified
    * Deprecate Flags for v4: OCI Referrers in
    * Use the configured Target Repository more consistently in
    * fix: check HTTP status code in LoadFileOrURL in
    * Fix unsafe type assertion in Rego policy evaluation by in
    * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
    * Enable initialize command output in conformance in
    * verify: return TUF errors for new bundle trusted roots in
    * Deprecate subcommands in
    * Remove docstring references to deprecated flags in
    * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
    * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
    * Update sigstore-go to v1.2.0 in
    * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1

++++ criu:

  - Backport the fixes from criu-devel branch for the recent 7.x kernels
    (bsc#1270423):
    0001-net-Route-veth-restore-through-usernsd-for-userns-mo.patch
    0002-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch
    0003-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPL.patch
    0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch

++++ docker-compose:

  - Update to version 5.3.1:
    * Internal
  - Ci: add concurrency group to pr-review-trigger to prevent
    duplicate reviews by @derekmisler in #13890
  - Fix grammar in Attestations field comment by @blackflytech in
    [#13891]
  - Ci: remove unused desktop-edge-test workflow by @thaJeztah in
    [#13897]
  - Ci: zizmor workflow by @crazy-max in #13901
  - Ci: fix docs-upstream workflow by @crazy-max in #13912
  - CODEOWNERS: add compose-reviewers by @thaJeztah in #13913
  - Ci: harden GitHub Actions workflows by @glours in #13896
  - GHA: dependabot: group docker/* actions updates by @thaJeztah
    in #13914
    * Dependencies
  - Build(deps): bump github.com/moby/buildkit from 0.31.0 to
    0.31.1 by @dependabot[bot] in #13892
  - Build(deps): bump github.com/moby/sys/user to v0.4.1 by
    @thaJeztah in #13893
  - Build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to
    4.0.0-rc.6 by @dependabot[bot] in #13876
  - Build(deps): bump github.com/docker/cli from
    29.6.0+incompatible to 29.6.1+incompatible by
    @dependabot[bot] in #13895
  - Build(deps): bump actions/stale from 10.2.0 to 10.3.0 by
    @dependabot[bot] in #13902
  - Build(deps): bump the docker-actions group with 3 updates by
    @dependabot[bot] in #13916
  - Build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
    by @dependabot[bot] in #13908
  - Build(deps): bump actions/setup-go from 6.3.0 to 6.5.0 by
    @dependabot[bot] in #13907
  - Build(deps): bump test-summary/action from 2.4 to 2.6 by
    @dependabot[bot] in #13903
  - Build(deps): bump mxschmitt/action-tmate from 3.23 to 3.24 by
    @dependabot[bot] in #13910
  - Build(deps): bump codecov/codecov-action from 5.5.3 to 7.0.0
    by @dependabot[bot] in #13904
  - Build(deps): bump github/codeql-action/upload-sarif from
    3.36.3 to 4.36.2 by @dependabot[bot] in #13917
  - Build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by
    @dependabot[bot] in #13911

++++ rpm2docserv:

  - Update to version 20260707.78c4c29:
    * Update go dependencies

++++ glab:

  - Update to version 1.107.0:
    * Features
  - ad8642d8: feat(duo): support Duo CLI v9 auto-updates (Tomas
    Vik tvik@gitlab.com)
  - b8ba875f: feat(security config): add commands to manage
    security configuration profiles (Oscar Tovar
    otovar@gitlab.com)
    * Documentation
  - 76d0ac66: docs: add new CLAUDE.md file and reference
    AGENTS.md (Brendan Lynch blynch@gitlab.com)
  - 4a143d44: docs: clarify glab token rotate command info
    (Brendan Lynch blynch@gitlab.com)
  - 96ab83c0: docs: update stage from Create to AI Coding (Uma
    Chandran uchandran@gitlab.com)
    * Dependencies
  - 3329b298: chore(deps): update dependency @commitlint/format
    to ^21.1.0 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - d176bd65: chore(deps): update module charm.land/lipgloss/v2
    to v2.0.5 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - b9c46379: chore(deps): update module github.com/docker/cli to
    v29.6.1+incompatible (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - f6fefa6d: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.45.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 7fd07149: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.46.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
    * Maintenance
  - 0e195d0d: chore: update documentation MR template (Brendan
    Lynch blynch@gitlab.com)

++++ inspektor-gadget:

  - Update to version 0.54.0:
    * Welcome to the v0.54.0 of Inspektor Gadget. These are the most
    important changes:
  - Generate Cilium NetworkPolicy — advise_networkpolicy can now
    produce Cilium NetworkPolicy resources, not just Kubernetes
    NetworkPolicy. Pick the output you want with --policy-format
    cilium (or --policy-format k8s), then apply the generated
    policy directly to your Cilium managed cluster.
  - Set resources on the Kubernetes deployment — you can now
    define CPU and memory requests and limits for Inspektor
    Gadget via the Helm chart. Set them under resources in your
    values.yaml (or with --set) so the DaemonSet fits within your
    cluster's resource quotas and admission policies.
  - Race and scale fixes — several fixes make Inspektor Gadget
    more stable on busy, high-churn nodes: a data race on
    concurrent container attachment was fixed, a fanotify
    self-deadlock in the container hook was avoided, and repeated
    BTF work is now cached, reducing overhead at scale.
    * Breaking Changes
  - ci: remove SBOMs from image index, sign them separately by
    @natejsimonsen in #5495
    * General Improvements
  - otel-profiles: Add support for profile name by @mqasimsarfraz
    in #5459
  - operators/generate_networkpolicy: add Cilium NetworkPolicy
    output format by @qjoly in #5551
  - charts: Allow setting resources by @mqasimsarfraz in #5563
  - trace_exec: read args from the new process address space by
    @dorser in #5600
  - ebpf: upgrade to v0.22.0 and use user-provided BTF cache by
    @matthyx in #5599
  - tools: Pin bpftool version and add check for latest by
    @eiffel-fl in #5472
    * Bug Fixes
  - kubemanager: fix race for writes to attachedContainers by
    @mqasimsarfraz in #5584
  - container-hook: avoid fanotify self-deadlock by caching
    config.json by @alban in #5572
  - include: mask I_CTIME_QUERIED flag when reading inode ctime
    by @dorser in #5602
    * Documentation Improvements
  - gadgets/advise_networkpolicy: document --policy-format in
    gadget guide by @Copilot in #5571
  - Clarify applicability of built-in gadgets migration guide by
    @ahrkrak in #5562
  - docs: Update AKS CI documentation to use immutable subject by
    @eiffel-fl in #5601
    * Security Improvements
  - Bump Go toolchain and builder image pins to 1.26.4
    (CVE-2026-42504) by @Copilot in #5558
  - deps: update x/crypto for gadgettracermanager CVE scan by
    @Copilot in #5590
    * CI updates
  - ci: Fixes zizmor alerts for template injection by @eiffel-fl
    in #5549
  - ci: Pin vimto version and check latest version by @eiffel-fl
    in #5473
    * Dependencies updates
  - go: bump github.com/cyphar/filepath-securejoin from 0.5.1 to
    0.7.0 by @dependabot in #5581
  - go: bump github.com/containerd/containerd from 1.7.32 to
    1.7.33 by @dependabot in #5585

++++ kubearmor-client:

  - Update to version 1.4.9:
    * bump otlptrace to v1.43.0 to resolve Snyk memory allocation
    vuln (#555)
  - Update to version 1.4.8:
    * migrate docker SDK usage from docker/docker to moby/moby/client
    (#552)
    * fix(install): remove kubearmornetworkpolicies CRD on force
    uninstall
    * chore: typo fix for cli karmor logs --secure
    * add no sec to json encoding
    * chore(policy): add kubearmor network policy
    * probe: fix namespace field to the policies list
    * fix-go-release
    * update KubeArmor/protobuf dependency

++++ kubectl-view-allocations:

  - Update to version 3.0.2:
    * chore(deps): bump kube from 3.1.0 to 4.0.0
    * chore(deps): bump itertools from 0.14.0 to 0.15.0 (#344)
    * chore(deps): bump anyhow from 1.0.102 to 1.0.103 (#342)
    * chore(deps): bump actions/checkout from 6 to 7 (#340)

++++ syslog-ng:

  - update to 4.12.0
  - disable Java destination support
  - comment out secure logging related files for now (disabled by
    default by upstream)

++++ rpm:

  - Add Requires: (rpm-plugin-selinux if selinux-policy)

++++ libtsm:

  - Update to 4.6.0:
    * vte: map mouse wheel up/down buttons correctly
    * fix CSI default parameter
    * vte: Fix ctrl+shift+arrows
    * Add a new draw2 interface
    * vte: Add dim support

++++ limine:

  - Update to 12.4.0:
    * Support booting FreeBSD on BIOS/GPT systems by chainloading the
    freebsd-boot partition (gptboot), emulating FreeBSD's pmbr.
    * Add the `firmware_logo` option to restore the OEM firmware boot logo
    on handoff to the OS via the ACPI BGRT table (UEFI only).

++++ matrix-synapse:

  - Update to 1.156.0
  - Features
  - Expose MSC4354 Sticky Events over MSC4186 (Simplified)
    Sliding Sync. (#19591)
  - Stabilize support for sending ephemeral events to application
    services, as per MSC2409. Contributed by @jason-famedly @
    Famedly. (#19758)
  - Include allowed_room_ids in the /summary client-server API
    response for rooms with restricted join rules, as required by
    Matrix 1.15. Contributed by @FrenchGithubUser @famedly.
    (#19762) MSC4140: Cancellable delayed events: Allow
    authentication on delayed event management endpoints (such as
    /restart) to bypass ratelimits for unauthenticated requests
    based on the client IP address. (#19794)
  - Add new metric synapse_non_deactivated_user_count which
    tracks the number of non-deactivated users in the database,
    split by app_service. (#19848)
  - The GET
    /_matrix/client/unstable/org.matrix.msc1763/retention/configuration
    endpoint is now provided when retention is enabled and
    experimental_features.msc1763_enabled is enabled, based on
    MSC1763. (#19853)
  - Add experimental support for MSC4491: Invite reasons in room
    creation. (#19874)
  - Bugfixes
  - Provide remote servers a way to find out about an event
    created during the remote join handshake. Contributed by
    @FrenchGithubUser and @jason-famedly @ Famedly. (#19390,
    [#19855], #19856)
  - Advertise org.matrix.msc4143 in unstable_features when
    msc4143_enabled is set. (#19646)
  - Fix a long-standing bug where the badge notification count
    for a room could become permanently inflated if a read
    receipt was sent before the room's notification counts were
    first summarised. (#19785)
  - Fix startup listener logging to report the actual bound TCP
    port, so listeners configured with port 0 no longer log
    Synapse now listening on TCP port 0. (#19810)
  - Fix notification counts being inflated after a /purge_history
    when notifications had already been rotated into the summary
    table. (#19834)
  - Fix /sync caching transient errors for the
    sync_response_cache_duration. (#19845)
  - Fix local events being deleted by the Purge History admin API
    despite delete_local_events being set to false, in room
    versions other than 1 and 2. (#19850)
  - Fix a bug where a user's dehydrated device (MSC3814) was
    deleted when their device list was synced from Matrix
    Authentication Service (e.g. upon logging out their last
    device), breaking offline key delivery. (#19892)
  - Improved Documentation
  - Update auto_join_rooms config documentation to cover
    requirements for auto-joining invite-only rooms. (#19660)
  - Add stable endpoint for MSC3266: Room summary API into worker
    docs. Contributed by @olmari. (#19788)
  - Tweak wording of Rust crate dependency update policy.
    (#19829)
  - Fixed the Admin API user endpoint documentation examples to
    use JSON booleans (true/false) instead of numeric (0/1)
    values. (#19847)
  - Internal Changes
  - Make simple_select_one_onecol_txn() more helpful by naming
    the table of the select - as all other query wrapper
    functions already did. (#19869)
  - Refactor get_user_which_could_invite logic to reuse
    get_users_which_can_issue_invite. Contributed by Noah
    Markert. (#19732)
  - Fix a flaky test (twisted.protocols.amp.TooLong error under
    trial -jN) caused by an oversized debug log line. (#19832)
  - Upload Complement test logs as CI artifacts instead of
    printing the raw output to the build log. (#19840)
  - Fix release script considering any workflow completion as
    successful. (#19843)
  - Force keyword-args for clear
    default_config(server_name="test") usage in test utilities.
    (#19849)
  - Add .ruff_cache/ directory to .gitignore. (#19854)
  - Bump poetry in CI from 2.2.1 to 2.4.1. (#19866, #19877)
  - Split out deferred and tokio_runtime to their own Rust
    modules. (#19868)
  - Prevent the cargo-test and cargo-bench CI jobs from being
    skipped, even on PRs that have Rust changes. (#19883)

++++ opencloud-server:

  - Update to version 7.2.1:
    Opencloud
    * Bug Fixes
  - Fix warming up the id cache for the user storage [#3072]
    * Dependencies
  - [full-ci] chore: bump web to v7.1.3 [#3052]
    Reva
    * Bug Fixes
  - [stable-2.46] Fix warming up the id cache for the user
    storage [#728]
    Web
    * Bug Fixes
  - [stable-7.1] fix (tiptap): don't render html files via html
    strategy (#2774) [#2776]
  - fix: isolate module federation shared scope per app [#2770]

++++ opi:

  - Version 5.14.0
    * Use GitHub latest release endpoint for stable releases

++++ perl-Crypt-PasswdMD5:

  - updated to 1.450.0 (1.45)
    see /usr/share/doc/packages/perl-Crypt-PasswdMD5/Changelog.ini
    [V 1.45]
    Date=2026-07-07T10:28:00
    Comments= <<EOT
  - Replace LICENCE file with output of the software-license program which ships
    with the module App::Software::License. The specific command I ran is (all on 1 line):
    software-license --type license --holder "Luis E. Muñoz" --license Perl_5
  - -year 1998 > LICENSE
    EOT

++++ perl-Devel-Cover-Report-Codecovbash:

  - updated to 0.42.0 (v0.42.0)
    see /usr/share/doc/packages/perl-Devel-Cover-Report-Codecovbash/Changes
    v0.42.0 2026-07-07 11:20:41+02:00
  - fix: Report lines with any covered statement as covered

++++ perl-String-Util:

  - updated to 1.360.0 (1.36)
    see /usr/share/doc/packages/perl-String-Util/Changes

++++ perl-Tree-DAG_Node:

  - updated to 1.380.0 (1.38)
    see /usr/share/doc/packages/perl-Tree-DAG_Node/Changelog.ini
    [V 1.38]
    Date=2026-07-07T10:28:00
    Comments= <<EOT
  - Replace LICENCE file with output of the software-license program which ships
    with the module App::Software::License. The specific command I ran is (all on 1 line):
    software-license --type license --holder "Sean M. Burke and David Hand" --license Perl_5
  - -year 1998 > LICENSE
  - Add AI_POLICY.md file.
  - Modernize MANIFEST.SKIP again.
    EOT

++++ python-anthropic:

  - Update to 0.116.0:
    * Add support for claude-sonnet-5
    * Add support for Managed Agents event delta streaming, agent
    overrides, reverse pagination, vault credential injection
    scoping, and agent/deployment webhook events
    * Add support for the 20260318 web fetch and support tools
    * Fix async count_tokens missing output_format/output_config
    merge block
    * Fix agent_toolset to allow absolute paths that resolve inside
    the workdir
    * Keep the typing_extensions floor at >= 4.13.2 (upstream raised
    it to >= 4.14, but the code still only needs TypeIs, available
    since 4.10.0)

++++ python-eval-type-backport:

  - Add patch support-typing-eval-type-changes.patch:
    * Support typing._eval_type() changes introduced by Python 3.13 and 3.15.

++++ python-langchain-aws:

  - Update to 1.6.2:
    * Add support for the Claude Fable and Sonnet 5 Bedrock models
    * Allow thinking together with forced tool use on Claude
    Opus 4.8 and Claude 5

++++ python-langgraph:

  - Update to 1.2.8:
    * Bug-fix release; no API or dependency changes

++++ python-langsmith:

  - Fix variations from %check (boo#1227364)
  - Update to 0.9.8:
    * Add an asynchronous aread_project() client method to read a
    tracing project (by id or name, optionally with aggregate
    statistics) without blocking
    * Rename the client-facing online_evaluators accessor to
    evaluators for clearer nomenclature
    * Drop the asynchronous projects resource accessor

++++ python-pony:

  - Add py313.patch and py314.patch to support Python 3.13 and Python 3.14
  - remove skip for Python 3.13 and Python 3.14
  - add skip for Python 3.15

++++ rasdaemon:

  - - Create debugfs dependency in unit section of rasdaemon.service
    bsc#1270438
    A debugfs_service_dependency.patch
  - On systems where no DIMMs are installed and the systems only have HBM memory,
    the ras-mc-ctl --register-labels and --print-labels return an error instead
    of an info message (bsc#1240542)
    A rasdaemon_ras-mc-ctl_change_no_dimm_label_message_to_info_from_error.patch

++++ redsea:

  - Update to version 1.3.1
    UX changes:
    * Exit if a TMC location table is provided but can't be loaded.
    Documentation:
    * Encouraging the use of the --input flag (the default input
    format may be deprecated in the future).
    Bug fixes:
    * Fix the number-of-channels sanity check only being applied to
    raw pcm input.
    * Fix signed integer overflow in the number parsing in
    options.cc
    * Fixes to eRT/eRT+ decoding (#152) by VasylSamoilov:
    + Show incomplete UTF-8 characters as '?' instead of discarding
    the entire string.
    + Allow messages of up to 128 bytes in length.
    + Fix off-by-one in the RadioText+ tag placement for eRT.
    * Fix an issue where RadioText was constantly re-printed if the
    station used both string terminators and space-padding (#118).
    * Fix C' offset detection - type B groups can now be received
    even when block 2 is lost (MPX/bitstring input).
    * Fix bug in 15B decoding when Block 2 is absent, uncovered by
    the above.
    * Fix bug in legacy 5A/5B (Transparent data channels): don't
    attempt to decode missing block 3/4.

++++ rubygem-actioncable-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-actionmailbox-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-actionmailer-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-actionpack-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-actiontext-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-actionview-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-activejob-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-activemodel-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-activerecord-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-activestorage-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-activesupport-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-rails-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-railties-8.0:

  - Update to version 8.0.5:
    https://rubyonrails.org/2026/3/24/Rails-Versions-8-0-5-and-8-1-3-have-been-released

++++ rubygem-uri:

  - New upstream release 1.1.1

++++ rustup:

  - bsc#1270186 - CVE-2026-41676 - update openssl to 0.10.78

++++ sccache:

  - bsc#1270206 CVE-2026-41676 - Update openssl to 0.10.78

++++ tik:

  - Revert to version 1.5.1:

++++ ttl:

  - Update to version 0.20.2:
    Fixed
    * Panic-proofing across the CLI, probe, and TUI paths.
    * Unsafe socket code hardened against undefined behavior.
    * PMTUD correlation, lock ordering, and enrichment dedup.
    * IPv6 correctness.
    * Bounded enrichment caches.
    * Replay robustness.
    * File security and output hygiene.
    * Export filename length.

++++ zathura-plugin-cb:

  - Fix build without %check (boo#1227364)

++++ zathura-plugin-djvu:

  - Fix build without %check (boo#1227364)

++++ zathura-plugin-pdf-mupdf:

  - Fix build without %check (boo#1227364)

++++ zathura-plugin-pdf-poppler:

  - Fix build without %check (boo#1227364)

++++ zathura-plugin-ps:

  - Fix build without %check (boo#1227364)

------------------------------------------------------------------
------------------  2026-7-6  -  Jul 6 2026  -------------------
------------------------------------------------------------------

++++ apko:

  - Update to version 1.2.22:
    * build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#2295)
    * build(deps): bump google.golang.org/api from 0.285.0 to 0.286.0
    (#2298)
    * build(deps): bump go.step.sm/crypto from 0.83.0 to 0.84.1
    (#2301)
    * build(deps): bump goreleaser/goreleaser-action from 7.2.2 to
    7.2.3 (#2308)
    * build(deps): bump chainguard.dev/sdk from 0.1.74 to 0.1.94
    (#2309)
    * build(deps): bump golangci/golangci-lint-action from 9.2.1 to
    9.3.0 (#2312)
    * build(deps): bump chainguard-dev/actions/setup-registry from
    1.6.24 to 1.6.26 (#2313)
    * build(deps): bump github.com/klauspost/compress from 1.18.6 to
    1.19.0 (#2314)

++++ arkade:

  - Update to version 0.11.108:
    * Allow trusted symlink targets in OCI extraction

++++ ast-grep:

  - Update to version 0.44.1:
    * 0.44.1 bump version
    * chore(deps): update rust crate napi to v3.10.3 (#2786)
    * chore(deps): update rust crate napi-derive to v3.5.9 (#2785)
    * chore(deps): update dependency oxlint to v1.72.0 (#2780)
    * chore(deps): update rust crate terminal-light to v1.9.0 (#2781)
    * chore(deps): update rust crate clap_complete to v4.6.7 (#2783)
    * chore(deps): update rust crate ignore to v0.4.27 (#2784)
    * fix(cli): bound outline file queue (#2787)
    * chore(deps): update rust crate clap_complete to v4.6.6 (#2782)
    * chore(deps): update dependency @ast-grep/napi to v0.44.0 (#2764)
    * chore(deps): update rust crate tree-sitter to v0.26.10 (#2779)
    * chore(deps): update dependency web-tree-sitter to v0.26.10 (#2778)
    * chore(deps): update dependency dprint to v0.55.1 (#2776)
    * chore(deps): update dependency @napi-rs/cli to v3.7.2 (#2667)
    * chore(deps): update rust crate napi to v3.9.4 (#2696)
    * chore(deps): update rust crate napi-derive to v3.5.7 (#2768)
    * fix: update pyo3 deps
    * chore(deps): update rust crate anyhow to v1.0.103 (#2774)
    * feat: load custom language outline rules from config (#2777)
    * fix(deps): update rust-wasm-bindgen monorepo (#2775)
    * chore(deps): update actions/cache action to v6 (#2767)
    * feat: add outline rules for more builtin languages
    * feat: Support *.bazel files in python (#2771)
    * chore(deps): update oxlint monorepo (#2765)

++++ faugus-launcher:

  - Bump to version 1.22.8
    * Updated Russian translation
    * Removed prefix lock
    * Use png instead of ico
    * Add files via upload for 1.22.7
    * Update ja faugus-launcher.po 1.22.7
    * Updated German translation
    * centralize path constants in path_manager.py

++++ flake-pilot:

  - Bump version: 3.1.33 → 3.1.34

++++ framework_tool:

  - Update to 0.6.5
    * README: link to downstream package website by @JohnAZoidberg in #345
    * --thermal: Decode Intel Core Ultra Series 3 temps by @JohnAZoidberg in #348
    * --capsule: Add more GUIDs by @JohnAZoidberg in #349
    * --power: Add battery cutoff status by @JohnAZoidberg in #347
    * Add getting battery info thorugh SMBUS by @JohnAZoidberg in #350
    * Bump 0.6.5 by @JohnAZoidberg in #351

++++ gap-autodoc:

  - Update to release 2026.06.30
    * Fix a regression in `.autodoc` parsing where Markdown-style
    headings and AutoDoc commands were interpreted inside XML CDATA
    blocks instead of being kept as literal text.

++++ gap-digraphs:

  - Update to release 1.15.0
    * kernel: fix issues with assumptions in `IS_ACYCLIC_DIGRAPH`
    * Improve the documentation of the Digraph encoding formats
    * Implement `IsCograph` with bug fixes
    * Add unitedgeweight digraph
    * Implementing Colour Refinement
    * Correct Mutability of LineDigraph
  - Delete eaps5.patch (merged)

++++ gnome-branding-Aeon:

  - Demote ptyxis from default installation

++++ golang-github-prometheus-alertmanager:

  - update to 0.33.1:
    * [BUGFIX] doc: fix missing notification_reason field in webhook
    documentation (#5329)
    * [BUGFIX] silences: fix silences snapshot missing legacy
    matchers field. This caused a bug that prevented older
    alertmanager versions from reading newer snapshots
    unnecessarily. (#5330)
    * [BUGFIX] silence with no matchers should populate an empty
    array in API response (#5331)

++++ goreleaser:

  - Update to version 2.17.0:
    * ci: verify
    * docs: update
    * ci: replace tilde in nfpm filenames
    * docs(nfpm): note tilde ConventionalFileName
    * feat(dockers/v2): retry build
    * feat(scm): allow a custom token on the release repository (#6689)
    * chore: auto-update generated files (#6688)
    * ci(deps): bump the actions group with 11 updates (#6687)
    * chore(deps): bump the gomod group with 4 updates (#6686)
    * ci: notify telegram instead of discord
    * feat: Allow GOARM softfloat and hardfloat (#6198)
    * chore: godoc
    * feat(brew,cask,krew,nix,scoop,winget): default pull request branch name (#6685)
    * fix(winget): default head branch to a versioned template (#6684)
    * chore: schema update
    * ci: token perms
    * sec(deps): bump go-pkcs12 to v0.7.2 (GO-2026-5052) (#6683)
    * fix(deps): drop dep on docker/docker (#6682)
    * feat(winget): allow configuring the manifest locale (#6680)
    * fix(builders): reject empty target string (#6679)
    * chore(deps): bump the gomod group across 1 directory with 2 updates
    * ci: improve ci times (#6677)
    * chore(deps): bump the gomod group with 2 updates (#6673)
    * ci: remove node cleanup
    * docs: update
    * chore(deps): bump github.com/sigstore/rekor from 1.5.1 to 1.5.2 (#6676)
    * chore: auto-update generated files (#6675)
    * ci(deps): bump the actions group with 3 updates (#6674)
    * chore: auto-update generated files (#6671)
    * chore(deps): bump github.com/opencontainers/runc from 1.2.8 to 1.3.6 (#6669)
    * fix(nfpm): produce valid arch for Termux packages (#6668)
    * feat(nfpm): support msix packages (#6647)
    * docs: update
    * ci: remove dispatch generate
    * ci: improve sponsors update script
    * ci: improve get-releases script
    * chore(deps): bump the docker group across 1 directory with 2 updates (#6664)
    * ci(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions group (#6665)
    * chore(deps): bump the gomod group with 5 updates (#6663)
    * chore: auto-update generated files (#6662)
    * docs: fix "lets" -> "let's" in quick-start guide (#6661)
    * ci: fix install from gh release
    * ci: fix generate job
    * docs: doc authoring skill
    * docs: update
    * ci(deps): bump the actions group with 2 updates (#6659)
    * chore(deps): bump the docker group across 1 directory with 3 updates (#6658)
    * chore(deps): bump the gomod group with 6 updates (#6657)
    * docs: fix
    * fix(client): skip merge-upstream when target repo is not a fork (#6646)
    * chore: update schema
    * docs: good bye discord
    * fix: return error when go.mod is unreadable in CheckGoModPipe (#6644)
    * docs: fix typo in notarize.md (#6655)
    * chore: auto-update generated files
    * sec(deps): update golang.org/x/net
    * fix(mcp): clean subfolder path (#6649)
    * chore(deps): bump the gomod group with 2 updates (#6650)
    * chore(deps): bump the docker group across 1 directory with 3 updates (#6651)
    * ci(deps): bump the actions group with 5 updates (#6652)
    * docs: improve home
    * chore: auto-update generated files
    * chore: auto-update generated files
    * chore(deps): bump the gomod group with 2 updates (#6640)
    * ci(deps): bump the actions group with 4 updates (#6641)
    * chore: auto-update generated files
    * chore: auto-update generated files
    * docs(casks): fix private-repo example broken by Homebrew 5.1.14 (#6639)
    * chore: auto-update generated files
    * chore: auto-update generated files
    * docs: updates
    * chore: auto-update generated files
    * chore: auto-update generated files

++++ govc:

  - Update to version 0.55.1:
    * Fix
  - [ea8603d] remove ovf test files with non-ascii names
    * Chore
  - [1e372f1] Update version.go for v0.55.1
    * Commits
  - [1e372f1] chore: Update version.go for v0.55.1
  - [18b33ca] feat(cns): add ActiveClusters to
    CnsVolumePolicyReconfigSpec
  - [e5a1169] Add simulator methods for eam2 cluster solutions
    api
  - [ea8603d] fix: remove ovf test files with non-ascii names

++++ himmelblau:

  - Update to version 3.1.8+git0.f72b330e:
    * cargo vet
    * Version 3.1.8
    * Update cargo vet audits for backport
    * fix(deps): patch opentelemetry baggage propagation CVE
    * build: cleanup patch overrides
    * fix(auth): retry transient fail user existence lookups
    * fix(rpm): allow tpm2-tss dependency
    * fix(nss): depend on systemd users
    * packaging: disable duplicate NM workaround scripts
    * dispatcher: refine Himmelblau restart workaround
    * fix(sso): update Entra SSO extension
    * fix(rpm): clean SSO policy on erase
    * Add NSS shadow lookups for Himmelblau users
    * fix(nix module): allowed AF_INET and AF_INET6 to systemd sandbox
    * daemon: apply Intune policy asynchronously
    * Handle password changes in password-only auth
    * cargo clippy
    * Update libhimmelblau to latest version
    * deps(rust): bump the all-cargo-updates group across 1 directory with 21 updates
    * Add conf_example.patch (bsc#1268646).

++++ hugo:

  - Update to version 0.164.0:
    * releaser: Bump versions for release of 0.164.0
    * build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2
    * build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0
    * build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0
    * build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0
    * build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3
    * tpl/tplimpl: Support sub paths in layouts passed to .Render
    * all: Rewrite deprecated constructs in tests
    * Add markup.rst.syntaxHighlight option
    * tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer
    * contributing: Add a note about co-authoring attributions when borrowing test cases
    * tpl/collections: Include key in IsSet unsupported-type warning
    * build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0
    * create: Keep new content placeholders buildable
    * hugolib: Use the output format's suffix for alias paths
    * hugio: Speedup hasBytesWriter
    * build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0
    * build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2
    * tpl/crypto: Add crypto.Hash
    * Squashed 'docs/' changes from e17426e2b6..c85af679bf
    * Add encoding.HexDecode/Encode
    * deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1
    * markup/pandoc: Add citation support
    * tpl/tplimpl: Make template name lookup case-insensitive
    * deps: Add Chroma dark/light mode support
    * hugolib: Return error from .Render when template not found
    * releaser: Prepare repository for 0.164.0-DEV

++++ k0sctl:

  - Update to version 0.32.1:
    * chore: finetune rig v2 migration note
    * build(deps): bump github.com/k0sproject/rig/v2 from 2.0.1 to
    2.1.0 (#1110)
    * build(deps): bump github.com/k0sproject/rig/v2 from 2.0.0 to
    2.0.1

++++ kubectl-switch:

  - Update to version 2.4.23:
    * fix(go): update charm.land/bubbles/v2 ( v2.1.0 → v2.1.1 )
  - Update to version 2.4.22:
    * ci(github-action): update docker/login-action ( v4.3.0 → v4.4.0
    )
    * fix(go): update charm.land/lipgloss/v2 ( v2.0.4 → v2.0.5 )
    * fix(go): update charm.land/bubbletea/v2 ( v2.0.7 → v2.0.8 )
    * ci(github-action): update docker/login-action ( v4.2.0 → v4.3.0
    )
    * chore: add mise lockfile (#249)
    * ci(github-action): Update actions/checkout ( v6.0.3 → v7.0.0 )
    (#247)
    * ci(github-action): update jdx/mise-action ( v4.1.0 → v4.2.0 )

++++ ldc:

  - Adjust build to support clang using libalternatives by referencing
    the versioned names explicitly
  - Move ldc.conf (now a directory) into /usr/share/, needs patch:
    * ldc-conf-path.patch
  - Update to 1.42.0:
    * Big news
  - Frontend, druntime and Phobos are at version [2.112.1+](https://dlang.org/changelog/2.112.0.html), incl. new command-line options `-extI`, `-dllimport=externalOnly` and `-edition`. (#4949, #4962, #4988, #5029, #5042, #5046, #5051, #5061, #5067, #5069, #5076)
  - Support for [LLVM 21](https://releases.llvm.org/21.1.0/docs/ReleaseNotes.html). The prebuilt packages use v21.1.8. (#4950, #5033)
  - New prebuilt package for Alpine Linux aarch64 with musl libc, analogous to the existing x86_64 package. (#4943)
  - **Breaking change for dcompute**: The special `@kernel` UDA is now a function and _**requires**_ parentheses as in `@kernel() void foo(){}`. Optionally you can provide launch dimensions, `@kernel([2,4,8])`, to specify to the compute runtime how the kernel is intended to be launched.
  - ldc2.conf can now be a directory. All the files inside it, ordered naturally, will be concatenated and treated like a big config. (#4954)
  - Running `ldc-build-runtime --installWithSuffix` now includes installing a target-specific .conf file to that directory. (#4978)
  - **Breaking change for ldc2.conf cmake generation**: The `cmake` build process now generates the `ldc2.conf` and `ldc2_install.conf` as directories. `ldc2*.conf.in` and `ADDITIONAL_DEFAULT_LDC_SWITCHES` have been removed, if you need to add switches check out `makeConfSection` in `LdcConfig.cmake`. (#4954)
  - When cross-compiling, the fallback value for the (cross) C compiler will be picked based on some heuristics.
    The old behavior was to default to `cc`.
    As an example, when cross-compiling for `aarch64-linux-gnu` the compilers that are checked are:
  - `aarch64-linux-gnu-gcc`
  - `aarch64-linux-gnu-clang`
  - `clang --target=aarch64-linux-gnu`
  - The prebuilt arm64/universal macOS packages additionally bundle the arm64 iOS-*simulator* libraries, for out-of-the-box cross-compilation support via e.g. `-mtriple=arm64-apple-ios12.0-simulator`. (#4974)
  - New `--fdebug-prefix-map` command-line option and changed debuginfo file/directory name splitting logic (both now similar to clang), to aid reproducible builds. (#5039)
    * Platform support
  - Supports LLVM 15 - 21.
  - PowerPC64: `real` now matches the C++ host compiler's `long double` when compiling for the native target, not just on Linux hosts. (#5054)
  - Update to 1.41.0:
    * Big news
  - Frontend, druntime and Phobos are at version [2.111.0+](https://dlang.org/changelog/2.111.0.html). (#4877, #4910, #4918, #4941)
  - Support for [LLVM 20](https://releases.llvm.org/20.1.0/docs/ReleaseNotes.html). The prebuilt packages use v20.1.5. (#4843, #4911, #4935)
  - The dynamic-compile (JIT) feature has regressed with LLVM 20. Use LLVM 18 or 19 for that feature.
  - Keep frame pointers by default with `-O` for some targets, notably AArch64 (except Windows), x86_64 (except Windows and glibc Linux), Windows x86, and Android. This fixes druntime backtraces with optimized code (incl. prebuilt druntime/Phobos). (#4889)
  - The prebuilt (non-musl) Linux packages are now generated on Ubuntu 22.04; the minimum glibc version has accordingly been raised from v2.31 to v2.35. (#4893)
  - druntime: Optimize `core.int128` via inline IR/assembly. (#4892)
  - Follow clang wrt. unwind tables emission, enabling them for most popular targets. (#4888)
  - ldc2.conf: Arrays can now be appended to via the `~=` operator. (#4848, #4856)
  - New `--installWithSuffix` command-line option for the `ldc-build-runtime` tool, to simplify copying the libraries to an existing LDC installation. (#4870)
  - CMake changes (for building LDC itself):
  - Minimum CMake version bumped to v3.16. (#4898)
  - macOS: Fix weird linker error when running CMake the first time. (#3901, #4926)
  - Reworked integration of the LLVM compiler-rt libraries. Package maintainers may want to see [docs/compiler_rt.md](https://github.com/ldc-developers/ldc/blob/master/docs/compiler_rt.md). (#4665)
  - Somewhat simplify separate compiler and runtime builds, incl. cross-compiling LDC itself. (#4872)
    * Platform support
  - Supports LLVM 15 - 20.
  - RISC-V: Fiber context switching is now implemented natively. (#4867)
    * Bug fixes
  - Prebuilt macOS packages: Fix `ldmd2` and other bundled executables crashing on macOS v15.4. (#4899, #4912)
  - ImportC: Run C preprocessor in C11 mode. (#4933)
  - ImportC Windows: Disable clang headers when C-preprocessing with `clang-cl`. (#4934)
  - Fix ICE on invalid constant address-of expressions. (#4938, #4939)
  - Allow Unicode in fully qualified label names. (#4927, #4929)

++++ libcdata:

  - Update to release 20260703
    * The testsuite was updated

++++ libcdatetime:

  - Update to release 20260703
    * The testsuite was updated

++++ libcdirectory:

  - Update to release 20260703
    * The testsuite was updated

++++ libcerror:

  - Update to release 20260703
    * The testsuite was updated

++++ libcfile:

  - Update to release 20260704
    * File alignment code from 20260520 has been removed again
    * libcfile received some support for BSD APIs
    * The testsuite was updated

++++ libclocale:

  - Update to release 20260703
    * The testsuite was updated

++++ libcnotify:

  - Update to release 20260703
    * The testsuite was updated

++++ libcpath:

  - Update to release 20260703
    * The testsuite was updated

++++ libcsplit:

  - Update to release 20260703
    * The testsuite was updated

++++ libcthreads:

  - Update to release 20260703
    * The testsuite was updated

++++ libesedb:

  - Update to release 20260704
    * Support for segmented and compressed Long Values
    * Added some getopt code for esedbtools

++++ libevt:

  - Update to release 20260705
    * Reworked the command-line option parsing
    * Updated the manpage and testsuite

++++ libevtx:

  - Update to release 20260705
    * Reworked the command-line option parsing
    * Updated the manpage and testsuite
    * Extract some more fields from EVTX files

++++ libexe:

  - Update to release 20260705
    * Improvements to command line option handling
    * The testsuite was updated

++++ suricata:

  - Fix TOCTOU issue in %post (bsc#1270362, CVE-2026-59674)

++++ libwrc:

  - Update to release 20260705
    * The testsuite was updated

++++ mcp-server-managesw:

  - Update to version v0.2.1 with better tool output and better
    input schemas for the tools
  - Use direct githu download link to make package better suiteable
    for git packaging
  - Update to version 0.2.1:
    * enhanced and synced cmd line options
    * allow selection of repos
    * fixed tests
    * parse output
    * better install
    * limit the number of lines for changelog display
    * better crafted query functionality for installed packages
    * allow repo retrival for dnf and dpkg
    * proper schema to select repos
    * updated to actual go-sdk for mcp
    * enhanced output for dpkg and dnf based systems
    * reformatted output of search_package for zypper
  - Update to version 0.2.0:
    * added MIT license
    * added manual trigger to release workflow
    * added release workflow
    * fix test
    * added README.md
    * added github actions
    * added zypper test for listinmg repos
    * added test for rpm actions
    * added test for syspackage.go
    * made rpms relocateable

++++ melange:

  - Update to version 0.56.1:
    * build(deps): bump the gomod group across 1 directory with 6
    updates (#2585)
    * build(deps): bump the actions group across 1 directory with 4
    updates (#2583)

++++ mesheryctl:

  - update to 1.0.54:
    * General
  - upgrade to meshkit v1.0.21 @arjunmehta-git (#20506)
  - Chore: upgrade meshsync and operator @arjunmehta-git (#20505)
  - [server] Fix Meshsyn->Meshsync typo in controller helper
    symbols @leecalcote (#20501)
    * Maintenance
  - [Server] Fix FlushMeshSyncData stale table-name subqueries
    leaking MeshSync data @leecalcote (#20502)
    * Documentation
  - [Docs] Update Docker Hugo version to 0.157.0
    @AbhishekMauryaGEEK (#20071)
  - [Server] Fix FlushMeshSyncData stale table-name subqueries
    leaking MeshSync data @leecalcote (#20502)
  - update to 1.0.53:
    * General
  - [CI] Bump docs-docker recipe to utilize hugo image v0.163.3
    @banana-three-join (#20469)
    * Meshery CLI
  - [mesheryctl] Guard empty design response in apply to avoid
    index out of range @mightbeanshuu (#20448)
    * Maintenance
  - chore(rtk): remove /evaluate path exception from
    mesheryApiPath @yi-nuo426 (#19822)
    * Documentation
  - [Docs] Add guide: Bringing Existing Infrastructure Under
    Meshery Management @leecalcote (#20491)
  - [Docs] Configuring Meshery Operator, MeshSync, and Broker
    guide @leecalcote (#20490)
  - [Docs] Add Contributing to MeshSync guide @leecalcote
    (#20486)
  - [Docs] MeshSync: align architecture, logical, and
    troubleshooting docs with the implementation @leecalcote
    (#20464)
  - [Docs] Fix Overview & Installation button link @Bharath314
    (#20440)
  - [Docs] Hide redundant hero logo on mobile home/overview page
    @mightbeanshuu (#20460)

++++ minigalaxy:

  - Update to 1.4.2:
    * Critical bugfix: Use another API to determine game platform support
    * UI improvement: Show games in the library incrementally when starting
    * Reduce unnecessary writes to the config file.
    * Fix a possible exception during game installation not being handled correctly.
    * Logs are now also written to ~/.cache/minigalaxy/minigalaxy.log.
    * Ask the user which binary to launch if Minigalaxy is unsure.
    * The wine executable can now also be changed before a game is installed
    * Resolve deprecation/syntax warnings and quiet test output noise.
    * Switch to using PEP 302 compliant resources, excluding translations.
    * Allow installing Minigalaxy via pipx.
    * Switch debian builds to using pybuild-plugin-pyproject.
    * Set minimum Python version to 3.11.

++++ nelm:

  - Update to version 1.24.3:
    * Bug Fixes
  - autodetection of ServiceAccount dependencies for
    ClusterRoleBinding and RoleBinding resources (#632) (e9ea5da)
  - make pods/controllers depend on rolebindings (#634) (233e123)
  - Update to version 1.24.2:
    * Bug Fixes
  - better error message when kube client request timed out
    (dc11213)
  - close LegacyReportCh on action return (#629) (78033c6)
  - deploy ns on pre-pre-install stage (#630) (816d8c1)
  - panic if channel for legacy progress reporter closed (#618)
    (0e6945c)
  - pass NoPodLogs to kubedog (#622) (069609f)

++++ openQA:

  - Update to version 5.1783327469.933c54e2:
    * fix(obs_rsync): use scope guards to avoid stalls
    * chore(deps): Dependency cron 2026-07-04
    * feat: Retry git_clone minion job with exponential backoff
    * feat: request unredacted settings in openqa-clone-job and warn
    * feat: allow authenticated operators to fetch unredacted job settings

++++ os-autoinst:

  - Update to version 5.1783329367.214f5bc:
    * test: fix flaky timeout in t/18-qemu-options.t
    * feat: optimize and shorten pretty serial hook
    * test: Disable unstable `t/28-signalblocker.t` on ppc64le OBS builds
    * fix: Check also hidden files in checklist plugin
    * test: assert pipe size adjustment dynamically
    * test: assert terminal session boundary safety
    * refactor: support pretty markers in script_sudo and become_root
    * test: simplify Level 3 pretty marker detection

++++ palo:

  - Update to version 2.30
    * Avoid usage of dh_movetousr (Closes: #1122767).
    * ipl: Enhance comment about PDC version.

++++ perl-Mojolicious:

  - updated to 9.470.0 (9.47)
    see /usr/share/doc/packages/perl-Mojolicious/Changes
    9.47  2026-07-05
  - Added support for the QUERY HTTP request method from RFC 10008.
  - Added query and query_p methods to Mojo::UserAgent.
  - Added query method to Mojolicious::Routes::Route.
  - Added query method to Mojolicious::Lite.
  - Added query_ok method to Test::Mojo.
  - Fixed a security issue where the pure-Perl implementation of Mojo::JSON could exhaust all available memory when
    decoding deeply nested data. Decoding is now limited to 512 levels of nesting, to match the default of
    Cpanel::JSON::XS.
  - Fixed a memory leak in Morbo. (heikojansen)
  - Fixed Mojo::File::list_tree to no longer follow symbolic links to directories.

++++ prek:

  - Update to version 0.4.8 (.7 was not released):
    * Enhancements
  - Add default_env configuration (#2288)
  - Rename auto-update to update (#2286)
    * Bug fixes
  - Fix progress collapse ordering (#2291)
  - Fix progress insertion after collapsed rows (#2292)

++++ python-pymilter:

  - update to 1.0.6:
    * Drop paragraph about python 2.0 compatibility
    * Adapt to MTAs that use ':' as key terminator and/or add null char to
    * Remove calls to the deprecated method "assertEquals"
    * Work with berkeleydb and try importing it first.
  - drop set-c-standard-17.patch: obsolete
  - drop
    0001-Remove-calls-to-the-deprecated-method-assertEquals.patch:
    upstream
  - add fix-version.patch

++++ python-SpeechRecognition:

  - update to 3.17.0:
    * feat: Add AudioData.split() for chunking large audio data
    * Example: https://github.com/Uberi/speech_recognition/pull/896
    [#]issuecomment-4720478780
    * chore: Install ffmpeg direct in Linux for CI stability
    * **Full Changelog**: https://github.com/Uberi/speech_recogniti
    on/compare/3.16.1...3.17.0

++++ python-falcon:

  - update to 4.3.1:
    * Documentation and tests aside, this release is functionally
    identical to Falcon 4.3.0.
  - update to 4.3.0:
    * On the parsing side, this release introduces a family of new
    Request methods for extracting structured data from the query
    string – get_param_as_dict(), get_param_as_media(), and
    get_query_string_as_media() – together with a new `delimiter`
    argument for get_param_as_list(). Several of these align with
    OpenAPI v3 (and 3.2) parameter styles, making it easier to
    implement spec-compliant APIs on top of Falcon.
    * On the typing side, our internal annotations are now strict
    enough for the project to pass `mypy --strict falcon/`, and
    generic App types are now automatically parametrized by the
    default request/response types on CPython 3.13+.
    * This release also brings a number of smaller improvements,
    including MessagePack support in the test client, an opt-in
    `on_request()` default responder, and hardening of
    falcon.secure_filename() against Windows reserved device
    names.

++++ python-keystoneauth1:

  - update to 5.15.0:
    * Drop Python 3.10 support
    * trivial: Declare attributes on _BaseAdapter
    * zuul: Use openstack-python3-next-jobs template
    * pre-commit: Bump versions
    * Remove get_oslo_config helper
    * Drop unnecessary type: ignore
    * tox: switch to recommended constraints parameter
    * remove pbr as runtime dependency

++++ python-pyghmi:

  - update to 1.6.18:
    * Fixes for XCC3 storage config
    * Update SMM3 to handle common issue with FFDC

++++ python-Protego:

  - update to 0.6.2 (CVE-2026-55520, bsc#1270394):
    * Fixed a ReDoS (regular expression denial of service)
    vulnerability: URL patterns from robots.txt Allow and
    Disallow directives were compiled into regular expressions,
    where multiple * wildcards could cause exponential
    backtracking. A server could exploit this to cause denial of
    service by serving a crafted robots.txt file. Wildcard
    matching is now performed without regular expressions.
    Please, see the CVE-2026-55520 and GHSA-wjmf-p669-5m5p
    security advisories for more information.
    * Fixed parsing of Request-rate values where the seconds field
    has no time-unit suffix (e.g. 1/60 instead of 1/60s).
    Previously the last digit of the number was silently dropped.

++++ python-blockbuster:

  - Add patch support-python-315.patch:
    * Skip a test with Python 3.15+.

++++ python-caio:

  - Update to 0.10.2:
    * Package version is now defined in the project metadata and
    derived from the release tag, so caio.__version__ reports the
    real version instead of a stale hardcoded 0.9.25
    * Fix mypy errors on class-level backend attributes
  - Drop fix-version-info.patch: obsolete, upstream removed the
    stale caio/version.py it corrected
  - Use %pytest_arch macro in %check; additionally skip the
    test_env_selector tests, which assert the native io_uring/linux-aio/
    thread backends are selectable (the build chroot only offers the
    pure-Python fallback)

++++ python-easy-thumbnails:

  - update to 2.10.1:
    * Add support for Django-5.2.
  - drop py313.patch (upstream)

++++ python-fastmcp:

  - Update to version 3.4.3:
    * Version sync with python-fastmcp-slim, which carries all
    functional changes of this security and bugfix release (SSRF,
    DNS rebinding and OAuth redirect hardening, proxy session and
    JSON schema conversion fixes)

++++ python-fastmcp-slim:

  - Update to version 3.4.3:
    * Block SSRF allow-list bypasses via NAT64 and IPv6 transition
    addresses (6to4, Teredo, ISATAP)
    * Validate Host and Origin headers in the Streamable HTTP
    transport to prevent DNS rebinding against localhost servers
    * Reject unsafe OAuth redirect schemes and unregistered DCR
    redirect URIs; forward IdP auth errors to the MCP client
    * Isolate event store replay between sessions
    * Fix proxy session teardown races and KeyError on
    StatefulProxyClient.clear()
    * Preserve required discriminator tags and guard recursive
    references in JSON schema conversion
    * Fix caching middleware TypeError on cache miss and async
    rate-limiting client id callbacks
    * Add --verify flag for TLS certificate verification to the
    remote command
    * Bound the default OIDC discovery timeout and expose it on
    provider wrappers

++++ python-forbiddenfruit:

  - Add patch support-cursing-next.patch:
    * Add support for cursing __next__, to support Python 3.15.

++++ python-futurist:

  - update to 3.4.0:
    * Add release note for mp_context kwarg
    * tests: Fix ProcessPoolExecutor race on Python 3.14+
    * Drop Python 3.10 support
    * pre-commit: Bump versions
    * typing: Fixes for mypy 2.0.0

++++ python-httplib2:

  - update to 0.32.0:
    * Python support 3.8+ only
    * decompression limited by size and ratio
    * decoder foundation to support more compression algorithms

++++ python-httpx-retries:

  - Update to version 0.6.0:
    * Add retry_request and aretry_request helpers that run the
    retry loop at the client level, so errors raised while
    reading the response body (ReadTimeout, RemoteProtocolError)
    are retried too - something RetryTransport cannot do
    * Add validate_response option on Retry to retry when a
    callback rejects an otherwise-successful response
    * Allow overriding the Retry configuration per request via
    request.extensions["retry"]; the resolved Retry is exposed
    on response.extensions["retry"] for introspection
    * Add Retry.copy_with to derive a modified Retry configuration
    * No breaking changes - the existing API stays compatible
  - Run the upstream test suite in %%check instead of a bare
    import smoke test

++++ python-imagesize:

  - Add patch remove-upper-bound.patch:
    * Remove upper bound on Python versions.
  - Sprinkle in fdupes.
  - Ship the license in the built packages.

++++ python-kafka-python:

  - update to 3.0.7:
    * transport: cancel pending io coroutines on close()
    * producer: fix stalled shutdown when brokers unreachable

++++ python-lastversion:

  - update to 3.6.12:
    * Fixed Docker image publish on release
    * Moved the `NOSONAR` suppression for the missing `USER`
    directive off the `FROM` line; BuildKit's frontend rejects
    trailing inline comments on `FROM`, breaking the `Publish
    Docker image` workflow in 3.6.11
    * Fixed `Version` object JSON serialization error when caching
    release data with dict output format
    * The `version` field is now serialized to string at the cache
    layer for both file and Redis backends
    * This fixes the "Object of type 'Version' is not JSON
    serializable" warning when running `lastversion --changelog
    * .spec`
    * Companion to the 3.6.8 datetime serialization fix; the dict-
    format path kept `version` as a `Version` instance and
    tripped the same cache encoder

++++ python-latexcodec:

  - update to 3.0.1:
    * Drop Python 3.7 and 3.8 support.
    * Add Python 3.13 support.
    * Use new pkg_resources files interface (see issue #98).

++++ python-libtmux:

  - update to 0.61.0:
    libtmux 0.61.0 hardens support for the tmux 3.7 patch line. It
    fixes Pane.break_pane() naming broken-out windows libtmux instead
    of tmux's own default on tmux 3.7a/3.7b, and adds
    get_version_str() for reading the raw tmux version with its
    point-release suffix intact.
    * Highlights
  - Fix — break_pane() keeps tmux's default window name on
    3.7a/3.7b (#699). Breaking a pane into a new window without
    an explicit window_name left it named libtmux on tmux
    3.7a/3.7b; it now keeps tmux's own default (typically the
    running command). Passing window_name is unaffected.
  - New — get_version_str() (#699).
    libtmux.common.get_version_str() returns the running tmux
    version verbatim, keeping the point-release suffix ("3.7a")
    that get_version() strips for numeric comparison — useful for
    telling patch releases apart, e.g. 3.7 from 3.7a.
  - tmux 3.7a/3.7b test compatibility (#698). The test suite now
    passes against tmux 3.7a and 3.7b, which CI also exercises.
    * What's Changed
  - docs: lead topic pages with the concept, add docs voice guide
    by @tony in #696
  - Fix window-name test for tmux 3.7a/3.7b and add them to CI by
    @tony in #698
  - Fix break_pane forcing 'libtmux' window name on tmux
    3.7a/3.7b by @tony in #699

++++ python-llvmlite:

  - update to 0.48.0:
    * https://llvmlite.readthedocs.io/en/latest/release-notes.html#v0-48-0rc1-june-4-2026

++++ python-openapi-spec-validator:

  - update to 9.0.0:
    * Upgrade schema-validator 0.9 #505
    * Upgrade jsonschema-path 0.5 #506
    * Validation results may change for specifications that previously
    relied on discriminator-based narrowing or on discriminator mapping
    resolution errors during validation. #505

++++ python-pamqp:

  - update to 4.0.1:
    * Migrated documentation from ReadTheDocs to GitHub Pages
    (MkDocs)
    * Updated docs/dev dependencies: lxml 6.0.2→6.1.0, urllib3
    2.6.3→2.7.0, idna 3.11→3.15, pymdown-extensions
    10.21.2→10.21.3
    * Correctly decode negative Decimals and Decimals in scientific
    notation, preventing corrupted and silently-lost values
    * Decoders now raise the documented `ValueError` instead of
    leaking `struct.error` on truncated or malformed input
    * Validate short/long string and field-table key byte lengths,
    raising a clear `TypeError` instead of a cryptic
    `struct.error`
    * `BasicProperties.__eq__` returns `NotImplemented` for non-
    Properties operands so comparisons yield `False` instead of
    raising
    * Correctly round-trip frames with 8+ consecutive bit fields
    * Corrected the `short_int` range error message
    * Prevent an infinite loop in `ContentHeader._get_flags` on
    malformed flags
    * Prevent an infinite loop when decoding malformed field
    arrays/tables

++++ python-pipdeptree:

  - update to 3.1.1:
    * Validate archive hash parts
    * fix(extras): scope optional deps to requesting edge

++++ python-psychtoolbox:

  - update to 3.0.22.2:
    * Mostly lots of bug fixes and smaller feature work and
    refinements. Most of the work done in the last six months is
    "behind the scenes" work, preparing for the future, but not yet
    visible to users in the form of new features or
    obvious improvements, beyond what is listed here.
    * https://github.com/Psychtoolbox-3/Psychtoolbox-3/releases/tag/3.0.22.2

++++ python-publicsuffixlist:

  - update to 1.0.2.20260703:
    * various toplevel domain updates

++++ python-pyaml:

  - update to 26.7.0:
    * dump.write: don't trap AttributeError in dst.write(b'') str-or-bytes

++++ python-pyinstaller-hooks-contrib:

  - update to 2026.6:
    * Fix bug in pyi_rth_osgeo.py where the "GDAL_DATA" environment
    variable would not get set on Windows when building from a
    conda environment. (#1021)
    * Update dash hook for compatibility with dash 4.2.0. (#1026)
    * Update toga hooks for compatibility with toga 0.5.4. (#1016)

++++ python-pyleri:

  - update to 1.5.1:
    * Stop greedy choice after full input match

++++ python-quimb:

  - update to 1.14.0:
    * `tensor_compress_bond`: rename input tensor args `ta` and
    `tb`
    * `D2BP`: support fermionic tensor networks (only computing
    norm^2 so far, gating/compression need work).
    * `tensor_compress_bond`: add `reduce_opts` for controlling the
    decomposition options used when reducing each tensor before
    the main truncating decomposition. For example
    ``reduce_opts={"method": "qr:cholesky"}``.
    * add `TensorNetworkGen.select_sites` as a convenience method
    for selecting a sub network given a list of sites.
    * add `PEPO_product_operator` for bond-dimension-1 PEPOs given
    by a product of on-site operators, including cyclic boundary
    conditions via ``cyclic=True`` or ``cyclic=(cyclic_x,
    cyclic_y)``.
    * `PEPO`: accept explicit ``cyclic`` kwarg in the constructor,
    to override shape-based boundary-condition inference
    (required for bond dimension 1 cyclic PEPOs).
    * `TensorNetworkGenOperator`: add generic `apply` (dispatching
    on operator/vector tensor networks), `trace` and
    `partial_transpose` methods. These now work for arbitrary
    geometry operator tensor networks (including MPO and PEPO);
    ``partial_transpose`` supports arbitrary hashable site
    labels. ``apply`` also gains an ``inplace`` option that
    propagates to the *acting* operator rather than the one being
    acted on.
    * add `TensorNetworkGen.has_site` to test whether an object is
    a valid site label of a tensor network. The generic
    implementation checks membership in the site set; 1D, 2D and
    3D tensor networks override it with a fast bounds check.
    * add `LocalHam2D.build_pepo_propagator_trotterized` for a
    first-order Trotter decomposition of ``expm(x H)`` as a PEPO.
    Accepts an `ordering` argument to control the order in which
    terms are applied.
    * `TensorNetwork.split_simplify`: consider all candidate
    bipartitions for each tensor and accept the one that
    minimizes the resulting maximum tensor size, rather than the
    first reduction found.
    * `contract_hotrg`, `coarse_grain_hotrg`, their 3D
    counterparts, and `tensor_network_ag_compress_projector`: add
    `gauge_power` parameter to control the power applied to the
    bond gauge weights when `canonize=True` before computing the
    compressed projectors.
    * `RegionGraph`: add `get_maximal_regions`,
    `get_minimal_regions`, and `get_maximal_ancestors` helpers
    for querying the region hierarchy.
    * `Drawing`: add orthographic projection mode alongside the
    existing axonometric projection via the new `projection`
    parameter (replaces `a`/`b`). Named presets include
    `"orthographic"`, `"axonometric"`, and `"isometric"`.
    * `Drawing.translate`: new context manager to temporarily
    offset all draw operations in coordinate space (before
    projection).
    * `Drawing.translate_screen`: new context manager to
    temporarily offset all draw operations in screen space (after
    projection).
    * `Drawing.grid3d`: automatically select back-facing planes
    based on projection so grids always appear behind the scene,
    use readable tick label orientations for all projections, and
    place axis labels correctly.
    * `CircuitPermMPS.sample`: fix output bitstring ordering when
    the internal MPS qubit order is permuted ({issue}`327`).
    * `TensorNetwork.split_tensor`: fix handling of `absorb=None`,
    adding all tensors returned by the split ({issue}`260`).
    * `D2BP.gate_`: correctly mark touched tensors and rebuild
    local contraction expressions after applying gates.

++++ python-scikit-hep-testdata:

  - update to 0.6.6:
    * Add pylhe lheh5 test files
    * Add automatic support for HDF5
    * chore: add an AGENTS file
    * refactor: remove dead code and stale comments

++++ python-signxml:

  - update to 5.1.0:
    * Implement point-in-time verification
    * xades: fix CertDigest handling
    * Confirm certs passed to validate are X.509 formatted
    * Clarify location parameter syntax
    * Increase minimum cryptography version to 45
    * X.509 certificate valitation now requires the provided
    certificate to list digital signature as a key usage.
    * fix rst formatting
    * Support setting certificate validation policy

++++ python-uproot:

  - update to 5.7.5:
    * feat: support path objects with storage_options in
    uproot.open
    * feat: finish implementing `library` kwarg for RNTuples
    * fix: implement report=True for RNTuple.iterate
    * fix: `uproot.dask` cannot handle grouped `TObject` properly
    * fix: add typenames to form so Coffea can use them
    * fix: interpretation dtype handling returned byte-swapped data
    * fix: avoid std::any in pyroot_to_buffer to support older ROOT
    versions
    * fix: accidental dropping of AsGrouped
    * fix: concurrency settings from build workflow
    * ## Other
    * ci: pin micromamba version and bump Pyodide version
    * chore: update pre-commit hooks
    * ci: Move fsspec-xrootd into separate dependency group

++++ python-versioneer:

  - Run the testsuite like upstream to avoid failures with Python 3.15.

++++ python-wadllib:

  - update to 2.1.0:
    * Add support for Python 3.14.

++++ python-zc.customdoctests:

  - Loosen nspkg.pth path, it is now per-Python version.
  - Add missing Requires on setuptools.

++++ python-zc.lockfile:

  - update to 4.0:
    * Replace pkg_resources namespace with PEP 420 native
    namespace.
    * Add support for Python 3.12, 3.13.
    * Drop support for Python 3.7, 3.8.

++++ python-zope.deferredimport:

  - BuildRequires profiling for Python 3.15+.
  - Drop unneeded Requires on setuptools.

++++ python-zope.testing:

  - Update to 6.2:
    * Add support for Python 3.15.
    * Deprecate zope.testing.doctestcase in favour of plain doctest.
    * Move package metadata from setup.py to pyproject.toml.

++++ redumper:

  - Update to version 729
    * Show built-in option defaults in --help regardless of
    overrides.
    * Stop generating DVD ecc and replace with null bytes.
    * Redump dot info #397.
    * Print PS3 firmware version.
    * Log hfs volume identifier.
    * Add new Drives #387.
  - Update patches
    * redumper-no-static-linking.patch
    * redumper-use-system-googletest.patch

++++ rqlite:

  - Update to version 10.2.7:
    * Remove explicit database-level read-only check from the pure
    Query path
    * Miscellaneous Store-level fixes related to resource management
    and shutdown sequence
    * Don't run CRC checks twice on Snapshot when fast-restart is
    explicitly disabled
    * Fixes to the http package including SQL rewriting control.
    * Address potential dropped CDC event on restart
    * Various minor fixes
  - includes changes from 10.2.6:
    * Handle a fully-executed Reap plan, but Plan file itself not
    removed
    * Close Snapshot streamer on error.
  - includes changes from 10.2.5:
    * Perform a Quick Integrity check after reaping snapshots, not
    Full

++++ rubygem-uri:

  - New upstream release 1.0.4
    * Fixed: credential exposure via URI + operator [CVE-2025-61594][bsc#1255833]

++++ semaphore:

  - Update to version 2.18.20:
    * Bugfixes
  - Validate playbook path
  - Update to version 2.18.19 (.17 and .18 were not released):
    This patch release includes several important security and
    validation fixes.
    * Security fixes
  - Added validation for Git repository URLs to prevent Git
    option injection.
  - Added --end-of-options to Git commands to make repository URL
    and branch handling safer.
  - Fixed branch override handling: task-level Git branch
    override is now applied only when the template explicitly
    allows it.
  - Prevented custom roles from shadowing built-in role slugs
    such as owner or manager.
  - Fixed permission resolution so built-in roles always use
    their built-in permissions instead of database-defined custom
    roles.
  - Added validation to prevent access keys from being updated
    with a different ID or moved to another project.
    * Reliability and tests
  - Added tests for Git URL validation and Git command injection
    protection.
  - Added tests for access key update validation.
  - Added tests for custom role validation and reserved role
    slugs.
  - Refactored Git branch resolution into a dedicated helper to
    make task behavior more consistent.
  - Update to version 2.18.16 (.15 was not released):
    * Bugfixes
  - Fix variable groups sync functionality

++++ tik:

  - Update to version 1.5.2:
    * [15-encrypt] Give up on using sdbootutil in a chroot, pollute install environment and use sbootutil from there

++++ webcamoid:

  - Update to version 9.4.0
    New features:
    * Added local HTTP streaming support, allowing video and audio
    to be served over the local network to browsers and players
    like VLC, as a more stable and portable alternative to the
    virtual camera.
    * Added basic support for streaming to RTMP platforms, with
    stream keys/URLs configurable from the video outputs,
    support for multiple simultaneous streams, and a streaming
    button that informs the user when a platform needs to be
    added or configured.
    * Reworked the audio layer: removed JACK, SDL, and Qt Audio
    dependencies; users can now select and combine multiple
    audio inputs with individual volume control, plus volume
    control on the audio output; PulseAudio can now be loaded
    dynamically.
    * Added a media gallery with playback controls.
    * Added simple quality sliders with presets for video
    recording and streaming.
    * Added an OpenGL ES 2.0 effects pipeline and ported many
    effects to it (AnalogTV, Aging, Cartoon, Charify, Cinema,
    Dice, Edge, Emboss, FaceTrack, Fire, GrayScale, Hypnotic,
    Matrix, Otsu, Pixelate, Radiactive, Swirl, Vignette, Warhol),
    optimizing the pipeline.
    * Added screen capture support for wlroots-based Wayland
    compositors via the wlr-screencopy protocol.
    * Added support for capturing individual windows in desktop
    capture.
    * Added support for right-to-left languages.
    * Added single instance mode.
    Removed:
    * Removed AudioGen, and the GStreamer/VLC playback plugins.
    * Removed MultiSink in favor of using muxers/encoders directly.
    Bug fixes:
    * Fixed audio/video synchronization for both FFmpeg and NDK
    playback.
    * Fixed a bug preventing simultaneous video audio playback and
    microphone capture on some configurations (e.g. headsets).
    * Fixed PipeWire camera capture.
    * Fixed multiplanar format support with Qt camera capture.
    * Fixed V4L2 format detection, falling back to VIDIOC_S_FMT
    and predefined formats when
    VIDIOC_TRY_FMT/VIDIOC_ENUM_FRAMESIZES fail.
    Improvements in the UI and user experience:
    * Adapted camera controls, preferences, and About menus, plus
    item delegates, for small screens.
    * Moved flash-related options into the Settings dialog.
    * Allowed hiding on-screen controls when the pointer moves
    away.
    * Added printing of detected camera information for easier
    debugging.
    Translations support:
    * Completed translations for dozens of languages (Arabic,
    Chinese Simplified/Traditional, French, German, Hebrew,
    Hindi, Indonesian, Japanese, Korean, Portuguese, Russian,
    Turkish, Vietnamese, and many more), and updated several
    existing ones via Weblate.
    Other changes:
    * Limited image save formats to png, jpg, webp, and avif.
    * Removed unnecessary assets.
    * Added a privacy policy.
  - Drop webcamoid-link_pipewire_libs.patch and
    webcamoid-fix_ppc64_detection.patch (merged upstream)

++++ wolfictl:

  - Update to version 0.39.21:
    * build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0
    (#2010)

++++ xca:

  - Fix build error for Tumbleweed.
    Qt6Concurrent is needed to build.

------------------------------------------------------------------
------------------  2026-7-5  -  Jul 5 2026  -------------------
------------------------------------------------------------------

++++ libcanlock:

  - Update to version 3.3.2
    * Bugfix: canlock-hp: Define parameter list for strip_body() as
    "void" (Patch from Dennis Preiser).
    * Bugfix: Modified declaration of RFC5869HkdfResult() in header
    to match the function definition.
    * Bugfix: Modified definition of RFC2104HmacResult() to match
    the function declaration in header.
    * Add support for C23 memset_explicit() to cl_clear_secret().
    * Document that canlock-hp subpackage requires an US-ASCII
    based POSIX locale (EBCDIC is not supported).
    * Add SPDX copyright and license identifiers for all files of
    the source tree. Note that the license terms are unchanged for
    all files that already contained such identifiers.
    * Some documentation files (like "README" and "ChangeLog")
    formerly had neither copyrights nor licenses assigned.
    No copyright and CC0-1.0 license are declared now.
    * Package is REUSE 3.3 conformant (according to "reuse lint").

++++ chirp:

  - Update to version 20260626:
    * uvk5_egzumer: Fix battery_text and mic_bar never being saved
    * Fix open filter translated string

++++ endless-sky:

  - Update to version 0.11.2
    * Pacifist worlds in human space that do not offer tribute now
    have their own set of responses when it is demanded, as
    opposed to responding as if your combat rating is not high
    enough yet.
    * The player's cloak state will now persist in the save file.
    This means that if you land while cloaked, close, and reopen
    the game, you will still be cloaked when taking off, which was
    already the behavior if you landed while cloaked and then
    departed without having closed the game.
    * The shop UI now has a dropdown for selecting the number of
    items to buy, sell, or move.
    * Added a setting for globally modifying text alignment
    in paragraphs.
    * Using the "Reload" button in the main menu after dying no
    longer crashes.
    * The Successor wormhole can now be used when hostile to the
    Successors.
    * Various fixes and improvements to mouse controls when the
    "Control ship with mouse" preference is on.
    * Moved the planet description in the map panel down a little so
    it no longer overlaps with the system name when the
    game window is small.
  - Drop Leap 15 workarounds, Leap 15 is EOL

++++ gap-groupoids:

  - Update to release 1.82
    * Removed support for old GAP versions from the testsuite
    subtest "cosets".

++++ gap-smallantimagmas:

  - Update to release 0.6.0
    * Allow smallantimagmas to accept list as identifier list

++++ gap-twistedconjugacy:

  - Update to release 3.4.0
    * Improved `ReidemeisterNumber` for pairs of homomorphisms where
    both source and range have their conjugacy classes precomputed.
    * Improved `CoincidenceReidemeisterSpectrum` for non-abelian
    groups.

++++ giada:

  - Update to version 1.5.0:
    * Prepare version 1.5.0
    * Allows MIDI-generating plugins to forward their output to subsequent plugins
    * [Refactor] Move PluginAudioPlayHead to separate source file
    * [Refactor] Rename PluginHost::Info class to PluginAudioPlayHead
    * PluginsApi: remove unused method
    * Pass PPQ (as in JUCE's position-per-quarter-note) value to Plugin via juce::Playhead
    * c::Plugin: forward-declare Plugin and PluginParameter
    * [Refactor] Move PluginParameter outside of Plugin class
    * [Refactor] gdPluginList: cleanup plugin list navigation bounds checks
    * c::Plugin: don't cache 'hasEditor' property
    * Add missing 'sampleRate' value to patch (#802)
    * gePluginElement: avoid extra copy of c::plugin::Plugin object
    * [Refactor] c::plugin::Plugin: remove access to underlying ptr
    * c::plugin: remove unused function
    * [Refactor] Don't use vector of m::Plugins in c::plugin::Plugins, use c:: type
    * c::plugin: remove unused function
    * [Refactor] Simplify parameter fetching in gePluginParameter
    * [Refactor] Use vector of c::plugin::Param in c::plugin::Plugin in place of raw indexes
    * [Refactor] Pass m::Plugin::Parameter ref to c::plugin::Parameter object
    * [Refactor] Swap plug-ins by ID, not by m::Plugin* ptrs
    * [Refactor] Remove swapPlugin() method from PluginHost
    * [Refactor] Remove all plug-ins in a channel by ID, not by vector of m::Plugin ptrs
    * [Refactor] Remove plug-ins by ID, not by m::Plugin ptr
    * Plugin: stop caching the 'hasEditor' property
    * UI: optimize plug-in parameter repaint in gdPluginWindow
    * gdPluginWindow: add updateParameter() method
    * gdPluginWindow: add assertion + tidy up code
    * [Refactor] Change c::plugin::Param member name
    * Remove old params methods from m::Plugin, use new approach
    * Plugin: remove midiInParams public member
    * Plugin: add getParameters() accessor
    * Plugin: prepare vector of Parameter objects
    * Add new Plugin::Parameter class (unused)
    * geBox: redraw when setting new label
    * Sequencer: fix comment
    * [Refactor] Use TimeSignature in place of raw beats/bars variables
    * gdMainWindow: fix spacing around main menu
    * geMainWindow: simplify flex structure
    * Update project name on save + remove unused function
    * gdMainWindow: make variable private
    * gdMainWindow: show version number in footer
    * Limit maximum CPU load value to 100.0
    * Increase master I/O VU meters precision
    * UI: display project name in main window footer
    * UI: show 'Giada' + version number in main window title
    * [Refactor] geBox: add getter/setter methods for label, delete old ones
    * geBox: use v::drawings function for draw() method
    * geBox: add ability to customize text color
    * gdMainWindow: avoid variable shadowing
    * UI, mainWindow: display CPU load widget in footer
    * UI, mainWindow: add new footer (empty)
    * Add API for CPU load display
    * UI: add new geCpuLoad widget
    * Enable CPU load computation (core only)
    * model::Shared: Add new Shared from KernelAudio
    * model::KernelAudio: add internal Shared object with CPU load atomic variable
    * Don't lock the document while saving the project (#799)
    * SampleChannel: remove unused methods
    * Prevent creating invalid FrameRange when de-serializing JSON
    * gePianoRoll: simplify onRefreshAction()
    * gdBaseActionEditor: simplify pixelToTick() method
    * Action Editor: simplify even more MIDI action handling
    * Revert 042fad599f8dcebf4c89b2124a892ce7bc848eef
    * Simplify action handling for Sample Channels in PRESS mode
    * Action Manager: remove wrong assertion
    * Action Editor: fix toTickRange conversion for sample actions
    * geBaseActionEditor: simplify even more toTickRange() method
    * geBaseActionEditor: rework toTickRange method
    * geBaseActionEditor: pass ActionEdit enum to onRefreshAction() (unused)
    * geBaseActionEditor: tidy up header file
    * [Refactor] move toTickRange() from gdBaseActionEditor to geBaseActionEditor
    * geGridTool: refactor member name
    * Action Editor: fix grid rendering
    * geGridTool: refactor method name
    * geBaseActionEditor: use correct type for grid drawing
    * gePianoRoll, geSampleActionEditor: simplify onResizeAction() method
    * gdBaseActionEditor: allow 1 tick actions
    * geSampleActionEditor: add nullptr check
    * Action Editor: simplify onRefreshAction() method in both PianoRoll and SampleActionEditor
    * geBox: remove getBounds() method
    * geEnvelopePoint: fix constructor
    * Actions: simplify rec() method with no calls to findAction()
    * Actions, ActionManager: remove unused methods
    * [Refactor] Avoid passing around multiple copies of Actions from model to Action Editor
    * ActionManager: DRY + add more asserts
    * [Refactor] Use ID instead of Action refs for action operations
    * geBox: add getBounds() method
    * geBox: make draw() method as protected
    * geBaseAction: use geBox as parent class
    * Update mcl-utils dep to fix build error on macOS, again
    * Update mcl-utils dep to fix build error on macOS
    * Update geompp dependency
    * Add TODO notes
    * Remove unused code, fix method name
    * Action Editor: restore snap to grid
    * utils::time: add quantize() for Tick
    * Sequencer: adjust quantize() method to work tick-based
    * Update mcl-utils submodule
    * Don't write old 'sampleRate' value from Patch on save
    * Add support for old patches with frame-based actions
    * Sequencer: make sure actions are actually in the current block
    * u::time: add frameToTickRound() function
    * Sequencer: remove unused method
    * Don't pre-compute frames in model::Sequencer, just do it on the fly when needed
    * Tick: add support for % operator
    * Move currentTick computation to model::Sequencer
    * Remove 'frame' property from Action struct
    * ActionManager: fix const correctness in consolidate() method
    * model::Actions: update comments
    * [Refactor] Dry model::Actions private method
    * model::Actions: remove unused methods
    * Enable tick-based live recording
    * ActionManager: remove old unused method
    * model::Actions: use tick-based exists() method in rec()
    * Update action persistence code to use tick instead of frame
    * [Refactor] Sequencer: better name for Block struct
    * Remove all frame recomputation on bpm/samplerate change
    * Sequencer: enable tick-based rendering
    * model::Actions: sort actions by tick
    * Add new frameRangeToTickRange utils function
    * [Refactor] Rename SampleRange -> FrameRange for consistency with TickRange
    * ActionManager: remove deprecated methods, update tests
    * Action Editor: show tick-based playhead
    * Sequencer, MainApi: add getCurrentTick() method
    * c::ActionEditor::Data: remove old members
    * BaseActionEditor: use correct type in std::min function
    * BaseActionEditor: adjust tick-based zoom
    * SampleActionEditor: display actions tick-wise
    * Enable adding/moving new tick-based sample actions
    * Cleanup some deprecated/unused functions
    * Enable move tick-based MIDI actions around
    * ActionManager: mark updateMidiAction() method as deprecated
    * UI: initial tick-based painting in Action Editor
    * Sequencer: add more utility functions (unused)
    * model::Actions: debug actions by tick
    * Record tick-based MIDI actions
    * ActionEditorApi: add new tick-based recordMidiAction() method (unused)
    * Utils: add tick <-> pixel conversion functions
    * model::Sequencer, Sequencer: add getTicksInLoop() method (unused)
    * model::Sequencer: use TimeSignature object + encapsulation
    * Add new TimeSignature type
    * [Refactor] model::Sequencer: make bpm member private
    * Change G_PPQ type to Tick
    * Tick: add more operators
    * ActionEditorApi: mark recordMidiAction() method as deprecated
    * ActionManager: add new tick-based recordMidiAction() method + utilities
    * model::Actions: add new tick-based rec() method + TickRange alias
    * model::Actions: mark another rec() method as deprecated
    * Mark G_DEFAULT_ACTION_SIZE as deprecated, add new tick-based one
    * ActionRecorder: mark rec...() methods as deprecated
    * model::Actions: add new tick-based rec() method (unused)
    * model::Actions: mark rec() method as deprecated
    * ActionFactory: add new makeAction() method (unused)
    * ActionFactory: mark makeAction() method as deprecated
    * Action: add new 'tick' member (unused)
    * Bump version to 1.5.0
    * Sequencer: optimize actions parsing by moving it outside the main block loop
    * Undo 'Sequencer: simplify 'sceneChanged' code in advance() method', was wrong
    * model::Actions: cleanup
    * model::Actions: sort actions on set() method
    * Update rendering engine to work with new Sequencer::Event type
    * Sequencer: fill EventBuffer with actions coming from the std::span
    * Sequencer: add internal ActionsBlock struct (still unused)
    * Sequencer: use new Block object for event parsing in advance()
    * Sequencer: add internal Block struct (still unused)
    * Sequencer: simplify 'sceneChanged' code in advance() method
    * Sequencer: add comments
    * Sequencer: use SampleRange in advance() method instead of raw start/end values
    * Sequencer: mark 'actions' member in Event struct as deprecated
    * model::Actions: add getActionsInSampleRange() method (still unused)
    * Deserialize actions with new container
    * model::Actions: remove more deprecated methods
    * ActionFactory: update serializeActions() to use new Actions container
    * model::Actions: rework hasActions() method to use new container
    * model::Actions: rework clearAll() to use new container
    * model::Actions: rework updateSiblings() to use new container
    * model::Actions: rework updateEvent() to use new container
    * model::Actions: rework updateKeyFrames() method to use new container
    * model::Actions: remove removeIf() method, use mcl::utils
    * model::Actions: add new getAll() method, remove forEachAction
    * model::Actions: mark getAll() method as deprecated
    * model::Actions: remove unused method
    * model::Actions: remove findAction_DEPR_, adjust new ones
    * model::Actions: rework getActionsOnChannel() to use new container
    * model::Actions: rework rec() method (for live recording) to use new container
    * model::Actions: rework rec() method to use new container
    * model::Actions: add private findAction() method based on new container
    * model::Actions: mark findAction() method as deprecated
    * model::Actions: rework debug() method to support new container
    * model::Actions: reimplement rec() method based on new container
    * model::Actions: add new private sort() method (still unused)
    * model::Actions: add new exists() private methods (still unused)
    * model::Actions: mark private methods as deprecated
    * model::Actions: add std::vector<Action> container (still unused)
    * model::Actions: mark m_actions map as deprecated
    * Add utility functions for Frame <-> Tick conversions
    * Add new Tick type
    * Prepare release 1.4.2
    * [Linux] Fix broken build
    * Fix sample channels being killed abruptly on scene change (#792)
    * [Refactor] Change method name
    * Remove VST logo in About window (#798)
    * model::Sequencer: add recomputeFrames() method
    * Add model::Sequencer::reset() method
    * Sequencer: remove unused method
    * Sequencer: store current sample rate internally
    * JackTransport: add isAvailable() method (still unused)
    * Add ability to copy the whole scene to another (#766)
    * [Refactor] Rename ActionRecorder -> ActionManager
    * Add ability to force-change a scene (#764)
    * Add scene support to 'edit -> clear all actions' function (#787)
    * ChannelsApi: join two functions
    * Fix label text
    * ChannelManager: minor optimization to free sample channel algorithm
    * Add scene support to 'edit -> free all sample channels' function (#787)
    * UI: add missing popup labels to scene buttons (#785)
    * geScenes: DRY
    * Bump version to 1.4.2
    * Update copyright date

++++ gnome-builder:

  - Update to version 50.0:
    + Updated translations.

++++ helmfile:

  - Update to version 1.7.0:
    * build(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by
    @dependabot[bot] in #2664
    * fix: ensure OCI charts are prepared for needed releases with
  - -include-needs by @yxxhero in #2663
    * fix: serialize concurrent helm operations for same chart to fix
    [#768] by @yxxhero in #2662
    * fix: clean up chartify temp directories after helm operations by
    @yxxhero in #2668
    * feat: add --template-args flag to template/apply/sync for helm
    lookup() support by @yxxhero in #2666
    * fix: support go-getter URLs in ad-hoc dependencies to fix #821
    by @yxxhero in #2670
    * test: add integration test for issue #1880 transformers with
    file:// deps by @yxxhero in #2673
    * fix: replace YAML-based DeepCopy with recursive deep copy to fix
    [#973] by @yxxhero in #2675
    * build(deps): bump github.com/helmfile/vals from 0.44.2 to 0.44.3
    by @dependabot[bot] in #2677
    * test: add integration test for selector filtering with
    requiredEnv (#1172) by @yxxhero in #2678
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.25 to 1.32.26 by @dependabot[bot] in #2681
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.104.0 to 1.104.1 by @dependabot[bot] in #2682
    * feat: add inherits: for sub-helmfile config inheritance by
    @yxxhero in #2680
    * feat: Add ConditionTemplate support in releaseSpec by @agarov
    in #2669
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.26 to 1.32.27 by @dependabot[bot] in #2684
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.104.1 to 1.104.2 by @dependabot[bot] in #2685
    * build(deps): bump github.com/helmfile/vals from 0.44.3 to
    0.44.4 by @dependabot[bot] in #2686

++++ lazygit:

  - Update to version 0.63.0:
    * Update docs and schema for release
    * Update translations from Crowdin
    * Remove unused function ExpectClipboard
    * Show renamed files in the custom patch builder
    * Add gui.shrinkSidePanelsToContent option
    * Scale the side-panel layout height thresholds by panel count
    * Allow overriding the platform used for default keybindings
    * Offer to delete the branch when removing a worktree
    * Allow deleting local+remote of a worktree-checked-out branch at once
    * Delete the branch when deleting it via its worktree
    * Let worktree removal/detach chain follow-up work
    * Extract reusable branch-deletion helpers
    * AGENTS.md additions
    * Expand a leading ~ in worktree paths to the home directory
    * Move the new-worktree keybinding from worktrees to universal
    * Add MoveYamlKey helper to move config keys between sections
    * Rework the worktrees-panel 'n' into a branch picker
    * Redesign the 'w' worktree-creation flow
    * Add helper to compute candidate worktree parent directories
    * Add worktree.defaultPath config
    * Remove the Windows limitation from Custom_Pagers.md
    * Materialize cursor-forward escapes as space runs
    * Demonstrate that cursor forward escapes collapse runs of spaces
    * Convert forward cursor-positioning escapes into row advances
    * Demonstrate that cursor positioning escapes collapse blank rows
    * Use ConPTY on Windows for pty-backed command execution
    * Add pty support on Windows via ConPTY
    * Abstract pty startup behind a platform-specific primitive
    * Abstract task command over *exec.Cmd
    * Always set LAZYGIT_COLUMNS
    * Have "just lint" show all issues instead of just the first so many
    * Auto-dismiss the continue-rebase prompt when it becomes stale
    * Only prompt to continue a rebase/merge if we started it
    * Make Gui.Update a synchronous FIFO enqueue
    * Run moveMainContextPairToTop before queueing main-view tasks
    * Make ViewBufferManager.NewTask respect call order
    * Revert "Add GlobalArg/GlobalArgIf to GitCommandBuilder"
    * Suppress optional locks by default again, except foreground refresh
    * Reintroduce the gitCmdObjBuilder wrapper
    * Run `go mod tidy` before `go mod vendor`
    * Check gofumpt formatting with the pinned version in CI and lint
    * Add gofumpt-tool.sh script and use it in VS Code
    * Use `go tool gofumpt` for `make format`
    * go get -tool mvdan.cc/gofumpt@v0.9.2
    * Remove obsolete "errors" step from lint job on CI
    * Remove obsolete bump_gocui.sh script
    * Bump golang.org/x/net from 0.47.0 to 0.55.0
    * Bump golangci/golangci-lint-action from 9.2.0 to 9.3.0
    * Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
    * Bump actions/checkout from 6 to 7
    * Bump actions/cache from 5 to 6
    * Bump github.com/sahilm/fuzzy from 0.1.2 to 0.1.3
    * Bump golang.org/x/sys from 0.45.0 to 0.46.0
    * Bump golang.org/x/sync from 0.20.0 to 0.21.0
    * Pick both hunks, not the common ancestor, in diff3 conflicts
    * Add a test for picking both hunks in a diff3 conflict
    * Give opts.Stop priority in NewCmdTask's read loop
    * Addition to AGENTS.md
    * Stop leaking other malformed and unimplemented escape sequences
    * Silently consume unrecognized escape sequences
    * Demonstrate that unknown escape sequences leak as literal text
    * Extract per-case render helpers from FilesController.GetOnRenderToMain
    * Show per-side commit logs for submodule conflicts in the main view
    * Resolve submodule conflicts through a picker
    * Route space to the conflict picker for non-textual conflicts
    * Extract a predicate for conflicts that need a resolution dialog
    * Addition to AGENTS.md
    * Add a global keybinding for editing the config file
    * Extract editConfig into a shared EditConfigAction
    * Remove unnecessary askForConfigFile indirection
    * Remove the "Open config file" command
    * Test per-repo side panel config and re-application on repo switch
    * Re-apply the side panel config on a live config reload
    * Add an IsActiveTab assertion for integration tests
    * Let integration tests post a focus event
    * Clear tab strips on views that are no longer tabs
    * Add integration tests for configuring the side panels
    * Show each panel's first configured tab by default
    * Scale the minimum window height with the panel count
    * Give the submodules and reflog views standalone titles
    * Drive the side panel layout from gui.sidePanels
    * Stop requiring jumpToBlock to have exactly five entries
    * Add the gui.sidePanels config option
    * Assign panel jump labels by iterating panel groups
    * Make the remote-branches view follow its parent's window
    * Drive side-panel layout from a single window list
    * Ask agents to surface mid-implementation decisions
    * Add end-to-end test for shell command quoting on Windows
    * Fix quoting of shell commands on Windows
    * Demonstrate that shell metacharacters are mangled on Windows
    * Demonstrate that Quote produces invalid Windows quoting
    * Use headless mode for the "Run current file integration test" vscode task
    * Remove "Open deprecated test TUI" vscode task
    * Use `just` instead of `make` in AGENTS.md
    * Document running the integration tests via the just recipes
    * Add zsh completion for the e2e integration-test recipes
    * Restructure integration-test just targets
    * Remove bespoke commit selection restoration when starting a rebase
    * Restore commit selection even when the commit's TODO status changed
    * Keep selected commits stable across refreshes
    * Allow GpgHelper to refresh differently on success and failure
    * Cleanup: wrap long parameter lists
    * Cleanup: remove unnecessary `if` statement
    * Add HeadCommitIdx helper function
    * Add tests for IsHeadCommit
    * Tighten a test expectation
    * Remove the now-redundant gitCmdObjBuilder wrapper
    * Only pass --no-optional-locks for background status refreshes
    * Add GlobalArg/GlobalArgIf to GitCommandBuilder
    * Detect external ref changes via background polling
    * Snapshot refs state before refs-touching refreshes
    * Add config options for external change detection
    * Add Status.RefsSnapshot
    * Centralize scope expansion in Refresh
    * Log CPU time of external commands in addition to wall-clock time
    * Fix schema minimum for refresh and fetch intervals
    * Pause background refreshes while driving a git operation
    * Make background-refresh pausing reentrant
    * Extend the fill background to wrapped tail segments
    * Remove the '\n' sentinel cell
    * Wrap v.lines cells in a line struct
    * Rename lineType to cells
    * Remove dead \x00 filtering from string conversion helpers
    * Demonstrate broken background fill on wrapped \x1b[K-padded lines
    * Add regression tests for trailing-fill rendering
    * Don't include integration tests in "just test" on Windows
    * Allow running check_script.sh when there are uncommitted changes
    * Make .go files have LF line endings on Windows
    * Fix Windows linter errors
    * Allow cycling pagers in reverse
    * Extract onPagerChanged helper from cyclePagers
    * Show pager name in the cycle-pager toast, and let users name pagers
    * Reject pager entries that combine multiple diff mechanisms
    * Terminate tooltip text with a full stop
    * Add a "just check" command
    * Explain when a submodule has nothing stageable
    * Optimistically render unstaging a dirty submodule
    * Also verify stage-all can unstage a dirty submodule
    * Fix unstaging a submodule with dirty content
    * Unify the stage/unstage decision for press and stage-all
    * Add a test demonstrating that you can't unstage a dirty submodule
    * Offer direnv .envrc approval from inside lazygit
    * Load direnv environment when switching repos
    * Dedupe the recent-repos fallback in setupRepo
    * Cleanup: drop unneeded variable
    * When RecordCurrentDirectory fails, only log the error
  - Update to version 0.62.2:
    * Additions to AGENTS.md
    * Fix the waiting status display for synchronous operations
    * Refactor: extract private setAppStatusContent helper method
  - Update to version 0.62.1:
    * Add docs for how to add the default, non-pager diff to the list of pagers
    * Fix minor typos in README.md
    * Cleanup: filter out empty keybindings earlier
    * Fix crash when keybindings are disabled that we want to show in the status bar
  - Update to version 0.62.0:
    * Fix breaking changes note
    * Update docs and schema for release
    * Update translations from Crowdin
    * Add support for git flow using git-flow-next
    * Pull git-flow prefix parsing into a config-level helper
    * Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.2
    * Bump github.com/gdamore/tcell/v3 from 3.3.0 to 3.4.0
    * Bump golang.org/x/sys from 0.43.0 to 0.45.0
    * Bump github.com/sahilm/fuzzy from 0.1.1 to 0.1.2
    * Fix undo shortcut in Undoing.md
    * Bump github.com/gookit/color from 1.6.0 to 1.6.1
    * Refresh main view when cycling pagers with main view focused
    * Do less work to update the main view when cycling pagers
    * Add `<alt+up>`/`<alt+down>` as alternate keybindings for moving commits up/down
    * If a menu entry has multiple keybindings, list them in a tooltip
    * Fold remaining alt bindings into their main fields
    * Use a dedicated keybinding for hunk navigation in the main view
    * Fold legacy quit-alt1 into the multi-key quit binding
    * Convert custom command Key fields to Keybinding
    * Convert JumpToBlock to a list of multi-key bindings
    * Convert keybinding fields to Keybinding
    * Add Keybinding type that accepts a string or a sequence of strings
    * Render every key for a binding in the cheatsheet
    * Rename Key to Keys in Binding, KeybindingsOpts, and MenuItem
    * Use a slice of keys for each binding
    * Add menuKey helper to reduce noise on menu item literals
    * Remove OptionMenuAlt1
    * Change SetKeybinding to not return an error
    * Remove unused text KeybindingsLegend
    * Add script for checking all commits in a branch
    * Use the isolated test env for shell commands
    * Refresh worktrees before auto-forwarding branches
    * Add test for auto-forwarding a branch checked out in another worktree
    * Extract BranchesHelper.PostFetchRefresh to unify the two fetch paths
    * Refresh pull requests after a manual fetch
    * Preserve empty Worktrees slice when worktree list fails to load
    * Some additions to AGENTS.md
    * Add script to preview release notes
    * Remove the invitation to submit PRs from the issue template
    * Log errors from fetching GitHub PRs to the debug log, not to the Command Log
    * Keep GitHub PR refresh error logging in one place
    * Optimize regex compilations
    * Document that the services entry also enables GHE pull-request icons
    * Remove now unused code
    * Support GitHub Enterprise for the pull-requests feature
    * Expose service info (provider, host, owner, repo) from the hosting service
    * Clear cherry-pick buffer when copying after a paste
    * Add test for missing commits when range-copying after a paste
    * Some additions to AGENTS.md
    * Improve performance of inline status spinner
    * Remove Render() from ListContextTrait.HandleRender
    * Bounce setGithubPullRequests' Branches render to UI thread
    * Bounce commit files selection render to UI thread
    * Bounce SuggestionsContext.SetSuggestions to UI thread
    * Bounce explicit LocalCommits render in refreshBranches to UI thread
    * Bounce refreshView to the UI thread
    * Set the view color on the UI thread too
    * Have renderAppStatus trigger a full layout when the appStatus width changes
    * When drawing tainted views in ForceFlushViewsContentOnly, also draw views that overlap them
    * Fix visual glitch with status bar spinner at very slow spinner rates
    * Improve performance of spinner in Synchronized events
    * Validate that gui.spinner.frames must all have the same width
    * Improve performance when drawing the spinner on background events
    * Support to request a content-only UI refresh
    * Honor the spinner rate configurate with sync spinner
    * Fix missing layout call after switching repos
    * Fix the check_for_fixups.sh script again
    * Remove dead Modifier field from keybindings
    * Remove unused function DeleteKeybinding
    * Disable gh telemetry when running integration tests
    * Revert the change of <ctrl+j>/<ctrl+k> to <alt+down>/<alt+up>
    * Add an AGENTS.md file
    * Expose PushUrls to custom commands
    * Show PushUrls for selected remote if there are any
    * Add PushUrls field to models.Remote
    * Use more widely-supported Unicode symbols for the commit graph
    * Fix linter warnings about ignoring errors from bufio.Scanner
    * Fix linter warning about inefficient string concatenation
    * Close temp file handles before cleanup on Windows
    * Remove now unnecessary Setenv call
    * Make UnixToDateSmart timezone-deterministic
    * Clear LC_* env vars when running LANG tests
    * Fix regressions with alternate edit bindings for backspace and move-cursor-right
    * Change keybinding syntax to spell out full modifier names, and use + instead of -
    * Remove the keybindings legend in the cheatsheets
    * Add a forwardDeleteWord keybinding
    * Make edit keybindings for move-by-word and backspace-word configurable
    * Add breaking changes note for the changed bindings
    * Change bindings for moving commits to a-up/down
    * Change a-enter keybinding to m-enter on mac, and c-enter elsewhere
    * Document custom keybinding syntax
    * Move modifiers into Key
    * Get rid of pkg/gui/keybindings package
    * Unexport the labelByKey and keyByLabel maps
    * Move keybindings.LabelFromKey to config package
    * Add config.KeyFromLabel
    * Fix typo in keybinding
    * Bump tcell dependency to v3
    * Add Key type
    * Rename Key to KeyName
    * Cleanup: use named constant
    * Cleanup: fix typo in comment
    * Cleanup: remove unnecessary function Label()
    * Cleanup: simplify code
    * Cleanup: remove obsolete code
    * Remove unused Parse/ParseAll and friends
    * Remove unused StartTicking and tickingMutex
    * Remove unused View.HasLoader functionality
    * Exclude gocui from codespell check
    * Fix linter warnings
    * Copy gocui files into lazygit repo under pkg/gocui
    * perf(branches): use for-each-ref ahead-behind for git >= 2.41
    * Bump golang.org/x/sys from 0.42.0 to 0.43.0
    * Bump actions/github-script from 8 to 9
    * Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0
    * Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1
    * Bump dario.cat/mergo from 1.0.1 to 1.0.2
    * Fix dependabot label for github-actions-related updates
    * Bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4
    * Bump github.com/gookit/color from 1.4.2 to 1.6.0
    * Bump github.com/kyokomi/emoji/v2 from 2.2.8 to 2.2.13
    * Bump samber.lo to latest version
    * Define PR colors as hex colors to make them the same as GitHub's
    * If multiple remotes exist but only one is a Github remote, pick it without prompting
    * Stop showing cached PRs when we no longer have a base remote
    * Preserve whitespace when remembering a commit message
    * Add integration test demonstrating whitespace loss in preserved commit messages
    * Tolerate trailing newlines in AddCoAuthorToDescription
    * Fix the check_for_fixups script
    * Preserve commit message when quitting while the commit message panel is open
    * Add OnQuit hook for controllers
    * Extract PreserveCommitMessage from CloseCommitMessagePanel
    * Remove unnecessary clearing of the commit message panel on close
    * retry on ref lock errors during fetch/pull
    * Fix copying a file's absolute path when running in a linked worktree
    * Change clipboard tests to demonstrate bug with copying absolute file path

++++ libtorrent:

  - Update to release 0.16.16
    * Disconnect and mark as corrupt if a single peer sends a whole
    chunk that fails hash check.
    * Detect libcurl passing us internal fd's and re-enable strict fd
    leak checking.
    * Fixed shutdown handling of stalled http requests.
    * Added new ProxyManager and support for socks5 for peer
    connections.
    * Added max http request size and limited redirect protocols to
    http/https.

++++ maven-filtering:

  - Upgrade to upstream version 3.5.1
    * Bug Fixes
    + Improve error message for MalformedInputException during
    resource filtering
    + Restore "first entry wins" for overlapping resource
    declarations
    * Maintenance
    + enable build with Maven 4
    * Dependency updates
    + Bump org.apache.maven.shared:maven-shared-components from 47
    to 49
    + Bump Maven version to 3.9.16
    + Bump plexus-utils version to 3.6.1
    + Bump commons-io:commons-io from 2.21.0 to 2.22.0

++++ maven-resolver2:

  - Update to version 2.0.20
    * New features and improvements
    + Reduce PathConflictResolver memory and auto-select resolver
    + Fix dependency selector cache regression in DF collector
    + Fix thread contention in GenericVersionScheme and
    WeakInternPool
    + Improve thread safety across modules
    + WarnChecksumPolicy: proceed on no checksums
    + Extend AuthenticationBuilder to support SSLContext for mTLS
    authentication
    + DependencyCollectionChecker: new session member
    + Add any media type to RFC9457 content type header
    + fix: Configuration to be able to control sending RFC 9457
    related Accept HTTP header
    + Improvement: BF dependency selector hot methods
    * Bug Fixes
    + Fix ApacheTransport auth cache CCEx
    + Checksums: lack of information
    + Fix inverted SIGTSTP condition in IPC server
    + Bug: fix IPC named lock client-side robustness for Windows
    + Bugfix: Fix NPE in PathConflictResolver
    + Bug: fix IPC named lock server-side waiter leak on client
    timeout
    + Bug: fix new PCR as it in certain cases left duplicates
    * Documentation updates
    + Javadoc update
    + Doc: Trusted Checksums Summary File Procedure
    * Maintenance
    + Put PCR aside for now
    + Get rid of BND warnings
    + Align generators
    + Fix for ChainedWorkspaceReader
    + Create simple JMH benchmark to compare CCR and PCR
    + Tidy up suppliers
    + Disable IPC lock tests on Windows
    * Dependency updates
    + Bump org.apache.maven:maven-parent from 48 to 49
    + Bump roasterVersion from 2.31.0.Final to 2.31.1.Final
    + Bump sisuVersion from 1.0.0 to 1.0.1
    + Bump org.redisson:redisson from 4.4.0 to 4.6.1
    + Deps: Jetty 12.1.10
    + Bump io.minio:minio from 9.0.0 to 9.0.3
    + Bump dev.sigstore:sigstore-java from 2.1.0 to 2.2.0
    + Bump okhttpVersion from 5.3.2 to 5.4.0
    + Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0
    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from
    0.25.7 to 0.26.1
    + Bump org.ow2.asm:asm from 9.9.1 to 9.10.1
    + Bump dev.sigstore:sigstore-java from 2.0.0 to 2.1.0
    + Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to
    2.12.0
    + Bump maven3Version from 3.9.15 to 3.9.16

++++ maven-resolver2-supplier-mvn3:

  - Update to version 2.0.20
    * New features and improvements
    + Reduce PathConflictResolver memory and auto-select resolver
    + Fix dependency selector cache regression in DF collector
    + Fix thread contention in GenericVersionScheme and
    WeakInternPool
    + Improve thread safety across modules
    + WarnChecksumPolicy: proceed on no checksums
    + Extend AuthenticationBuilder to support SSLContext for mTLS
    authentication
    + DependencyCollectionChecker: new session member
    + Add any media type to RFC9457 content type header
    + fix: Configuration to be able to control sending RFC 9457
    related Accept HTTP header
    + Improvement: BF dependency selector hot methods
    * Bug Fixes
    + Fix ApacheTransport auth cache CCEx
    + Checksums: lack of information
    + Fix inverted SIGTSTP condition in IPC server
    + Bug: fix IPC named lock client-side robustness for Windows
    + Bugfix: Fix NPE in PathConflictResolver
    + Bug: fix IPC named lock server-side waiter leak on client
    timeout
    + Bug: fix new PCR as it in certain cases left duplicates
    * Documentation updates
    + Javadoc update
    + Doc: Trusted Checksums Summary File Procedure
    * Maintenance
    + Put PCR aside for now
    + Get rid of BND warnings
    + Align generators
    + Fix for ChainedWorkspaceReader
    + Create simple JMH benchmark to compare CCR and PCR
    + Tidy up suppliers
    + Disable IPC lock tests on Windows
    * Dependency updates
    + Bump org.apache.maven:maven-parent from 48 to 49
    + Bump roasterVersion from 2.31.0.Final to 2.31.1.Final
    + Bump sisuVersion from 1.0.0 to 1.0.1
    + Bump org.redisson:redisson from 4.4.0 to 4.6.1
    + Deps: Jetty 12.1.10
    + Bump io.minio:minio from 9.0.0 to 9.0.3
    + Bump dev.sigstore:sigstore-java from 2.1.0 to 2.2.0
    + Bump okhttpVersion from 5.3.2 to 5.4.0
    + Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0
    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from
    0.25.7 to 0.26.1
    + Bump org.ow2.asm:asm from 9.9.1 to 9.10.1
    + Bump dev.sigstore:sigstore-java from 2.0.0 to 2.1.0
    + Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to
    2.12.0
    + Bump maven3Version from 3.9.15 to 3.9.16

++++ maven-resolver2-supplier-mvn4:

  - Update to version 2.0.20
    * New features and improvements
    + Reduce PathConflictResolver memory and auto-select resolver
    + Fix dependency selector cache regression in DF collector
    + Fix thread contention in GenericVersionScheme and
    WeakInternPool
    + Improve thread safety across modules
    + WarnChecksumPolicy: proceed on no checksums
    + Extend AuthenticationBuilder to support SSLContext for mTLS
    authentication
    + DependencyCollectionChecker: new session member
    + Add any media type to RFC9457 content type header
    + fix: Configuration to be able to control sending RFC 9457
    related Accept HTTP header
    + Improvement: BF dependency selector hot methods
    * Bug Fixes
    + Fix ApacheTransport auth cache CCEx
    + Checksums: lack of information
    + Fix inverted SIGTSTP condition in IPC server
    + Bug: fix IPC named lock client-side robustness for Windows
    + Bugfix: Fix NPE in PathConflictResolver
    + Bug: fix IPC named lock server-side waiter leak on client
    timeout
    + Bug: fix new PCR as it in certain cases left duplicates
    * Documentation updates
    + Javadoc update
    + Doc: Trusted Checksums Summary File Procedure
    * Maintenance
    + Put PCR aside for now
    + Get rid of BND warnings
    + Align generators
    + Fix for ChainedWorkspaceReader
    + Create simple JMH benchmark to compare CCR and PCR
    + Tidy up suppliers
    + Disable IPC lock tests on Windows
    * Dependency updates
    + Bump org.apache.maven:maven-parent from 48 to 49
    + Bump roasterVersion from 2.31.0.Final to 2.31.1.Final
    + Bump sisuVersion from 1.0.0 to 1.0.1
    + Bump org.redisson:redisson from 4.4.0 to 4.6.1
    + Deps: Jetty 12.1.10
    + Bump io.minio:minio from 9.0.0 to 9.0.3
    + Bump dev.sigstore:sigstore-java from 2.1.0 to 2.2.0
    + Bump okhttpVersion from 5.3.2 to 5.4.0
    + Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0
    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from
    0.25.7 to 0.26.1
    + Bump org.ow2.asm:asm from 9.9.1 to 9.10.1
    + Bump dev.sigstore:sigstore-java from 2.0.0 to 2.1.0
    + Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to
    2.12.0
    + Bump maven3Version from 3.9.15 to 3.9.16

++++ mkvtoolnix:

  - Update to version 100
    New features and enhancements:
    * all: added new scalable (SVG) application icons for all
    applications, replacing the existing pixmap (PNG, ICO)
    icons.
    * mkvmerge: MP4 reader: track names are now read from the
    track's user-data atoms (`trak` → `udta` → `name`) if
    present.
    * MKVToolNix GUI: executing actions configuration, type "play
    audio file": added a slider to make configuration more
    intuitive.
    * MKVToolNix GUI: job queue: added a context menu for opening
    copies of the selected queue jobs in the multiplexer as new
    settings there without removing the queue jobs.
    * MKVToolNix GUI: job queue: added a search functionality for
    jobs that searches in job descriptions, outputs, warnings &
    errors.
    Bug fixes:
    * mkvmerge: AAC: fixed mis-detection of ADTS streams not
    starting on a frame boundary. Fixes regression starting with
    v87 when fixing AAC LATM config not being parsed if it
    wasn't present in the first AAC frame.
    * mkvmerge: MPEG TS reader: under certain rare conditions
    mkvmerge was skipping a certain amount of content at the
    start of the main M2TS file when reading MPLS playlists. The
    amount of content skipped proportional to the probe range
    percentage. This only happened when the source Blu-ray
    contains HDMV TextST subtitles.
    * MKVToolNix GUI: executing actions configuration, type "play
    audio file": fixed audio volume not working since switching
    to Qt 6 due to its interface taking a `float` in range
    `0.0`–`1.0` instead of the old interface taking an`int` in
    range `0`–`100`.
    * MKVToolNix GUI: executing actions: fix backslash handling
    when parsing a Unix-shell escaped string into separate
    arguments. The user-visible fix is that the command-line in
    the "executing actions" dialog will not have the quoting
    changed in wrong ways by the GUI when the GUI adds another
    variable upon user request, a regression introduced in v99.

++++ nushell:

  - Update to version 0.114.0:
    + Sharper type checking: inferred output types from pipeline
    input, typed `$in`, better `let` binding inference, `oneof`-aware
    operator checks; `enforce-runtime-annotations` now opt-out
    + POSIX-style `--` end-of-options delimiter for built-in, custom,
    and `def --wrapped` commands
    + New `run` command runs scripts as isolated pipeline stages
    (bare transforms or `def main` entry point)
    + Built-in Semantic Versioning support: `into semver`,
    `into semver-range`, `semver bump`, with sorting and range matching
    + KDL v2.0.0 format support via `to kdl`/`from kdl`
    + Breaking changes
    * Submodules are no longer implicitly imported; use explicit
    `export use sub` to keep old behavior
    * Type system improvements: command output types inferred from
    input, optional params typed as `oneof<T, nothing>`, more
    precise widening; previously-passing annotations may now error
    * `enforce-runtime-annotations` experimental option promoted to
    opt-out (enabled by default)
    * Reedline vi mode: proper visual mode, caret on last grapheme,
    `h`/`l` cross line boundaries, separate visual prompt indicator
    * `from xlsx`/`from ods`: corrected signatures (return records of
    tables, not tables; `from ods` input is `binary`), added
    datetime support to `ods`, broadened datetime formats,
    uncoercible values imported as `string`/`float` instead of
    `null`; removed `--header-row` flag, added `--noheaders` and
    `--first-row`
    * Error records in `catch` no longer have `json` field; replaced
    by `details`; labels gain `location` with file-relative offsets
    * Removed deprecated `grid` record input and implicit `name`
    column assumption
    * `std/iter scan` signature now matches `reduce` (`--fold`,
    `--noinit` removed); `std/iter find-index` returns `null`
    instead of `-1`
    * `idx find`/`idx search` hits now displayed relative to cwd
    + Additions
    * `polars map-batches` for mapping closures over dataframe columns
    * `commandline complete` to invoke nushell completions (supports
    `--type`, `--detailed`)
    * `to nuon --pretty`/`-p` (shorthand for `--indent 2`) with
    column alignment
    * `run` command for scripts in pipelines; `--full-reparse`/`-f`
    flag
    * POSIX `--` end-of-options parsing for built-in, custom, and
    `def --wrapped` commands
    * `ignore` flags: `--stderr`/`-e`, `--stdout`/`-o`,
    `--show-errors`/`-x`
    * `idx search --context`/`-c` accepting int or range
    * Polars bitwise commands: `bitwise-and`, `-or`, `-xor`,
    `count-ones`, `-zeros`, `leading-ones`, `-zeros`,
    `trailing-ones`, `-zeros`
    * `url encode` supports binary input; `url decode --binary`
    returns binary for non-UTF-8
    * Reedline menu `input_mode`/`output_mode` and
    `description_position` configuration
    * `random pass` for password generation with `--chars`,
    `--no-uppercase`, `--no-lowercase`, `--no-numbers`,
    `--no-symbols`, `--include-ambiguous`, `--include-similar`,
    `--require-each-type`
    * `is-terminal` detects redirection; defaults to `--stdout`
    * `--right` flag for `split row` and `split column`
    * Set/combinatorics commands: `union`, `intersect`, `difference`,
    `combinations`, `permutations`
    * SemVer support: `into semver`, `into semver-range`,
    `semver bump` (major/minor/patch/alpha/beta/rc/release) with
    tab completions, table coloring, `describe` support
    * `from xlsx`/`from ods` `--prefer-integers`/`-i` flag
    * `math cbrt` (cube root)
    * `append` accepts multiple rest values
    * `LS_COLORS` support in `commandline complete --detailed`
    * `idx init` uses content indexing by default
    * Completions for `ansi gradient --fgnamed`/`--bgnamed`
    * Verb-based reedline edit keybindings (`move`, `extend`, `cut`,
    `copy`, `change`, `erase`) with motions
    * HTTP commands use response body as error message
    * `NU_EXPERIMENTAL_OPTIONS` honored with `--login`/`--execute`
    * `explore config` navigation shortcuts (`hl`, `jk`, `ctrl+p/n`)
    * `--log-level perf` for startup performance debugging
    + Deprecations
    * `str upcase` deprecated in favor of `str uppercase`;
    `str downcase` in favor of `str lowercase`
    + Removals
    * Removed deprecated `use std/clip` `copy`/`paste` (use
    `copy52`/`paste52` or experimental `native-clip` `clip copy`/
    `clip paste`)
    * Removed deprecated `grid` record input and implicit `name`
    column
    * Removed `--header-row` flag from `from xlsx`
    + Other changes
    * More idiomatic YAML output with smarter string quoting and
    multiline string block style (YAML rework planned for next
    release)
    * Width-priority columns: `metadata set
  - -table-width-priority-columns`/`-w` hints for `table` rendering
    * Polars 0.54 upgrade: `polars implode --maintain-order`,
    `polars is-in --maintain-order`,
    `polars pivot --always-combine-names`, `polars replace --default`
    required with `--strict`/`--return-dtype`
    * New experimental `dc-glob` globbing engine (faster,
    cross-platform)
    * "Command not found" suggests full command from category (e.g.
    `sqrt` -> `math sqrt`)
    * `plugin list --help` shows correct `commands` column type
    * `toolkit.nu` commands annotated with categories/search-terms/
    examples
    * LSP feature-gated behind `--features lsp`
    * MCP `evaluate` tool returns NUON directly and provides
    `structuredContent` JSON
    * `http post`/`put`/`patch`/`delete` respects `--content-type`
    for JSON-variant MIME types
    * `nu-highlight` clears `content_type` metadata
    * Refactored sqlite pushdown into query_plan for extensibility
    * Rust toolchain bumped to 1.94.1
    + Bug fixes
    * `idx` family: `idx init . --wait` blocks properly,
    `--follow-links` added, accurate counts, snapshot restore for
    `import`, `files`/`dirs`/`find`/`search` work on imports,
    `query` parameter added
    * `which`/`attr complete` subcommand completions quoted for spaces
    * `update` with nested column path and closure no longer writes
    same result to every row
    * `nu-mcp` evaluation output uses raw strings to reduce escaping
    * Clearer errors for negative indices in cell paths
    * `oneof<..., table>` accepts table literals;
    `oneof<..., closure>` accepts closures without `||`
    * `table` alignment with `header_on_separator` fixed
    * `run` repeated execution caching bug fixed; `--full-reparse`
    added
    * Float ranges use natural fractional steps (`0.1..0.3` yields
    0.1, 0.2, 0.3) with rounding to step precision
    * `stor open` return type corrected to `SQLiteDatabase`
    * Module descriptions in `use` completions/LSP hovers properly
    formatted
    * Aliases keep working when referenced variables are shadowed
    * `--` parsing bug with `--wrapped` commands fixed
    * `from json`/`from kdl`/`from xml` respond to Ctrl-C and show
    focused error snippets
    * `flatten` renames conflicting parent columns correctly
    * `{}` in row conditions parsed as empty closure, not record
    * `idx search` treats brackets/`?` as literal text
    * Table mode from CLI (`-m`) respected in scripts
    * `input list` streams items live, fixes header expansion and
    control-character alignment
    * `nu --plugins` accepts multiple params, comma/space/quoted lists
    * `commandline edit` REPL update regression fixed
    * `math abs` reports overflow instead of panicking on
    i64::MIN/duration
    * `bytes index-of` no longer panics on empty patterns
    * `explore config --output` fails fast in edit mode
    * Nix flake build fixed
    * Interpolated strings auto-converted to `glob` flags/arguments
    * `lines` handles invalid UTF-8 (lossy default, `--strict` to
    fail)
    * `input list --fuzzy` ANSI truncation fixed
    * `uniq-by` errors on non-record lists and missing columns
    * `bits shl`/`shr` default to 8-byte word size
    * `--wrapped` glob regression fixed (strings/globs passed
    correctly to externals)
    * dc-glob: `~` expansion, absolute paths, case-insensitivity,
    `rm`, Windows path fixes
    * All polars-expression commands accept polars selectors
    * AST flattening leading-pipe rendering bug fixed
    * `str index-of --grapheme-clusters` no longer panics on
    sub-grapheme matches
    * `exit` restores terminal cursor; REPL uses command normally
    * SIGABRT on terminal close / MCP server exit fixed
    * `insert`/`upsert` into empty nested cell path gives clear error
    * Compiler error fixed for `$in`-collecting RHS of `and`/`or`/
    comparisons
    * `--log-include`/`--log-exclude` accept module/target names
    * `math avg`/`sum` on tables produce consistent error messages
    * `help aliases` shows alias name for internal-command aliases
    + For a full list of changes with detailed descriptions, see:
    https://www.nushell.sh/blog/2026-07-04-nushell_v0_114_0.html

++++ pt2-clone:

  - Update to version 1.91
    * Windows: Dropped support for Windows XP (it's 25 years old,
    time to move on!). The earliest supported Windows version is
    now Windows 7 SP1.
    * Windows: Upgraded the Visual Studio project from vs2019 to
    vs2026 for taking advantage of vs2026's new compiler (should
    result in faster code).

++++ python-dateparser:

  - update to 1.4.1:
    * Remove fastText language detection support: the fasttext
    extra is dropped and detect_languages() now raises
    ImportError. Migrate to the langdetect extra, which also
    unblocks numpy 2.x compatibility
    * Make digit quantifiers possessive in the relative-date
    regexes to prevent quadratic backtracking (ReDoS) on long
    digit runs
    * Add the USE_GIVEN_LANGUAGE_ORDER setting to try languages and
    locales in the order given rather than by frequency
    * Preserve explicit signs on individual components when parsing
    relative dates that combine decades with years, such as "-1
    decade +2 years"
    * Fall back to other provided languages in search_dates when
    the detected language yields no dates
    * Parse relative date expressions with spaces between the sign
    and number, such as "now - 2 hours" and "now + 1 day"
    * Use the parser-relative now for the current month when
    filling in incomplete dates so the month and day stay
    consistent
    * Fix Norwegian Bokmål (nb) parsing of relative date
    expressions such as "3 måneder siden" and "om 2 måneder"
    * Parse abbreviated English month expressions such as "1mon
    ago" and "3mons ago"
    * Preserve surrounding whitespace when removing skip tokens
    during translation to avoid spurious double spaces
    * Move project metadata and build configuration to
    pyproject.toml
    * Add alternative Korean date expressions for today, yesterday,
    tomorrow, and "N months ago/later"
    * Expand Czech date translations with additional inflections,
    word numbers, decade and century expressions, and clock
    phrases like "čtvrt na tři"
    * Replace internal OrderedDict usage with the built-in dict
  - drop mark-network-tests.patch (upstream)

++++ python-django-webpack-loader:

  - update to 3.2.4:
    * Refactor `get_as_url_to_tag_dict` when dealing with extra
    arguments in elements
    * Fix `skip_common_chunks` usage at `get_files` to add parity
    with `render_bundle`
    * Add integrity and CSP nonce to preload script tags
    * Fix hanging or broken stats file
    * Handle issue when webpack stats change mid-request
    * Fix `AttributeError` in config check for non-dict
    `WEBPACK_LOADER`

++++ python-fastnumbers:

  - Remove no-setuptools-scm.patch, use PyPI package which ships a
    version file instead of GitHub tarball which failed the source
    validator.
  - Clean up specfile from EOL distro workarounds

++++ python-flask-jwt-extended:

  - update to 4.7.4:
    * setup.py: bump PyJWT floor to >=2.11.0 to match the actual
    runtime requirement
  - update to 4.7.3:
    * I'm skipping 4.7.2 because I forgot to bump the python
    version in code. This is the same as 4.7.2, with things setup
    correctly.
  - update to 4.7.2:
    * fix: a unexpected token
    * Update active python versions
    * Bump PyJWT to 2.12.1
  - update to 4.7.1:
    * Add controls for `verify_sub` option in PyJWT
  - update to 4.7.0:
    * Drop support for python 3.7 and 3.8, add 3.13
    * Fix documentation around identity needing to be a string

++++ python-google-cloud-kms:

  - update to 3.14.0:
    * regenerate google-cloud-[k-n] packages

++++ python-google-cloud-resource-manager:

  - update to 1.18.0:
    * regenerate google-cloud-[o-r] packages

++++ python-google-cloud-speech:

  - update to 2.40.0
    * regenerate google-cloud-s packages

++++ python-hepunits:

  - update to 2.4.6:
    * chore(deps): update pre-commit hooks
    * chore(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 in
    the actions group
    * chore: removal of duplicates and trivial Python 3
    modernisation in the docs
    * chore: add an AGENTS file

++++ python-humanize:

  - Update to 4.16.0
    * Added
  - Add Latvian language localization (#301) @EPoikans
  - Add i18n support for naturalsize() and French translation (#294) @Yibomao
    * Changed
  - Performance improvements: 1.07x - 8.4x (#315) @hugovk
  - Lazy imports for Python 3.15+ (#335) @hugovk
  - Drop experimental Python 3.13 free-threaded (#336) @hugovk
  - Refactor: simplify scientific() and extract _SUPERSCRIPT_MAP constant (#313) @maayanmatsliah-tech
    * Fixed
  - Fix naturalsize() rounding rollover at unit boundaries (#329) @patchwright
  - Carry metric() to the next SI prefix when rounding reaches 1000 (#328) @gaoflow
  - Stop printing two minus signs in fractional for a negative mixed number (#320) @c-tonneslan
  - Return an empty string from natural_list() for an empty list (#318) @c-tonneslan
  - Handle tz-aware datetimes in naturalday() and naturaldate() (#297) @bysiber
  - Fix Arabic translation (#307) @AYMENJD
  - Fix Spanish large number translations to use long scale (#302) @sedat4ras

++++ python-langfuse:

  - update to 4.13.0:
    * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to
    0.5.7 in the github-actions group
    * fix(langchain): extract model name for ChatHuggingFace
    * chore(deps): bump the github-actions group with 2 updates
    * fix(resource_manager): reinitialize consumer threads after
    os.fork()
  - update to 4.12.0:
    * feat(tracing): propagate environment attributes
    * **Full Changelog**: https://github.com/langfuse/langfuse-
    python/compare/v4.11.0...v4.12.0
  - update to 4.11.0:
    * fix(langchain): avoid duplicating structured tool inputs in
    metadata
    * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the
    github-actions group
    * feat(tracing): allow custom OpenTelemetry ID generators
    * **Full Changelog**: https://github.com/langfuse/langfuse-
    python/compare/v4.10.0...v4.11.0
  - update to 4.10.0:
    * fix(langchain): mark handled tool errors as errors
    * fix(langchain): prefer structured tool inputs
    * feat(api): update API spec from langfuse/langfuse 8cdf8a4
    * feat(datasets): support multimodal dataset items
  - update to 4.9.1:
    * fix(openai): preserve Responses tools and streamed tool calls
    * **Full Changelog**: https://github.com/langfuse/langfuse-
    python/compare/v4.9.0...v4.9.1
  - update to 4.9.0:
    * feat(api): update API spec from langfuse/langfuse 53433e8
    * fix(scores): support CORRECTION score data type
    * feat(tracing): add export-stage OTEL span masking and media
    detection
  - update to 4.8.1:
    * feat(api): update API spec from langfuse/langfuse 9ce4aa4
    * chore(deps): bump the github-actions group with 2 updates
    * fix(serializer): correctly serialize float('-inf') as
    "-Infinity"
    * feat(api): update API spec from langfuse/langfuse c82119e
    * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 in
    the github-actions group
    * chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2
    in the github-actions group
    * fix: update env template to use LANGFUSE_BASE_URL
    * feat(api): update API spec from langfuse/langfuse b8db8b6
    * fix(propagation): coerce propagated metadata values
    * fix(observe): preserve current observation type on span
    update
    * fix(deps): support wrapt 2.x (closes #1561)
    * fix(langchain): handle prompt_tokens_details as dict in
    _parse_usage_model
  - update to 4.7.1:
    * feat(api): update API spec from langfuse/langfuse 41f5847
    * chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0
    in the github-actions group
    * **Full Changelog**: https://github.com/langfuse/langfuse-
    python/compare/v4.7.0...v4.7.1
  - update to 4.7.0:
    * chore: add CODEOWNERS for GitHub config
    * chore(deps): bump the github-actions group across 1 directory
    with 5 updates
    * chore(deps): bump langsmith from 0.7.22 to 0.8.0
    * feat(span-processor): mark app root spans
    * feat(span-processor): simplify app root state and expand LLM
    scopes
    * chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to
    0.5.5 in the github-actions group
    * ci: adjust zizmor advanced security handling
    * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5
    in the github-actions group
    * chore(deps): bump idna from 3.11 to 3.15
    * chore(deps): bump urllib3 from 2.6.3 to 2.7.0
    * fix: add depth limit to EventSerializer to prevent hangs on
    complex objects
    * chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to
    0.5.6 in the github-actions group

++++ python-lazy:

  - update to 2.0:
    * Remove deprecated license classifier. [stefan]
    * Upgrade GitHub workflow. [stefan]
    * Upgrade .readthedocs.yaml. [stefan]
    * Upgrade sphinx and sphinx-rtd-theme in docs extra. [stefan]
    * Require Python >= 3.5. [stefan]

++++ python-lxml_html_clean:

  - update to 0.4.5 (bsc#1270285, CVE-2026-49825):
    * Fixed a security vulnerability where javascript: URLs in
    xlink:href attributes were not sanitized
    when``safe_attrs_only=False``, allowing cross-site scripting
    (XSS) attacks. The fix requires lxml>=6.1.1, which adds
    xlink:href to the set of link attributes iterated by
    rewrite_links(). Reported by Guillem Lefait (@glefait).

++++ python-meshtastic:

  - update to 2.7.10:
    * protobufs updated
    * Inject options in nanopb .options files into the protobuf
    files used for code generation
    * Refactor the Meshtastic TCP pub/sub example to ensure proper
    resource cleanup and clearer exception handling.
    * Add textchat.py and replymessage.py examples
    * Fix position overwrite by lower-precision data
    * Update factory reset to use integer for config reset
    * Filter --reply based on specified channel index
    * Make Serial and TCP interfaces more closely respect
    connectNow when false
    * StreamInterface: prevent socket/reader-thread leak on
    handshake failure
    * Fix some leaks/hangs on close: unstarted StreamInterface
    streams & TCP reader unblock
    * Give TCPInterface reconnect logic on write errors
    * Container: Add initial container for meshtastic-cli
    * Make examples more regularized and focused, and add
    contribution guidelines for the examples folder
    * Added example script : meshtastic_serial_message_reader.py
    * Fix up the container build

++++ python-nmcli:

  - update to 1.8.0:
    * feature: allow DeviceControl.wifi_connect to accept None as
    password

++++ python-okta:

  - update to 3.4.4:
    * Fixed a `ValidationError` crash in `list_factors()` when
    processing users enrolled in Okta FastPass. Added missing
    `signed_nonce` discriminator mapping and three new component
    schemas (`UserFactorSignedNonce`,
    `UserFactorSignedNonceProfile`,
    `UserFactorSignedNonceProfileKey`) to properly deserialize
    FastPass factor payloads (#311, 387).
    * Fixed enum case mismatches in `AccessPolicyConstraint`,
    `KnowledgeConstraint`, and `PossessionConstraint` models. The
    `methods` and `types` fields now correctly accept lowercase
    values (e.g., `"password"`, `"push"`, `"webauthn"`) to align
    with actual API responses, resolving `ValidationError`
    exceptions raised by `list_policy_rules()` (#548).

++++ python-opentelemetry-exporter-gcp-trace:

  - update to 1.12.0:
    * no changes

++++ python-particle:

  - update to 1.0.0:
    * Added the 2026 PDG data table file, now default,
    * and made a new 2026 nucleus data file to match.
    * Added version 16 of package CSV data files since PDG 2026
    information now the default.
    * Removed old and superseded 2022 and 2023 PDG and derived data
    files.
    * Removed old 2020 and 2022 nucleus data files.
    * `Particle` class and submodules:
    * Return `Fraction` instead of float for charge, spin J, and
    isospin I.
    * Implemented baryon, lepton and R-parity quantum numbers.
    * Implemented flavour quantum numbers - strangeness, charmness,
    bottomness, topness. Also hypercharge.
    * Tests added for all new functionality.
    * Added also a test of the Gell-Mann–Nishijima formula relating
    charge to isospin and hypercharge.
    * Performance improvements, notably for particle and PDGID
    literals.
    * Minor improvements and fixes to the odd member function.
    * Improvements to the CLI commands `python -m particle ...` for
    better user experience
    * and clearer error messages.
    * `PDGID` class method and related standalone functions:
    * Return `Fraction` instead of float for charge, spin J, and
    isospin I.
    * Minor fixes to the odd function.
    * Classes for MC particle identification codes and converters:
    * New common `MCParticleID` base class for MC particle ID
    classes.
    * The classes `Geant3ID`, `PythiaID`, `Corsika7ID` now inherit
    from it
    * and are much simplified and streamlined.
    * Dependencies:
    * Moved to Pandas 2.0+.
    * Dropped support for Python 3.9.
    * Miscellaneous:
    * Added support for agents.
    * Started using pattern matching to simplify bits of code.
    * Tests and CI:
    * Test suite significantly improved and enhanced.
    * Updates and improvements to pre-commit hooks and CI YAML
    files.

++++ python-phonenumbers:

  - update to 9.0.34:
    * Merge metadata changes from upstream 9.0.34

++++ python-plette:

  - update to 2.2.2:
    * Support cool-down-period in [pipenv] section with proper format validation and timedelta conversion
    * Support TOMLKit elements inside _LockFileEncoder and enforce UTF-8 decoding
  - add fix-version.patch

++++ python-psygnal:

  - update to 0.15.1:
    * fix: Fix leaking objects by `connect_child_events=True` in
    `SignalGroupDescriptor`  #407 (Czaki)
    * build: Update ci #405 (tlambert03)
    * chore:Fix docs build by bump build system #403 (Czaki)
    * Making ordered set reversible #395 (yfukai)
    * Drop pydantic1 #392 (tlambert03)
    * build: drop 3.9, support 3.14 #391 (tlambert03)
    * ci(dependabot): bump astral-sh/setup-uv from 6 to 7 #390
    ([dependabot[bot]](https://github.com/apps/dependabot))
    * ci(pre-commit.ci): autoupdate #389 ([pre-commit-
    ci[bot]](https://github.com/apps/pre-commit-ci))
    * ci(dependabot): bump pypa/cibuildwheel from 3.1 to 3.2 #388
    ([dependabot[bot]](https://github.com/apps/dependabot))
    * **Implemented enhancements:**
    * feat: Allow to replace selection content in with one event
    emitted #387 (Czaki)
    * feat: allow SignalInstances for evented dataclass fields to
    emit on field mutation (in addition to field change) #379
    * feat: allow psygnal.testing functions to to accept connection
    kwargs #378 (tlambert03)
    * feat: support coroutine functions #346 (tlambert03)
    * feat: support pydantic @computed_fields,  and arbitrary
    `field_dependents` for event emission #340 (tlambert03)
    * feat: Support bubbling up of events from evented children on
    dataclasses  #298 (tlambert03)
    * fix: fix evented container pydantic serialization #377
    (tlambert03)
    * fix: fix typing in psygnal testing #374 (tlambert03)

++++ python-regex:

  - update to 2026.6.28:
    * Git issue 604: regex fails on free-threading python because
    setlocale is not thread-safe

++++ python-responses:

  - update to 0.26.2:
    * Default headers (such as ``Content-Type``, ``Date`` and
    ``Server``) are now stripped from recorded files regardless
    of header name case.  Previously, responses recorded from
    servers that send lowercase header names (for example over
    HTTP/2) kept these redundant headers in the generated file.
    * Fixed `query_param_matcher` mutating the caller's params dict
    when numeric values are provided. See #801

++++ python-rich-rst:

  - Update to version 2.1.0:
    * Add -S/--save-html and -d/--debug CLI flags
    * Improved error messages and help text
    * Expanded test coverage and CI automation
    * No runtime dependency changes

++++ python-rq:

  - update to 2.10:
    * Added webhook notifications to notify external end points
    when a job finishes or fails. Thanks @selwin!

++++ python-service_identity:

  - update to 26.1.0:
    * Python 3.14 and 3.15 are now officially supported.
    * *service-identity* now uses *cryptography*'s Rust-based ASN.1
    decoder and doesn't depend on *pyasn1* and *pyasn1-modules*
    anymore.
    * As a result, the oldest supported pyOpenSSL backend
    combination is now *pyOpenSSL* 26.1.0 with *cryptography*
    47.0.0.
    * Verifying a single-label hostname (e.g. `localhost`) against
    a wildcard certificate pattern now raises `VerificationError`
    cleanly instead of crashing with an opaque `ValueError`.

++++ python-soupsieve:

  - update to 2.8.4:
    * **FIX**: Fix another inefficient attribute pattern
    (@mauriceng98).
    * **FIX**: Limit total number of selectors processed in a
    pattern to prevent massive selector requests (@mauriceng98).

++++ python-sphinx-scrapy:

  - update to 0.8.6:
    * Add index templates for extension-defined cross-reference
    types so related objects appear in generated Sphinx indexes.
    * Normalize project IDs loaded from :file:`pyproject.toml` and
    inferred from Sphinx metadata.
    * Fix links in :file:`llms.txt`.
    * Rewrite generated Markdown links for supported Intersphinx
    targets from .html to .md.
    * Extended easy Intersphinx configuration to aiohttp curl-cffi
    niquests
    * Document installation from Git for sphinx-scrapy and sphinx-
    scrapy[tox].
    * Upgrade sphinx-markdown-builder.

++++ python-stevedore:

  - update to 5.9.0:
    * zuul: Use openstack-python3-next-jobs template
    * pre-commit: Bump versions
    * Do not install code to build release notes
    * Drop support for Python 3.10

++++ python-textual:

  - update to 8.2.8:
    * Fixes for extended key processing, and a crash bug for
    clicking the screen padding area.
    * Fixed parsing Kitty extended keys with multiple codepoints
    https://github.com/Textualize/textual/pull/6592
    * Fixed crash when clicking in the Screen's padding
    https://github.com/Textualize/textual/pull/6598
    * super+backspace is now an alias for ctrl+u in Input and
    TextArea https://github.com/Textualize/textual/pull/6594
    * alt+backspace (option+backspace on Mac) has the same effect
    as ctrl+backspace in Input and TextArea

++++ python-ty:

  - update to 0.0.56:
    * Avoid MRO cycle when collecting NamedTuple fields
    * Model `int` and `str` enum value normalization
    * Prefer reflected operators by runtime class
    * Exit with status 130 when interrupted
    * Avoid exponential OR-pattern reachability
    * Reduce bound typevar identity overhead
    * Infer generic class pattern capture types
    * Narrow exact tuples through sequence patterns
    * Recognize inherited enum member constructors
    * Respect return-context inference when filtering overloads
    * Sync vendored typeshed stubs (#26501). Typeshed diff
  - update to 0.0.54:
    * Avoid duplicate configuration error output
    * Avoid stack overflows in reachability analysis
    * Fix divergent recursive tuple cycle handling in ty
    * Fix panic from relation queries during cycle recovery
    * Fix panics by reverting recursive `TypeOf` cycle recovery
    * Support basic usages of `__class__` closure cells in methods
    * Fix typealias token classification inconsistency
    * Implement rust-analyzer's "Click for full compiler
    diagnostic" feature
    * Co-locate retained definition usage state
    * Use never-change durability for immutable file inputs
    * Reject undeclared protocol instance attributes
    * Allow replacing ordinary methods with compatible functions
    * Distinguish `typing.TypedDict` from
    `typing_extensions.TypedDict`
    * Don't treat non-empty ranges as single-valued
    * Handle TypeVar bounds over `type[...]` in attribute lookup
    * Infer definite equality comparison results
    * Infer mismatched literal comparisons
    * `match` statements: make class-pattern fallthrough member-
    aware
    * `match` statements: prove TypedDict structural patterns
    exhaustive
    * `match` statements: resolve positional class-pattern
    exhaustiveness
    * Model non-exhaustive enum member sets (`enum.Flag`s)
    * Reduce retained definition map storage
    * Reuse equality semantics for membership compatibility
    * Sync vendored typeshed stubs to support `builtins.sentinel`
    * Treat non-empty `range` calls as non-empty for reachability
    * Use assignability for divergent constraints
    * Widen inferred class-valued instance attributes
  - update to 0.0.53:
    * Avoid bypassing lazy constraints for `Divergent`
    * Avoid recursion when projecting narrowing constraints
    * Fix ParamSpec callable signature extraction for callable
    instances
    * Make multi-arm `TypeOf` cycle recovery monotonic
    * Document all special forms in `ty_extensions`
    * Avoid cloning fallback condition flow snapshots
    * Avoid constructing discarded speculative diagnostics
    * Avoid path lookups when sorting same-file diagnostics
    * Cache `is_never_satisfied` results
    * Defer applying type context to simple standalone expressions
    * Infer types for names bound in match patterns
    * Preserve regular kind for callable instances
    * Simplify intersections of invariant generic types with `Any`
    specializations
  - update to 0.0.52:
    * Avoid shadowing hints for attribute assignments
    * Fix dict.pop overloads to accept arbitrary keys with defaults
    * Normalize recursive `TypeOf` across multiple union arms
    * Normalize recursive `TypeOf` growth during cycle recovery
    * Normalize recursive protocol growth during cycle recovery
    * Preserve generic alias identity during cycle recovery
    * Recover from dynamic class code generator cycles
    * Add a go-to destination for `Divergent`
    * Publish diagnostics for all open files after a single file is
    saved
    * Render Markdown for reStructuredText fields in docstrings on
    hover
    * Make `error-on-warning` the default
    * Make rendering of fix diffs more concise
    * Avoid allocating disabled error context trees
    * Avoid lookup maps for small place tables
    * Avoid moving boxed use-def map builders
    * Avoid transient AST ID merge map
    * Batch signature typevar freshness scans
    * Box large semantic index builders
    * Build frozen definition maps directly
    * Compact use-def binding interner keys
    * Consume condition flow snapshots
    * Lazily allocate reachability caches
    * Remove redundant use-def state shrinking
    * Reuse the first union bindings buffer
    * Short-circuit terminal narrowing constraints
    * Solve simple constraint conjunctions directly
    * Store cycle-detector cache entries inline
    * Stream indexed AST construction
    * Suppress discarded TypedDict diagnostics
    * Use SmallVec for `CycleDetector::seen`
    * Use a SmallVec for seen type aliases
    * ### Core type checking
    * Raise limit for number of non-recursive union literals
    * Preserve gradual behavior for explicit Any subclasses
    * Preserve metaclasses when inheriting from intersection-typed
    bases
    * Recognize exhaustive matches over finite tuples
  - update to 0.0.51:
    * Fix bound TypeVar default cycle recovery
    * Support `Annotated[Any, ...]` as a class base
    * Suggest keyword-only arguments between variadic parameters
    * Avoid assuming classes with `Any` or `Unknown` bases are
    descriptors
    * Infer simpler types in complex lambda cycles
    * Preserve exact class objects during identity narrowing
    * Preserve unpacking diagnostics for nested assignment targets
    * Compact indexed AST node storage
    * Discard dead DNF branches in intersection building
    * Remove broken gradual guarantee link
  - update to 0.0.50:
    * Avoid cross-TypeVar leakage in generic inference
    * Fix panic from oscillating collection-use constraints
    * Preserve type variables in fixed tuple aliases
    * Respect ParamSpec binding contexts
    * Show bare `Final` as a special form on hover
    * Support options in functional dataclass calls
    * Add context-sensitive keyword completions
    * Fix wildcard import symbol range
    * Highlight decorated methods consistently
    * Preserve narrowing after qualified `TYPE_CHECKING`
    * Respect client's content format preference
    * Retain all diagnostic annotations in the server
    * Track unused-binding captures across nested scopes
    * Fix override diagnostics for decorated methods
    * Improve `duplicate-base` diagnostics
    * Reject invalid dataclass flag combinations
    * Reject legacy TypeVars in PEP 695 class bases
    * Reject legacy TypeVars in PEP 695 functions
    * Respect `@no_type_check` in function validation
    * Avoid rebuilding unchanged specializations
    * Avoid redundant equality intersections
    * Avoid retaining empty use-def tables
    * Compact retained definition inference extras
    * Deduplicate retained scope inference types
    * Disable LRU tracking for one-shot checks
    * Fast path collection literals with exact type contexts
    * Flatten retained declaration states
    * Improve flow snapshot performance
    * Skip stub package checks in stub-free search paths
    * Speed up large-union narrowing
    * Speed up module resolution for projects with many search
    paths
    * Store cumulative binding end offsets
    * Use compact frozen representation for narrowing constraints
    * Annotate intersection and negation types using `&` and `~`
    * Diagnose zero-step slices on lists
    * Full-scope bidirectional inference for non-empty collection
    literals
    * Improve equality-based narrowing for `==`, `!=`, and `match`
    * Infer precise values for standard-library enums
    * Make equality evaluation cycle-aware
    * Narrow equality across IntEnum classes
    * Narrow tuple expression match subjects
    * Preserve literal types for loop variables over literal
    collections
    * Preserve negative narrowing for starred sequence patterns
    * Preserve non-final types in Hashable unions
    * Support enum literals as tagged-union discriminants
    * Sync vendored typeshed stubs (#25952). Typeshed diff
    * Sync vendored typeshed stubs (#25997). Typeshed diff
    * Synthesize NamedTuple `__match_args__`
    * Treat assigned enum hooks conservatively
    * Validate deprecated warning categories

++++ python-tzlocal:

  - update to 5.4.4:
    * Improved handling if you have a syntax error in /etc/clock.
    * Moved the tests back, removed the ones that check for
    symlinks.
    * Open files with Zone names as ascii.
    * Moved tests under `tzlocal/tests` and include them in
    distributions.
    * Dropped support for Python 3.9 and added support for 3.14.

++++ python-watchfiles:

  - update to 1.2.0:
    * ci: add riscv64 manylinux wheels
    * fix linting
    * Add Python 3.15-dev build, drop 3.9, increase MVRV to 1.83
    * fix: improve type safety and error handling
    * Ruff target version to 3.10
    * upgrade uv lock

++++ yt-dlp:

  - Update to version 2026.07.04
    * The minimum recommended Python version has been raised to
    3.11
    * Security: [CVE-2026-55404] Downstream command injection via
    improper sanitization of --write-link output
    * Shortcut file data is now properly validated and sanitized
    when the --write-link options are used
    * Always include warnings in debug output
    * Fix allow-unsafe-ext compat option
    * Raise minimum recommended Python version to 3.11
    * Validate and escape values in --write-link output
    * cookies: Use ' instead of " for SQL string quoting
    * utils: Deprecate make_dir in favor of make_parent_dirs
    * utils: HTTPHeaderDict: Fix __ior__
    * utils: parse_duration: Return int when appropriate
    * utils: parse_resolution: Support fps suffixes
    * utils: pkcs1pad: Fix invalid PKCS#1 v1.5 padding bytes
    * utils: qualities: Avoid repeated index lookups
    * utils: random_user_agent: Bump version range 143-149 =>
    144-150
    * Always include id in request error output
    * Fix request logging
    * arte: Fix playlist support
    * bandcamp: weekly: Fix extractor
    * bilibili: Fix API extraction
    * instagram: Detect when cookies are invalidated
    * instagram: Rework extractor
    * linkedin: Remove broken login support
    * mgtv: Fix VIP stream extraction
    * mxplayer: Fix extractors
    * mxplayer: Rework extractors
    * niconico: Fix error detection
    * niconico: Support shorts
    * omnyfm: Add extractors
    * openrec: Rework extractors
    * patreon: Support new URL format
    * peertube: Support password-protected videos
    * periscope: Improve metadata extraction
    * reddit: Remove broken login support
    * soundcloud: Extract uploader_url for playlists
    * soundcloud: Extract comments
    * soundcloud: Improve metadata extraction
    * streaks: Fix extractor
    * svt: Fix extractor
    * telewebion: Fix extractor
    * trovo: Remove dead extractors
    * truth: Support share URLs
    * tviplayer: Fix extractor
    * unsupported: Update unsupported sites
    * wrestleuniverse: vod: Fix extractor
    * youtube: Fix extract_relative_time for abbreviated units
    * youtube: Fix detection of forced preroll wait time
    * youtube: Fix minor issues
    * youtube: Support live adaptive formats
    * tab: Fix flat extraction of collaborators
    * tab: Fix flat playlist metadata extraction
    * tab: Fix metadata extraction
    * tab: Fix pagination
    * zan: Add extractor
    * zdf: Detect livestreams
    * zoom: clips: Add extractor
    * external: Fix resuming downloads with aria2c
    * external: curl: Support development versions
    * mhtml: Fix storyboard content-length calculation
    * build: Update 17 dependencies
    * build: Update 6 dependencies
    * cleanup: Fix invalid info dict fields
    * cleanup: Fix minor mistakes
    * cleanup: Remove RTSP and MMS support
    * cleanup: Replace dead example/test URL
    * cleanup: Miscellaneous: 997fa14
    * docs: Make "No AI / No LLM Policy" abundantly clear

++++ restic:

  - update to 0.19.1
  - Fix #5234: Prevent mounting over the repository directory
  - Fix #5667: Skip inaccessible backup source paths
  - Fix #5722: Update mount latest symlink after snapshot reload
  - Fix #21866: Hide stats progress bar in JSON mode
  - Fix #21869: Restore old behavior of snapshots --latest <n>
    without --group-by
  - Fix #21876: Show timezone location in snapshots output
  - Fix #21879: Prevent crash in mountpoint validation if
    mountpoint is inaccessible
  - Fix #21895: Remove read-only files via the SFTP backend on
    Windows servers
  - Fix #21899: Make backup respect excludes for duplicate
    directory entries
    For all the details see:
    https://github.com/restic/restic/releases/tag/v0.19.1

++++ rtorrent:

  - Update to release 0.16.16
    * Added max http request size and limited redirect protocols to
    http/https.

++++ spicetify-cli:

  - Update to version 2.44.0:
    * ci(dependabot): create PRs every month
    * chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 (#3879)
    * fix(update): close response body and file on error paths (#3829)
    * chore(deps): bump golang.org/x/net from 0.49.0 to 0.56.0 (#3878)
    * fix(expFeatures): properly apply experiments
    * ci: allow unsigned builds on forks
    * fix(shuffle+): use `PlatformAPI` for getting liked songs
    * chore: lint wrapper module
    * fix: properly assign `ReactQuery` and add spicetify to session path
    * feat: add support for Spotify `1.2.93`
    * fix(css-map): correct malformed CSS class name (#3881)
    * feat(css-map): add some canvas classes for 1.2.86 (#3867)
    * fix(config): infinite loop on spotify_launch_flags and non-deterministic extension ordering (#3847)
    * chore(deps): bump actions/upload-artifact from 6 to 7 (#3714)
    * chore(deps): bump actions/checkout from 6 to 7 (#3865)
    * fix(loopyLoop): loop between markers when repeat-one is active (#3833)
    * feat(css-map): add discography page classes for 1.2.86+ (#3838)

++++ ssh-audit:

  - Update to version 3.9.0
    * Warnings will be issued on key exchanges that are not
    post-quantum safe.
    * Hardening guides are now included for all supported platforms
    (see --list-hardening-guides).
    * UNIX sockets can be used as scan targets (specified with
    unix:///path/to/socket); useful in containerized environments
    such as CI/CD pipelines.
    * Scanning through SOCKS5 proxies can now be done (with --socks5)
    * A variety of new post-quantum algorithms can now be identified.
  - Update ssh-audit.keyring

++++ strawberry:

  - Update to version 1.2.22
    + Fixed editing tags for files on GVFS mounts (SMB, SFTP, MTP) by editing a local temporary copy (#1696)
    + Fixed the seekbar treating the mouse as still pressed when playback is stopped while seeking (#2075)
    + Fixed the beginning of songs being cut off while the audio device (DAC) is warming up with a new configurable device warm-up delay (default 500 ms)
    + Fixed empty available icon size handling for scalable (SVG) icons (#2171)
    + Fixed Musixmatch lyrics search
    + Removed logging of access tokens
    + Numerous stability, crash-safety and thread-safety fixes throughout the application
    + All central palette color roles are now configurable under appearance settings, with a dark mode preset (#2063)
    + Simplified GStreamer pipeline state handling and teardown, playback now starts directly without an intermediate pause
    + Turned on Subsonic certificate verification by default
    + Apply a default transfer timeout to network requests
    + Removed Last.fm import (#1936)

++++ weechat:

  - Update to 4.9.3:
    * core: fix buffer overflow in connection to SOCKS5 proxy (#2325)
    * core: fix possible buffer overflow in command /color alias (#2330)
    * core: fix possible buffer overflow in list of commands displayed
    by /help (#2330)
    * api: do not free dynamic string on error in function string_dyn_concat
    * relay/api: fix memory leak in resources "handshake", "input" and
    "completion" (GHSA-wmpc-m6g9-fwj8)
    * relay: fix read of uncompressed websocket frame (#2331)
    * xfer: fix out-of-bounds write in xfer file transfer resume (#2326)

++++ zswap-cli:

  - update to 1.2.0:
    * Add a new --verbose command-line option to display additional
    information for debugging or informational purposes.
    * Add the ability to use the --help and --version command-line
    options without super-user privileges.
    * Add printing of old ZSwap values when setting new values.
    * Add a check to ensure a new value was set correctly.
    * Add optional appdata manifest file for modern package managers
    * Deprecate obtaining ZSwap options from the environment
    variables

------------------------------------------------------------------
------------------  2026-7-4  -  Jul 4 2026  -------------------
------------------------------------------------------------------

++++ 3proxy:

  - Moved configuration from /var/lib/3proxy to /etc/3proxy.
  - Updated to 0.9.7
    * https://github.com/3proxy/3proxy/releases/tag/0.9.7
    * Moved PCRE2 and SSL/TLS code from plugins into main 3proxy binary.
    * Added 3proxy_crypt new internal password hashing replacing mycrypt.
    * Supported Unix sockets for parent proxies, tcppm, internal listeners and -i option.
    * Added ssl_client_mode = 3 to use 'secure' parent types: https, tcps, socks5s, connect+s, etc.
    * Added SOCKSv5 UDP parent support; -Ne/-Ni NAT options.
    * Allowed setting internal/external network namespaces on Linux.
    * Fixed multiple minor bugfixes and code cleanup.

++++ asl:

  - Update to version 142-bld310
    Addition
    * Add BF16 directive to dispose floating point constants in
    BFloat16 format.
    * P2BIN has new byte-swap option to perform pairwise or
    quartet-wise swap of bytes.
    Bugfixe
    * TMS320C3x: Allow trap vectors 0..31
    * TMS320C3x: Mute exponent when using LDM with immediate source
    operand.
    * repair INHX16M output for PIC targets.
    * TMS320C3x: assume no dest operand for CMPI3 and CMPF3, just
    like for TSTB3.
    * TMS320C3x: allow certain parallel operations also in reverse
    order
    * TMS3203x: Optionally upgrade a 2-operand instruction to three
    operands to achieve a valid pair for parallel execution.

++++ bluetuith:

  - Update to version 0.2.7:
    * Adapted to new tview changes
    * Backend fixes
    * Fixed OBEX and Media Player events and progress rendering
    * Minor bugfixes

++++ cage:

  - Update to version 0.3.1:
    * build: bump version to v0.3.1
    * xdg_shell: fix windows requesting fullscreen on startup
    * build: guard git version detection against missing .git directory
    * cage: stop using DEFAULT_XCURSOR as a cursor theme name

++++ lagrange:

  - update to 1.20.9
  - Fixed: Potential crash when Fingerprints menu open in Page Information.
  - Fixed: Page Information popup dismissed inadvertently.
  - Improved list resizing performance: contents should not be invalidated on
    height changes, since items are anyway buffered for vertical scrolling.
  - Ask SDL to use the Wayland video backend when running on a Wayland display.
    (This should fix rendering glitches on KDE Plasma.)

++++ clustershell:

  - Update to upstream release 1.10:
    * NodeUtils: add the 'mapall' group source upcall to retrieve all
    group mappings in a single call, greatly speeding up group
    resolution on slow sources (#612, #613)
    * NodeUtils: do not pass stdin to group source upcalls (#581)
    * NodeSet, RangeSet: add a list-like index() method returning the
    position of a node or element, the inverse of [i] (#631, #633)
    * cluset, nodeset: add a --index command to output a node's
    position in the set, the reverse of -I/--slice (#637)
    * groups.conf: add mapall upcalls to the Slurm group bindings (#623)
    * groups.conf: add an Ansible inventory group source example (#610)
    * clush, clubak: add --axis to fold nD node sets along selected
    axis only, as already supported by nodeset and cluset (#356)
    * Display: fix line buffering on Python 3.6 (#597)
    * Tree: implement TreeWorker.abort() and per-gateway abort, with
    gateway failover fixes (#229, #566)
    * Tree: fire ev_pickup only once the command can no longer be
    rerouted and improve reroute event reporting (#594)
    * Tree: fix rcopy when a remote node closes (#545)
    * Tree: improve handling of MessageProcessingError (#596)
    * Tree: keep tar/scp errors on stderr instead of stdout during
    forward copy (#622)
    * Tree: pass filter='fully_trusted' to tarfile.extractall()
    (PEP 706) (#617)
    * EngineClient: properly honor the abort flag on close (#591)
    * Engine: fix set_events debug logging to identify the client and
    stream (#630)
    * Task: only terminate a task once when killed, fixing a double
    termination (#110, #640)
    * NodeUtils, Topology: emit a DeprecationWarning for set_verbosity()
    and the topology.conf [Main] section (#226, #639)
    * completion: complete copy paths and command, and short options
    without spaces (#585, #586)
    * completion: treat -b/-B and clush's other no-arg options as flags
    (#598, #619)
    * completion: fix cluset no-arg option lists (#620)
    * setup: clean up wheel packaging metadata (#634)
  - Update Source0 to the new PyPI sdist filename, lowercase since 1.10
    per PEP 625: clustershell-1.10.tar.gz (importable Python module is
    still named ClusterShell)
  - Update URL to new upstream project page (repository moved to
    https://github.com/clustershell/clustershell)
  - Ship the bash completions for clush, cluset and nodeset
  - Add an import smoke test to the spec check section
  - Set explicit permissions on the ghost groups file (rpmlint
    zero-perms-ghost)

++++ gpxsee:

  - Update to version 16.11
    * Removed Qt-private dependency.
    * Improved KMZ files loading.

++++ heroic-games-launcher:

  - Apply security patches for embedded dependencies:
    * Add extract-zip-cve-2026-56876.patch to fix path traversal via
    malicious symlinks (bsc#1269757, CVE-2026-56876).
    * Add inline sed patches in %build to mitigate electron-updater
    credential leak (bsc#1269970, CVE-2026-54673).
    * Add inline sed patches in %build to mitigate app-builder-lib
    LD_LIBRARY_PATH hijack (bsc#1269968, CVE-2026-54672).
    * Note: The electron-updater and AppImage vulnerabilities do not
    affect the native RPM build at runtime, but the embedded code
    is sanitized to comply with automated security scanners.

++++ ouch:

  - Update to 0.8.1:
    Highlighted changes:
    * security improvements #951
    * fix exit code in non-interactive mode #1011
    * fix: ignore invalid unix permissions and setuid bits from zip #1007
    Other Changes
    * tweak extract logic in preparation for sandboxing #996
    * ci: bump actions/checkout from 6 to 6.0.2 in the github-actions group #1002
    * ci: bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group #1009
    * deps: bump tar from 0.4.45 to 0.4.46 in the cargo-patch-and-minor group #997
    * deps: bump the cargo-patch-and-minor group with 11 updates #1003, #1010 and #1013

++++ python-google-cloud-bigtable:

  - update to 2.40.0:
    * regenerate google-cloud-bigtable
    * **bigtable:** populate Value type in
    _format_execute_query_view_params

++++ python-pymdown-extensions:

  - update to version 11.0.1:
    * FIX: BetterEm: Fix regex pattern inefficiencies.
    * FIX: Tilde: Fix regex pattern inefficiencies.
    * FIX: Caret: Fix regex pattern inefficiencies.
    * FIX: MagicLink: Fix regex pattern inefficiencies.

++++ tellico:

  - Update to 4.2.1
    * Added user-defined data fetch argument (kde#516055)
    * Updated Google Scholar and Colnect data sources
    * Updated Google Books data source (kde#522095)
    * Updated external data source to allow termination by user (kde#516057)
    * Updated to allow multiple ISBN values (kde#521157)
    * Updated Album template to hide empty track tables and use loan
    information
    * Increased minimum image reader memory limit.
    * Fixed bug with exporting linked images (kde#522094)
    * Fixed bug with parsing field names with emoji (kde#521148)

++++ zoxide:

  - update to 0.10.0
    * Added
    * import now supports fetching entries from atuin.
    * import now auto-detects database files.
    * import now skips directories matching $_ZO_EXCLUDE_DIRS.
    * POSIX: support for non-Cygwin Windows environments (e.g. Busybox).
    * Fish: Space-Tab completions now display and run the selected command.
    * Bash/POSIX/Zsh: z now honors $CDPATH.
    * Bash: don't add to the database when history is disabled (set +o history).
    * Nushell: export commands so the init script can be imported with use.
    * Support for RISC-V (riscv64) Linux.
    * Changed
    * import now takes a subcommand instead of the --from flag.
    * Fixed
    * Bash/POSIX/Zsh: z now handles relative paths through symlinked directories.
    * Bash/Fish/POSIX/Zsh: _ZO_RESOLVE_SYMLINKS now works on Windows.
    * Bash: handle $PROMPT_COMMAND values ending in a semicolon.
    * PowerShell: navigate to home directory with z on drives that don't define HOME.
    * PowerShell: use fully qualified names when invoking cmdlets.
    * Zsh: skip doctor diagnostics in non-interactive shells.
    * Zsh: avoid inserting a trailing space when cancelling interactive Space-Tab completions.
    * Bash: avoid blanking the prompt when cancelling interactive Space-Tab completions.
    * Bash/Fish/Zsh: avoid drawing a new line when Space-Tab completion finds no matches.
    * Tcsh: preserve any existing precmd alias instead of overwriting it.
    * Nushell: complete only directories for z, instead of all files.

------------------------------------------------------------------
------------------  2026-7-3  -  Jul 3 2026  -------------------
------------------------------------------------------------------

++++ arkade:

  - Update to version 0.11.107:
    * Fix act, ko, oras and k6 get templates
  - Update to version 0.11.106:
    * Fix README contributor note and xz dependency marking
    * Update AGENTS.md to document bz2 and tar.xz support
    * Fix duplicate tar.xz checks and add OS guard for CRC
    * Add CRC tool for OpenShift local development
    * Add tar.xz decompression support via ulikunitz/xz
    * Fix duplicate bz2 check and restore contributor note
    * Add restic backup tool with bzip2 decompression support

++++ asdf:

  - Update to version 0.19.0:
    * chore: release 0.19.0 (#2261)
    * fix: make plugin test command resolve latest version properly
    * feat: don't override semver ordering during completion (#2263)
    * fix: set ASDF_INSTALL_* environment variables for reshim command
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 (#2270)
    * fix: convert hyphens to underscores when converting plugin names to generate valid environment variables
    * chore: update asdf install action to fix lint workflow (#2264)
    * chore(golang-rewrite): remove old Bash implementation code (#1822)
    * fix: use os.PathListSeparator (#2195)
    * fix: return error from repo.RemoteUrl function
    * fix: nushell completions --ignore-errors deprecation (#2157)
    * chore(docs): bump @types/node from 25.3.3 to 25.5.0 in /docs in the docs group (#2260)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 (#2259)
    * chore(deps): bump dorny/paths-filter from 3 to 4 (#2257)
    * chore(deps): bump crazy-max/ghaction-github-pages from 4 to 5 (#2251)
    * TrimSpace on the URL returned by RemoteURL()
    * docs: update nodejs script for formatting the documentation to be the correct `npm run fmt` from the package, as the `npm run format` does not exist
    * docs: remove `The Oh-My-ZSH asdf plugin is yet to be updated, see [ohmyzsh/ohmyzsh#8837](https://github.com/ohmyzsh/ohmyzsh/pull/8837).` from the docs for zsh as it has been [updated](https://github.com/ohmyzsh/ohmyzsh/pull/8837#issuecomment-2174169900)
  - Add completion packages

++++ cJSON:

  - Add baselibs.conf (bsc#1270256)

++++ calibre:

  - Update to 9.11.0
    * New Features
  - Allow exporting annotations in the HTML format as a standalone web page
    that can be viewed in any browser with support for light/dark themes,
    searching and filtering by highlight style
  - E-book viewer: Ask AI: Allow using the {selected} placeholder when typing free form queries
    to the AI as well
    * Bug Fixes
  - E-book viewer: Fix text area not always resizing correctly
    when window is resized when the scrollbar is enabled
  - Fix a regression in the previous release that broke python templates
    in the book details panel
  - Fix a regression in the previous release that caused default values
    for custom columns to not be used when adding new books

++++ copacetic:

  - Update to version 0.14.2:
    * fix: avoid forced recompression on local export (#1637) (#1640)

++++ firecracker:

  - Update to version 1.16.1:
    * Fixed
  - #5959: Reverted the use of O_NOFOLLOW for the jailer's cgroup
    and network namespace file operations, so symlinks are again
    allowed in these paths.
  - #5958: Fixed a bug that caused vsock guest-to-host
    connections to time out after snapshot restore, triggered by
    taking a snapshot with a TX descriptor in-flight. On restore
    the device now replays the TX queue notification so in-flight
    TX descriptors are re-processed and notification suppression
    is re-armed.

++++ flake-pilot:

  - Reverse showing progress logic
    So far the user had to pass %silent to the call to make
    the pilot stop showing progress information. The default
    behavior to show progress information caused a lot of
    confusion and breakage to script code calling an application
    as a flake. It is rather unexpected that such progress
    information is provided by default. This commit reverse the
    logic such that a user has to provide %progress to see
    the progress spinner while the pilot is working.
    This Fixes #80

++++ goshs:

  - Update to version 2.1.4
    Security
    * WebDAV --no-delete bypass via MOVE/COPY (GHSA-hq33-8jgp-8qq3)
    Under -w --no-delete (and --upload-only), the WebDAV MOVE verb
    still removed the source file — a rename deletes it from its
    original path — and, with Overwrite: T, destroyed an existing
    destination; COPY onto an existing file did the same via an
    implicit delete. The mode flags are now enforced on these
    verbs: MOVE is rejected whenever deletion is disabled, and a
    COPY that would overwrite an existing file is blocked, while a
    plain COPY to a new path stays allowed.
  - -read-only continues to block all of them.
    * SFTP authentication bypass with a single credential
    (GHSA-rjrw-mjq6-hpmm)
    SFTP only installed its password handler when both a username
    and a password were configured, so setting only one left the
    server accepting unauthenticated logins. Authentication is now
    enforced whenever either credential is set.
    New Features
    * Clipboard copy in the TUI generator - The --tui reverse-shell
    generator can now copy the selected payload straight to your
  - clipboard with y/c. It works both locally (xclip/xsel,
    wl-copy, pbcopy, clip) and over SSH via OSC 52, filling both
    the system clipboard and the X11 primary selection (Ctrl+V and
    middle-click / Shift+Insert). The generator tab was also
    restructured into a stacked layout so multi-line output can be
    cleanly mouse-selected without also grabbing the menu entries.
    Bug Fixes
    * Fatal port-bind errors under --tui — Every listening protocol
    is now bound before the TUI dashboard takes over the terminal,
    so a port conflict (or any bind error) is reported cleanly and
    is fatal up front — instead of being swallowed by a serving
    goroutine, which under --tui left the terminal in raw mode
    needing a reset (and was silently dropped entirely for FTP).

++++ govulncheck:

  - Update to version 1.5.0:
    * go.mod: update golang.org/x dependencies
    * all: update to x/tools@0602b30930e3

++++ vim:

  - update to 9.2.0780
    patch 9.2.0780: Memory leak in evalvars.c on alloc failure
    patch 9.2.0779: Memory leak in type_name_func() on alloc failure
    patch 9.2.0778: Memory Leak in compile_dict() on alloc failure
    patch 9.2.0777: Memory leak in add_defer() on alloc failure
    patch 9.2.0776: Memory leak in sign_getlist() on alloc failure
    patch 9.2.0775: Memory Leak in highlight_get_info() on alloc failure
    patch 9.2.0774: Memory leak in f_getscriptinfo() on alloc failure
    patch 9.2.0773: Memory leak in evalfunc.c on alloc failure
    patch 9.2.0772: Vim9: Null dereference inside alloc_type()
    patch 9.2.0771: dict_add_list() has inconsistent ownership on failure
    patch 9.2.0770: dict_add_dict() has inconsistent ownership on failure
    translation(zh_CN): Add Chinese man pages
    patch 9.2.0769: conversion to utf-16be using iconv is inconsistent
    patch 9.2.0768: legacy/vim9cmd modifiers are not exclusive
    patch 9.2.0767: legacy/vim9cmd modifiers do not set script version for options values
    patch 9.2.0766: quick_tab entries for empty letters point to the wrong index
    patch 9.2.0765: popup: opacity popup over a terminal is not cleared when moved
    patch 9.2.0764: Compiler warning about unused function
    translation(sr): Update Serbian translation
    patch 9.2.0763: tests: style issue in test_plugin_netrw
    runtime(xml): Update xml syntax file
    runtime(doc): regenerate help tags
    patch 9.2.0762: duplicated sub-option name check in :set completion
    runtime(screen): Bring the syntax up to version 5
    runtime(typst): Improve ftplugin, and syntax file
    patch 9.2.0761: runtime(netrw): Unix: unable to open '\' file
    patch 9.2.0760: Compiler warning for using potentially uninitialized var
    patch 9.2.0759: Some code for 'autocompletedelay' is no longer needed
    runtime(autoload/dist): gx may use xdg-open on macOS
    patch 9.2.0758: pum: No opacity when background not set for Popup menu group
    patch 9.2.0757: tests: test_popupwin fails with zsh because of the prompt
    patch 9.2.0756: Session with multiple tabpages sets 'winminheight' to 0
    patch 9.2.0755: 'autocomplete' behaves inconsistently when recording
    patch 9.2.0754: repeated completion length lookup in search_for_exact_line
    patch 9.2.0753: GTK GUI deferred redraw skipped on 'lazyredraw'
    runtime: add missing fnameescape()/shellescape() in a few runtime files
    patch 9.2.0752: GTK4: drag-and-drop does not support HTML
    patch 9.2.0751: GTK3 GUI is slow under Wayland
    translation(ru): Updated message files
    patch 9.2.0750: completion: 'autocompletedelay' deferral leaks state
    patch 9.2.0749: 'autocompletedelay' interferes with i_CTRL-K
    patch 9.2.0748: 'autocompletedelay' interferes with CTRL-G U
    runtime(netrw): Use consistent forward slashes
    patch 9.2.0747: cscope: connection leak when growing the array fails
    patch 9.2.0746: NULL pointer dereference in gui_photon
    patch 9.2.0745: Crash with truncated spellfile
    patch 9.2.0744: popup_atcursor() closes immediately on white space
    runtime(odin): Update indent script, add indent tests
    patch 9.2.0743: string macros silently accept a size of the wrong type
    runtime(vim): Fix heredoc triggering misidentifcation of Vim9 script
    patch 9.2.0742: filetype: SSH keys and related filetypes not recognized
    runtime(css): add more missing CSS properties
    patch 9.2.0741: complete_check() does not return TRUE for mapped input
    patch 9.2.0740: GTK4: scrollbar wrongly displayed
    patch 9.2.0739: completion: 'autocompletedelay' blocks the main loop and drops autocommands
    runtime: guard recommended style settings consistently
    patch 9.2.0738: ml_recover() may write beyond block buffer
    CI: Bump actions/checkout in the github-actions group across 1 directory
    patch 9.2.0737: tests: comment test can be improved
    patch 9.2.0736: potential command execution in PHP omni-completion
    patch 9.2.0735: [security]: arbitrary Ex command execution during C omni-completion
    runtime(doc): Tweak documentation style and typo
    patch 9.2.0734: function pointer passed to STRNCMP() instead of a length
    runtime(cabal): Update compiler, ftplugin, syntax, add indent script
    patch 9.2.0733: GTK3: GUI slow on X11 since dropping the alpha channel
    patch 9.2.0732: session: terminal restored using absolute columns/rows
    patch 9.2.0731: GTK4 GUI scrollbar size not updated when restoring a session
    patch 9.2.0730: GTK4 GUI tabline is not updated
    patch 9.2.0729: % skips parens on continued quoted lines
    runtime(doc): Add installer updates to version9.txt
    patch 9.2.0728: filetype: supertux info pattern is relative to current dir
    patch 9.2.0727: popup images not rendered correctly when unfocused
    patch 9.2.0726: filetype detect missing from completion

++++ haproxy:

  - Update to version bfa018f:
    * CLEANUP: otel: refactored flt_otel_parse_strdup() and shown src in debug
    * MINOR: otel: test: added full, tcp and updown to the speed-test sweep
    * MINOR: otel: test: added the err test configuration for runtime error logging
    * MINOR: otel: test: added an up-down-counter test configuration
  - Update to version 3.4.2+git0.9feeb3287:
    * [RELEASE] Released version 3.4.2

++++ helm3:

  - remove replacement - is now in 3.21.2

++++ hwdata:

  - Update to version 0.409:
    * Update pci, usb and vendor ids

++++ k0sctl:

  - Update to version 0.32.0:
    * Major internal change: rig v2
    This release replaces k0sctl's entire host connection and
    remote execution layer with rig v2.0.0 (was v0.21.11), this is
    the purpose built library that handles SSH/WinRM connections,
    sudo, OS detection, remote command execution and file
    transfers.
    No changes to your k0sctl.yaml or workflows are required,
    configuration and command-line usage remain fully compatible
    and behavior should be unchanged. However, since this touches
    nearly every remote operation k0sctl performs, please keep an
    eye out for regressions. If you run into unexpected connection,
    sudo/privilege escalation, OS detection or file transfer
    issues, please file an issue and roll back to k0sctl v0.31.1
    until it's resolved.
    * What's Changed
  - refactor(rig-v2):migrate k0sctl from rig v0.x to rig v2 by
    @kke in #1092

++++ kubeseal:

  - Update to version 0.38.2:
    * Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (#1997)
    * Bump github.com/onsi/ginkgo/v2 from 2.30.0 to 2.32.0 (#1998)
    * Bump k8s.io/client-go from 0.36.1 to 0.36.2 (#1996)
    * Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 (#1995)
    * Bump k8s.io/code-generator from 0.36.1 to 0.36.2 (#1993)
    * Bump k8s.io/api from 0.36.1 to 0.36.2 (#1994)

++++ lazarus:

  - Update to 4.8
    * This is a bugfix release for which no seperate release notes were
    published. The previous release notes still apply:
    https://wiki.freepascal.org/Lazarus_4.0_release_notes

++++ lazyworktree:

  - Update to version 1.48.0:
    * Features
  - Reset Existing Worktrees: Added a new --update-on-existing
    (-U) flag to the create command to automatically fetch and
    hard-reset an existing clean worktree to its remote head
    instead of failing.
  - Kitty-Compatible Avatar Badges: Show small, circular PR/MR
    author avatars in the Info pane on supported terminals (e.g.,
    Kitty, WezTerm, Ghostty) via the new avatar_badges
    configuration.
  - Unified Command Environment: Standardized environment
    variable execution across custom commands, containers,
    lifecycle hooks, and CLI commands. Exposes a consistent set
    of WORKTREE_*, REPO_*, and contextual LAZYWORKTREE_*
    variables.
  - Hyperlinked Repository Headers: Enabled OSC 8 hyperlinking on
    the repository header in the TUI to quickly open remote
    repositories in the browser, and shortened home path
    directories shown in the Info pane.
  - CLI Debug Logging: Added a --debug-log command-line flag to
    configure debug logging dynamically to a file for easier
    troubleshooting of interactive selectors.
  - Cache Clearing & PR Fetch Shortcut: Added a dedicated
    cache-clear action to empty in-memory/on-disk caches and
    assigned the p key to fetch PR data separately without
    triggering full UI refreshes.
    * Bug Fixes
  - CPU Resource Pegging: Fixed an issue where the loading
    spinner and file watcher consumed excessive CPU resources
    while idle. The spinner tick loop now self-stops when
    inactive and restarts only when loading operations begin.
    * Performance Improvements
  - Agent Session Caching & Debouncing: Optimized AI agent
    transcript watching by caching parsed registries in-process
    and introducing an adjustable debounce throttle
    (agent_sessions.refresh_debounce_ms) to lower CPU usage when
    agents are actively writing.
  - FZF Preview Temp Files: Switched the interactive selector's
    preview mechanism to write fzf preview content to temporary
    files, preventing command-line length limit issues and
    enhancing execution performance.
    * Maintenance
  - Contributor Policy: Added an External Contributor Disclosure
    policy in AGENTS.md requiring AI agents to clearly disclose
    their involvement, toolsets, and model configurations in pull
    requests or issues.
  - Makefile Enhancements: Silenced build output in the Makefile
    and added confirmation messages on successful build
    completion.
  - Documentation Updates: Clarified that the run command (!)
    executes shell commands, and revised feature descriptions for
    clarity.
  - Performed weekly maintenance updates (#74).
    * Dependencies
  - Bumped actions/checkout from v6 to v7.
  - Bumped github.com/urfave/cli/v3 from 3.10.0 to 3.10.1.
    * Breaking Changes
  - None.

++++ libqcow:

  - Update to release 20260703
    * A bit of format version 3 support

++++ sso-mib:

  - Import version 0.10.0
    This release adds an async API for all functions that communicate
    via DBus. The API is modeled similar to gdbus. Manpages for tools
    are also now provided.

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1087
  - improved logging
  - 4.5.339

++++ upower:

  - Update to version 1.91.3:
    + Feature: up-device-battery: Prefer "Standard" over "Fast"
    charging
    + Fix: Resolve potential leaks
    + Fix: Potential out-of-bound access
    + Fix: Improve access control
    + Fix: Remove unused codes
    + Fix: Fix for Asus Battery Charge Threshold Detection
  - Drop 25303ba52771ee514b70fb1a5318a8313889ac31.patch: Added
    upstream.

++++ lima:

  - Update to version 2.1.4:
    * cmd/limactl: include name in network list --json output
    * templates/freebsd-15: support 9p mounts
    * templates: update
    * nerdctl: update from v2.3.3 to v2.3.4
    * fix(qemu): fallback from hvf to tcg on macOS
    * Only add xorrisofs flag to the xorrisofs command

++++ mesheryctl:

  - update to 1.0.52:
    No CLI-related changes
  - update to 1.0.51:
    * General
  - sync go.mod @aabidsofi19 (#20400)
  - Maintainers.md: rm codexraunak; update matrixkavitha
    affiliation @yi-nuo426 (#20356)
  - [refactor] Standardize Method Not Allowed error in
    ServerEventConfigu… @emphor11 (#20163)
    * Meshery CLI
  - [Server] Bump github.com/meshery/schemas to v1.3.22
    @leecalcote (#20395)
    * Maintenance
  - feat(operator-chart): modernize to operator v1.0.0 — CRD
    updates on upgrade, opt-in conversion webhook, release-driven
    publishing @alexquincy (#20410)
  - Chore: Get rid of orphan root policies folder @aabidsofi19
    (#20376)
  - fix(e2e): search and import model e2e test @KhushamBansal
    (#20351)
  - [CI] Fix Rego workflow: setup-regal action moved to
    open-policy-agent org @leecalcote (#20396)
  - chore(deps-dev): bump eslint from 10.5.0 to 10.6.0 in /ui
    @dependabot[bot] (#20384)
  - chore(deps): bump @sistent/sistent from 0.21.25 to 0.21.26 in
    /ui @dependabot[bot] (#20389)
  - chore(deps): bump @sistent/sistent from 0.21.25 to 0.21.26 in
    /provider-ui @dependabot[bot] (#20383)
  - chore(deps): bump js-yaml from 5.1.0 to 5.2.0 in /ui
    @dependabot[bot] (#20387)
  - chore(deps): bump xstate from 5.32.2 to 5.32.3 in
    /provider-ui @dependabot[bot] (#20388)
  - chore(deps-dev): bump eslint from 10.5.0 to 10.6.0 in
    /provider-ui @dependabot[bot] (#20386)
  - chore(deps): bump @meshery/schemas from 1.3.15 to 1.3.18 in
    /provider-ui @dependabot[bot] (#20385)
  - Fix(ui): Use distinct FilterAllIcon for select-all checkbox
    in Header @kanishksingh23 (#19004)
  - Fix path for removing current docs pages @fitzergerald
    (#20352)
    * Documentation
  - docs: Upgrading Meshery guide; Server-managed operator
    lifecycle; Operator/MeshSync/Broker concept uplift
    @alexquincy (#20413)
  - Chore: Get rid of orphan root policies folder @aabidsofi19
    (#20376)
  - [Docs] Fix broken sample app image references
    @akshatsinghai6682-sketch (#20393)
  - Fix(ui): Use distinct FilterAllIcon for select-all checkbox
    in Header @kanishksingh23 (#19004)
  - docs: add Meshery Operator contributing guide @leecalcote
    (#20366)
  - fix/update-community-discussion-link @Sbragul26 (#20321)
  - fix: improve sidebar text visibility @Sbragul26 (#20304)
  - improve docs scrollbar ui @saurabhraghuvanshii (#20358)

++++ mutter:

  - Update to version 50.3:
    + Fix erroneous stack order changes on workspace switches
    + De-prioritize focusing desktop windows
    + Ensure preferred_scale event is sent to clients
    + Fix incorrect accumulated damage in screencasts
    + Fix triggering OSK for text_input_v3 version 1 clients
    + Fixed crashes
    + Misc. bug fixes and cleanups
  - Drop patches applied upstream:
    + ba64e055b5159a3acd5b4e4bc3d381066b26c62c.patch
    + 5096.patch

++++ python-nanobind:

  - update to release 2.13.0
    * for details about changes see
    github.com/wjakob/nanobind/blob/master/docs/changelog.rst
  - adapt nanobind-installationpath.patch to fit 2.13.0
  - add nanobind-typing-cache.patch from upstream to fix abort
    after running tests

++++ nekobox:

    Update to 5.11.26
  - Improve Tun mode, fix core exiting too frequently

++++ netbird:

  - Update to 0.74.2
  - [management] Add vLLM e2e test by @braginini in #6649
  - [misc] Fix GHCR image push after dockers_v2 migration by
    @mlsmaycon in #6653
  - [client] Increase management client gRPC receive limit default
    to 16MB by @riccardomanfrin in #6641
  - [client] Fix slow wg operations by @pappz in #6633
  - [client] backport enforce a single selected exit node by @pappz
    in #6640
  - [client] Fix backoff.Ticker goroutine leak in reconnect guard
    by @theodorsm in #6663

++++ obs-service-replace_using_package_version:

  - Update to version 1783095920.1c1ddba (bsc#1270270):
    * Bump version: 0.0.12 → 0.0.13
    * Depend on /usr/bin/python3
    * Bump actions/setup-python from 6.2.0 to 6.3.0
    * Bump actions/cache from 5 to 6
    * Bump actions/checkout from 6 to 7

++++ openQA:

  - Update to version 5.1783076943.6691832d:
    * test: Stabilize `t/05-scheduler-full.t`

++++ perl-IPC-ShareLite:

  - Fix Provides: Do not include modules from the inc/ directory

++++ pinentry:

  - Update to 1.3.3:
    * gtk,curses: Add --focus=ok option to CONFIRM command. [T8315]
    * tty: Discard input on timeout. [rP4c72137885]
    * Various build fixes.

++++ pinentry-gui:

  - Update to 1.3.3:
    * gtk,curses: Add --focus=ok option to CONFIRM command. [T8315]
    * tty: Discard input on timeout. [rP4c72137885]
    * Various build fixes.

++++ python-anthropic:

  - Lower the typing_extensions dependency floor to >= 4.13.2
    (the version in openSUSE Leap 16.0) instead of >= 4.14; the
    newest typing_extensions name used by the code is TypeIs,
    available since 4.10.0, and typing_extensions.Sentinel (added
    later) is not used. Verified by running the packaged offline
    test selection (211 passed) against typing_extensions 4.13.2.

++++ python-awscrt:

  - Update to version 0.35.0
    * Metric update by @rakshil14-2 in (#735)
    * noCertificateRevocation option binding by @sbSteveK in (#748)
    * adding certificate_source to crt layer by @rakshil14-2 in (#747)
    * adding tls_cipher Pref by @rakshil14-2 in (#749)
    * S3FileIoOptions.direct_io now supports download as well by @TingDaoK in (#750)

++++ python-langsmith:

  - Lower dependency floors to the versions shipped by openSUSE
    Leap 16.0 (verified not to change functionality):
    * websockets: require >= 14.2 instead of >= 15.0; only the
    sync and asyncio connect() calls with additional_headers
    and open_timeout are used, both available since websockets
    14.0
    * zstandard: require >= 0.22.0 instead of >= 0.23.0; only
    ZstdCompressor().stream_writer() with closefd is used,
    available since zstandard 0.15.0
    Verified by a full package build whose unit test suite
    (332 passed) succeeds against Leap's websockets 14.2 and
    zstandard 0.22.0.
  - Update to 0.9.7:
    * Add an optional Google ADK Live voice tracing integration
    (new google-adk-live extra; not enabled in this package)
    * Attribute voice traces via ls_integration metadata and set
    provider/model metadata on voice LLM runs for cost tracking
  - Enable the OpenTelemetry span utility unit tests (new
    BuildRequires on python-opentelemetry-sdk)
  - Drop obsolete %{?sle15_python_module_pythons} (SLE 15 /
    Leap 15.x is out of support)

++++ rasdaemon:

  - Update to version 0.8.5+git0.769593b:
    * rasdaemon: bump to version 0.8.5
    * Add a workflow to drop waiting new version label
    * ras-page-isolation.c: cleanup a warning
    * ras-non-standard-handler: remove an ugly goto
    * ras-mc-ctl: report NVIDIA Vera SQLite events
    * rasdaemon: add NVIDIA Vera non-standard CPER decoder
    * rasdaemon: guard NULL vendor decoders without sqlite
    * rasdaemon: Add Intel Diamond Rapids MCE decoder support
    * Fix unsafe strcpy in non-standard-nvidia.c
    * labels: Add ASRock WRX80 Creator R2.0 DIMM mapping
    * ras-mc-ctl: Fix invalid column in signal events query
    * mc_event_trigger: Fix reference to mc_event_trigger.local
    * Update README.md ans SECURITY.md

++++ rumdl:

  - Update to version 0.2.28:
    * Added
  - md043: report each heading mismatch via sequence alignment
    (d46dbef)
    * Fixed
  - lsp: isolate rule panics from the document lint path
    (020d4a2)
  - prevent stack overflow on deeply nested blockquote markers
    (1dd3ce5)
  - write fixes atomically and exit non-zero on unreadable files
    (085d7fe)
  - per-file-ignores: enforce centrally in the fix coordinator
    (c4b9899)
  - fmt: honor per-file-ignores on the stdin pipeline (5b5e779)
  - fmt: honor per-file-ignores in the fix pipeline (cb2d7f7)
  - md043: say 'pattern position' in unsatisfied-wildcard
    warnings (9ffc105)
    * Performance
  - md013: drop the per-check heading lookup allocation (f76a209)
  - make semantic-line-break reflow iterative (5692564)
  - md077: compute list-continuation ranges in linear time
    (d36b017)

++++ skillspector:

  - Relax over-strict dependency floors set by upstream at initial
    release (pin-inflation, not API requirements; the code only uses
    long-stable APIs of all three):
    * pydantic >= 2.12.0 -> 2.11.7
    * rich >= 14.3.0 -> 14.0.0
    * typer >= 0.23.0 -> 0.16.0
  - Verified against Leap 16.0's shipped versions (pydantic 2.11.7,
    rich 14.0.0, typer 0.16.0, click 8.2.1, Python 3.13): full
    offline unit suite passes (1249 passed, 12 skipped, 6 xfailed)
    and the CLI entry point works.

++++ tfupdate:

  - Update to version 0.10.0:
    * 0839200 Bump version to v0.10.0
    * cbac317 Omit the platform args if the registry supports h1
    hashes in testacc
    * 658c6c0 Add support for OpenTofu v1.12
    * cc0fd26 Fix lint issues
    * a3fed23 Add ProviderPackageMetadata method to ProviderLockAPI
    * 816afbe Rename ProviderDownloaderAPI to ProviderLockAPI
    * b432c5d Sort the platforms to stabilize the results
    * 48282ea Add test for fetchProviderPackageMetadata
    * 4313d13 Fix the key of the ProviderVersion map to the filename
    * 49183e3 Skip downloading binaries if the registry supports h1
    hashes
    * 8b21af4 Add hashes to provider package metadata response for
    OpenTofu

++++ tomcat11:

  - Upgrade libtcnative to v2 (bsc#1232390)

++++ trivy:

  - Update to version 0.72.0:
    * release: v0.72.0 [main] (#10782)
    * test: close plugin manager in tests cleanup (#10904)
    * Merge commit from fork
    * feat(bottlerocket): add vulnerability matching for Bottlerocket OS (#10893)
    * fix(misconf): support github_repository_vulnerability_alerts resource (#10680)
    * feat(java): detect JAR licenses from packaged LICENSE files (#10856)
    * fix(nodejs): parse project dependencies from multi-document pnpm-lock.yaml (#10861)
    * fix(server): propagate package repository class in client/server mode (#10874)
    * chore(deps): bump github.com/containerd/containerd/v2 from 2.3.1 to 2.3.2 (#10888)
    * fix(vuln): fall back to UNKNOWN severity when vulnerability details are missing (#10795)
    * feat(java): detect JAR licenses from the embedded pom.xml (#10851)
    * chore(deps): Upgrade github.com/cenkalti/backoff to v6 (#10863)
    * ci(helm): bump Trivy version to 0.71.2 for Trivy Helm Chart 0.23.2 (#10873)
    * chore(deps): bump alpine to 3.24.1 (#10868)
    * docs: fix article typo in plugin developer guide (#10860)
    * feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 (#10848)
    * docs: fix typos (#10857)
    * fix(terraform): avoid data race on global getter.Getters in remote module resolver (#10843)
    * feat(secret): support new stateless format for GitHub App installation tokens (#10826)
    * fix: correct format verbs in diagnostic messages (#10805)
    * ci(helm): bump Trivy version to 0.71.1 for Trivy Helm Chart 0.23.1 (#10845)
    * refactor: use ParseErrorsAllowlist instead of ParseErrorsWhitelist (#10830)
    * docs: fix repository scan heading typo (#10828)
    * Merge commit from fork
    * fix: forward ospkg detector options through ospkg.NewScanner (#10811)
    * chore(deps): bump github.com/bufbuild/buf to v1.70.0 (#10801)
    * fix(vex): load VEX documents from within the repository directory (#10820)
    * ci!: migrate docker config to dockers_v2 (#10783)
    * feat(dotnet): detect bundled runtime in self-contained deployments (#10786)
    * feat(secret): add OpenAI secret detection rules (#10798)
    * ci: expect GitHub App bot as backport PR author (#10813)
    * fix: surface the original analysis error instead of context cancellation (#10793)
    * chore(deps): bump the github-actions group across 1 directory with 11 updates (#10803)
    * chore(deps): bump the common group with 4 updates (#10797)
    * chore(deps): bump the aws group with 4 updates (#10796)
    * fix: use random suffix for process temp directory instead of PID (#10431)
    * docs: update signature verification for deb and rpm packages (#10784)
    * fix(image): lookup origin layer for custom resources in merged layers (#10788)
    * test: fix flaky containerd integration test (#10760)
    * ci: bump GoReleaser to v2.16.0 (#10774)
    * docs: fix broken nixpkgs reference link in installation guide (#10776)
    * test(java): force offline-scan for client/server integration tests (#10721)
    * fix(image): deterministic OS package deduplication for images with embedded SBOMs (#10777)
    * fix(spdx): guard against nil root component in SPDX marshaler (#10771)
    * ci(helm): bump Trivy version to 0.71.0 for Trivy Helm Chart 0.23.0 (#10768)

++++ trufflehog:

  - Update to version 3.95.8:
    * Include encoded resume info instead of clobbering it (#5110)
    * fixed syntax error (#5109)
    * [INS-334] Octopus Deploy detector (#4787)
    * [INS-465] Skip unverified JWT Detector results when feature flag is enabled (#5072)
    * Add prometheus metrics for engine channels and workers (#5095)
    * fix(azuresastoken): match SAS tokens regardless of parameter order (#5043)
    * removed "unauthorized" as exception for rotated graphana secrets (#5068)

++++ zathura:

  - Update to version 2026.07.02:
    * Port to GTK 4; window embedding is no longer supported and
    the window-icon-document setting has been removed
    * Add setting to open documents in single-page mode and bind
    toggle_single_page_mode to "w"
    * Make link opening confirmation optional
    * Replace SHA256 with XXH3-128 for faster file hashing
    * Fix regression when parsing first-page-column setting
    * Allow SIGSTOP in the seccomp sandbox and improve landlock
    confinement
    * Plugin API/ABI raised to 7/8 - plugins must be rebuilt
  - Switch GTK build dependency from gtk+-3.0 to gtk4 >= 4.12
  - Add libxxhash build dependency, raise sqlite3 requirement to
    3.35.0
  - Drop unused cmake build dependency

------------------------------------------------------------------
------------------  2026-7-2  -  Jul 2 2026  -------------------
------------------------------------------------------------------

++++ actuated-cli:

  - Update to version 0.2.15:
    * Include URL in jobs --json output
    * Make job progress more beautiful
    * Warning for old URL and Copyright update
    * Clarify README on OWNER
    * Upgrade Go version to 1.25
    * Additional explanation/documentation
    * Show URLs in standard view all the time
    * Show HTTP body when there is an error
    * Show a summary of jobs
    * Update message

++++ apko:

  - Update to version 1.2.21:
    * fix(ldso-cache): Order cache entries to match ld.so's search
    (#2311)

++++ bcc:

  - Update to version 0.37.0
    * Support for kernel up to 7.1
    * libbpf-tools: Fix memory and comm handling issues in trace_helpers,
    bashreadline, filetop, offcputime, biostacks, and biosnoop
    * tools: mptcpify, bindsnoop, execsnoop, ppchcalls bug fixes
    * Update syscall tables, add ARM64/riscv syscall prefix detection
    * Fix LLVM 22 build failure, C23 warnings
    * bcc-lua: Restore LuaJIT determinism
    * drop obsolete patches
    * drop 0001-clang-Add-microsoft-extensions-build-flags.patch
    * drop 0001-Fix-build-with-LLVM-22.patch
    * drop deterministic_luajit.patch

++++ blog:

  - Update to version 2.45
    Fix early boot LUKS prompt on s390x and resolve memory corruptions
    This update addresses several critical issues in the early boot phase,
    especially on s390x architectures, and hardens the daemon's architecture:
  - Initrd/Dracut: Properly include `systemd-ask-password-blog.path` in
    sysinit.target.wants during the initrd phase to ensure LUKS password
    prompts are captured early in the zipl phase.
  - Systemd Units: Drop restrictive `ConditionKernelCommandLine=!plymouth.enable=0`
    to prevent the agent from being disabled by standard mainframe boot parameters.
  - Memory Corruption: Fix a critical heap corruption by renaming the conflicting
    `alignof()` macro to `ALIGNED_SIZEOF()` and zeroing allocated memory for
    `struct request` (memset) to prevent reading uninitialized pointers #5.
  - Kernel Command Line: Improve `parse_cmdline()` to support boolean parameters
    without an explicit value (e.g., `blog.silent` defaults to `blog.silent=1`).
  - New Features: Introduce `blog.silent` to suppress console I/O and `blog.coldboot`
    to explicitly trigger the early coldstart password query.
  - Lifecycle: Switch `KillMode=none` to `KillMode=mixed` to comply with modern
    systemd process lifecycle management.
    Fixes: gh#bitstreamout/showconsole#5
    Fixes: gh#bitstreamout/showconsole#6
    Fixes: bsc#1264176

++++ bottom:

  - Update to version 0.14.3:
    * attempt a fix to reduce CPU cycles spent on kitty for
    'cursor_trail' (#2119).
    * misc dependency updates.

++++ bugzilla-mcp:

  - Update to version 0.16.0:
    * Add attachment support via two new tools: list_attachments returns
    a bug's attachment metadata (id, file name, summary, content type,
    size and flags) without the file contents, and download_attachment
    fetches a single attachment by id
    * download_attachment supports delivery modes auto/inline/save: small
    textual attachments are returned inline, binary or oversized files
    are written to disk, and private attachments require an explicit
    include_private opt-in
    * Add --download-dir option (and BUGZILLA_DOWNLOAD_DIR environment
    variable) selecting where downloaded attachments are written;
    defaults to an owner-only (0700) directory under the temporary dir
    * Improve reporting of Bugzilla REST API errors

++++ chromium:

  - promote Chromium 150 (150.0.7871.46) to stable (boo#1270051)
    * CVE-2026-13774: Use after free in Extensions
    * CVE-2026-13775: Use after free in GPU
    * CVE-2026-14398: Use after free in ANGLE
    * CVE-2026-13776: Type Confusion in Dawn
    * CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb
    * CVE-2026-13778: Use after free in WebUSB
    * CVE-2026-13779: Use after free in Chromoting
    * CVE-2026-13780: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-13781: Insufficient validation of untrusted input in Skia
    * CVE-2026-14417: Use after free in Dawn
    * CVE-2026-13782: Use after free in Browser
    * CVE-2026-13783: Use after free in Views
    * CVE-2026-13784: Use after free in Views
    * CVE-2026-14419: Use after free in Skia
    * CVE-2026-13785: Use after free in Bluetooth
    * CVE-2026-14420: Out of bounds read and write in Dawn
    * CVE-2026-13786: Use after free in Ozone
    * CVE-2026-14427: Heap buffer overflow in Skia
    * CVE-2026-13787: Use after free in Chromoting
    * CVE-2026-13788: Use after free in Fullscreen
    * CVE-2026-14382: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-13790: Side-channel information leakage in Scroll
    * CVE-2026-14385: Heap buffer overflow in ANGLE
    * CVE-2026-13791: Insufficient validation of untrusted input in Downloads
    * CVE-2026-13792: Use after free in Touchbar
    * CVE-2026-13793: Insufficient policy enforcement in SVG
    * CVE-2026-14392: Out of bounds write in Tint
    * CVE-2026-13794: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-14422: Out of bounds read and write in Tint
    * CVE-2026-13795: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-14426: Use after free in V8
    * CVE-2026-13796: Integer overflow in Chromecast
    * CVE-2026-13797: Insufficient validation of untrusted input in Chromecast
    * CVE-2026-14386: Out of bounds read in ANGLE
    * CVE-2026-13798: Heap buffer overflow in Chromecast
    * CVE-2026-13799: Use after free in QUIC
    * CVE-2026-13800: Inappropriate implementation in Updater
    * CVE-2026-13801: Integer overflow in Chromecast
    * CVE-2026-13802: Use after free in Views
    * CVE-2026-13803: Type Confusion in Chrome Tabs
    * CVE-2026-13804: Use after free in Chromecast
    * CVE-2026-13805: Use after free in GFX
    * CVE-2026-14390: Use after free in ANGLE
    * CVE-2026-13806: Insufficient validation of untrusted input in Accessibility
    * CVE-2026-13807: Use after free in Import
    * CVE-2026-13808: Insufficient data validation in Chrome for iOS
    * CVE-2026-13809: Side-channel information leakage in Safe Browsing
    * CVE-2026-13810: Inappropriate implementation in Input
    * CVE-2026-13811: Use after free in IME
    * CVE-2026-13812: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-13813: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-13814: Use after free in Views
    * CVE-2026-13815: Use after free in Blink
    * CVE-2026-13816: Insufficient validation of untrusted input in File Input
    * CVE-2026-14396: Out of bounds read in ANGLE
    * CVE-2026-13817: Insufficient validation of untrusted input in Glic
    * CVE-2026-13818: Inappropriate implementation in Passwords
    * CVE-2026-13819: Out of bounds read in ANGLE
    * CVE-2026-13820: Out of bounds read in Skia
    * CVE-2026-14400: Out of bounds write in ANGLE
    * CVE-2026-14401: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-14402: Uninitialized Use in ANGLE
    * CVE-2026-13821: Use after free in Canvas
    * CVE-2026-13822: Inappropriate implementation in Extensions
    * CVE-2026-13823: Use after free in Glic
    * CVE-2026-13824: Insufficient validation of untrusted input in Extensions
    * CVE-2026-13825: Uninitialized Use in Dawn
    * CVE-2026-13826: Inappropriate implementation in Autofill
    * CVE-2026-13827: Use after free in Updater
    * CVE-2026-13828: Inappropriate implementation in Enterprise
    * CVE-2026-13829: Insufficient validation of untrusted input in Settings
    * CVE-2026-13830: Use after free in Chromoting
    * CVE-2026-13831: Use after free in GPU
    * CVE-2026-13832: Use after free in Headless
    * CVE-2026-14411: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-13833: Uninitialized Use in ANGLE
    * CVE-2026-14412: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-14413: Uninitialized Use in ANGLE
    * CVE-2026-13834: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-13835: Inappropriate implementation in XML
    * CVE-2026-13836: Inappropriate implementation in CSS
    * CVE-2026-13837: Inappropriate implementation in CSS
    * CVE-2026-13838: Inappropriate implementation in CSS
    * CVE-2026-13839: Inappropriate implementation in CSS
    * CVE-2026-13840: Insufficient policy enforcement in Canvas
    * CVE-2026-13841: Integer overflow in Skia
    * CVE-2026-13842: Incorrect security UI in Chrome for iOS
    * CVE-2026-14418: Uninitialized Use in ANGLE
    * CVE-2026-13843: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-13844: Use after free in Updater
    * CVE-2026-13845: Use after free in DOM
    * CVE-2026-13846: Use after free in USB
    * CVE-2026-13847: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-13848: Use after free in Forms
    * CVE-2026-13849: Insufficient validation of untrusted input in Chromoting
    * CVE-2026-14423: Type Confusion in Tint
    * CVE-2026-13850: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-14424: Use after free in Dawn
    * CVE-2026-14425: Use after free in ANGLE
    * CVE-2026-13851: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-14428: Insufficient validation of untrusted input in Dawn
    * CVE-2026-14429: Insufficient validation of untrusted input in Skia
    * CVE-2026-14430: Integer overflow in V8
    * CVE-2026-13852: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-13853: Use after free in Journeys
    * CVE-2026-13854: Use after free in Ozone
    * CVE-2026-14431: Type Confusion in V8
    * CVE-2026-13855: Use after free in Ozone
    * CVE-2026-13856: Insufficient validation of untrusted input in Speech
    * CVE-2026-13857: Inappropriate implementation in Geometry
    * CVE-2026-13858: Out of bounds read in FFmpeg
    * CVE-2026-13859: Inappropriate implementation in ANGLE
    * CVE-2026-14391: Integer overflow in ANGLE
    * CVE-2026-13860: Incorrect security UI in Autofill
    * CVE-2026-14408: Uninitialized Use in Dawn
    * CVE-2026-14381: Incorrect security UI in WebAppInstalls
    * CVE-2026-14383: Inappropriate implementation in V8
    * CVE-2026-13861: Use after free in Core
    * CVE-2026-13862: Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys)
    * CVE-2026-13863: Insufficient validation of untrusted input in CustomTabs
    * CVE-2026-13864: Insufficient policy enforcement in WebHID
    * CVE-2026-13865: Insufficient validation of untrusted input in Enterprise
    * CVE-2026-13866: Insufficient validation of untrusted input in Input
    * CVE-2026-13867: Inappropriate implementation in Geolocation
    * CVE-2026-13868: Inappropriate implementation in Network
    * CVE-2026-14384: Out of bounds read in ANGLE
    * CVE-2026-13869: Use after free in Device
    * CVE-2026-13870: Use after free in WebView
    * CVE-2026-13871: Insufficient data validation in GuestView
    * CVE-2026-13872: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-13873: Out of bounds memory access in Layout
    * CVE-2026-13874: Inappropriate implementation in DataTransfer
    * CVE-2026-13875: Insufficient validation of untrusted input in GPU
    * CVE-2026-13876: Inappropriate implementation in Network
    * CVE-2026-13877: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-13878: Use after free in Bluetooth
    * CVE-2026-13879: Use after free in Bluetooth
    * CVE-2026-13880: Use after free in USB
    * CVE-2026-13881: Insufficient data validation in WebAppInstalls
    * CVE-2026-13882: Inappropriate implementation in USB
    * CVE-2026-13883: Type Confusion in ANGLE
    * CVE-2026-13884: Heap buffer overflow in Chromecast
    * CVE-2026-14387: Integer overflow in Skia
    * CVE-2026-13885: Use after free in Skia
    * CVE-2026-13886: Policy bypass in Isolated Web Apps
    * CVE-2026-14388: Out of bounds read in ANGLE
    * CVE-2026-14389: Integer overflow in Skia
    * CVE-2026-13887: Insufficient policy enforcement in NFC
    * CVE-2026-13888: Use after free in Extensions
    * CVE-2026-13889: Insufficient validation of untrusted input in WebAuthentication
    * CVE-2026-13890: Out of bounds read in Chromecast
    * CVE-2026-13891: Insufficient validation of untrusted input in Extensions
    * CVE-2026-13892: Inappropriate implementation in Chrome for iOS
    * CVE-2026-13893: Insufficient validation of untrusted input in WebUI
    * CVE-2026-13894: Insufficient policy enforcement in Network
    * CVE-2026-13895: Inappropriate implementation in Autofill
    * CVE-2026-13896: Insufficient policy enforcement in Glic
    * CVE-2026-13897: Insufficient policy enforcement in Chromecast
    * CVE-2026-13898: Use after free in Cast Receiver
    * CVE-2026-13899: Use after free in HTML
    * CVE-2026-13900: Insufficient validation of untrusted input in Chromecast
    * CVE-2026-13901: Insufficient validation of untrusted input in Serial
    * CVE-2026-13902: Inappropriate implementation in Chrome for iOS
    * CVE-2026-13903: Insufficient policy enforcement in Bluetooth
    * CVE-2026-13904: Incorrect security UI in Safe Browsing
    * CVE-2026-13905: Incorrect security UI in Chrome for iOS
    * CVE-2026-13906: Out of bounds read in Codecs
    * CVE-2026-13907: Inappropriate implementation in iOSWeb
    * CVE-2026-13908: Insufficient validation of untrusted input in Omnibox
    * CVE-2026-13909: Insufficient policy enforcement in DevTools
    * CVE-2026-13910: Insufficient policy enforcement in WebXR
    * CVE-2026-13911: Insufficient data validation in Spellcheck
    * CVE-2026-13912: Incorrect security UI in Safe Browsing
    * CVE-2026-13913: Insufficient policy enforcement in Autofill
    * CVE-2026-13914: Inappropriate implementation in Passwords
    * CVE-2026-13915: Use after free in Chrome for iOS
    * CVE-2026-13916: Inappropriate implementation in Chrome for iOS
    * CVE-2026-13917: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-13918: Use after free in Chrome for iOS
    * CVE-2026-13919: Insufficient data validation in Extensions
    * CVE-2026-14393: Use after free in V8
    * CVE-2026-13920: Insufficient validation of untrusted input in Media
    * CVE-2026-13921: Insufficient validation of untrusted input in DeviceBoundSessionCredentials
    * CVE-2026-13922: Side-channel information leakage in Paint
    * CVE-2026-13923: Uninitialized Use in GPU
    * CVE-2026-14397: Out of bounds write in ANGLE
    * CVE-2026-13924: Insufficient validation of untrusted input in WebView
    * CVE-2026-13925: Inappropriate implementation in Downloads
    * CVE-2026-13926: Insufficient validation of untrusted input in Network
    * CVE-2026-13927: Insufficient validation of untrusted input in UI
    * CVE-2026-13928: Insufficient validation of untrusted input in Enterprise
    * CVE-2026-13929: Insufficient validation of untrusted input in DevTools
    * CVE-2026-13930: Insufficient policy enforcement in Actor
    * CVE-2026-13931: Inappropriate implementation in Media
    * CVE-2026-13932: Inappropriate implementation in Sharing
    * CVE-2026-13933: Insufficient policy enforcement in Passwords
    * CVE-2026-13934: Insufficient validation of untrusted input in Dawn
    * CVE-2026-14399: Uninitialized Use in Dawn
    * CVE-2026-13935: Side-channel information leakage in ComputePressure
    * CVE-2026-13936: Inappropriate implementation in Passwords
    * CVE-2026-13937: Insufficient policy enforcement in Passwords
    * CVE-2026-13938: Integer overflow in Fonts
    * CVE-2026-13939: Insufficient validation of untrusted input in WebShare
    * CVE-2026-13940: Uninitialized Use in Cast
    * CVE-2026-13941: Inappropriate implementation in SiteSettings
    * CVE-2026-13942: Insufficient validation of untrusted input in Video Capture
    * CVE-2026-13943: Uninitialized Use in CSS
    * CVE-2026-13944: Inappropriate implementation in DataTransfer
    * CVE-2026-13945: Insufficient policy enforcement in Extensions
    * CVE-2026-13946: Inappropriate implementation in ScriptInjections
    * CVE-2026-13947: Uninitialized Use in XR
    * CVE-2026-13948: Insufficient policy enforcement in Extensions
    * CVE-2026-13949: Insufficient policy enforcement in Payments
    * CVE-2026-14404: Inappropriate implementation in PDFium
    * CVE-2026-13950: Uninitialized Use in GPU
    * CVE-2026-13951: Policy bypass in USB
    * CVE-2026-13952: Inappropriate implementation in PerformanceAPIs
    * CVE-2026-14406: Out of bounds read in V8
    * CVE-2026-13953: Inappropriate implementation in SplitView
    * CVE-2026-13954: Insufficient policy enforcement in XML
    * CVE-2026-13955: Insufficient validation of untrusted input in CustomTabs
    * CVE-2026-13956: Incorrect security UI in PageInfo
    * CVE-2026-13957: Incorrect security UI in Extensions
    * CVE-2026-13958: Uninitialized Use in Codecs
    * CVE-2026-14407: Inappropriate implementation in V8
    * CVE-2026-13959: Insufficient validation of untrusted input in Blink
    * CVE-2026-13960: Inappropriate implementation in Passwords
    * CVE-2026-13961: Insufficient validation of untrusted input in DevTools
    * CVE-2026-13962: Insufficient data validation in PDF
    * CVE-2026-13963: Inappropriate implementation in DevTools
    * CVE-2026-13964: Insufficient policy enforcement in WebView
    * CVE-2026-13965: Use after free in Oilpan
    * CVE-2026-13966: Inappropriate implementation in History
    * CVE-2026-13967: Type Confusion in V8
    * CVE-2026-13968: Insufficient validation of untrusted input in DevTools
    * CVE-2026-13969: Uninitialized Use in UI
    * CVE-2026-13970: Uninitialized Use in Media
    * CVE-2026-13971: Uninitialized Use in Skia
    * CVE-2026-13972: Inappropriate implementation in Paint
    * CVE-2026-13973: Inappropriate implementation in UI
    * CVE-2026-13974: Integer overflow in Safe Browsing
    * CVE-2026-13975: Out of bounds read in ANGLE
    * CVE-2026-13976: Heap buffer overflow in Storage
    * CVE-2026-13977: Inappropriate implementation in HTMLParser
    * CVE-2026-13978: Insufficient policy enforcement in PageInfo
    * CVE-2026-14414: Insufficient validation of untrusted input in Skia
    * CVE-2026-13979: Inappropriate implementation in Paint
    * CVE-2026-13980: Incorrect security UI in Chrome for iOS
    * CVE-2026-13981: Inappropriate implementation in Chrome for iOS
    * CVE-2026-13982: Incorrect security UI in Passwords
    * CVE-2026-13983: Incorrect security UI in Chrome for iOS
    * CVE-2026-13984: Incorrect security UI in TabStrip
    * CVE-2026-13985: Inappropriate implementation in MediaCapture
    * CVE-2026-13986: Inappropriate implementation in Media UI
    * CVE-2026-13987: Incorrect security UI in Mobile
    * CVE-2026-13988: Inappropriate implementation in Paint
    * CVE-2026-13989: Insufficient policy enforcement in PageInfo
    * CVE-2026-13990: Insufficient validation of untrusted input in DataTransfer
    * CVE-2026-13991: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-13992: Inappropriate implementation in UI
    * CVE-2026-13993: Incorrect security UI in WebAppInstalls
    * CVE-2026-13994: Inappropriate implementation in Credential Management
    * CVE-2026-13995: Insufficient validation of untrusted input in Autofill
    * CVE-2026-13996: Incorrect security UI in Permissions
    * CVE-2026-13997: Incorrect security UI in Extensions
    * CVE-2026-13998: Incorrect security UI in File Input
    * CVE-2026-13999: Inappropriate implementation in Extensions
    * CVE-2026-14000: Inappropriate implementation in XML
    * CVE-2026-14001: Inappropriate implementation in Network
    * CVE-2026-14002: Inappropriate implementation in Geolocation
    * CVE-2026-14003: Insufficient policy enforcement in Extensions
    * CVE-2026-14004: Inappropriate implementation in CSS
    * CVE-2026-14005: Use after free in Omnibox
    * CVE-2026-14006: Use after free in Navigation
    * CVE-2026-14007: Insufficient policy enforcement in PermissionsPolicy
    * CVE-2026-14008: Uninitialized Use in WebXR
    * CVE-2026-14009: Insufficient data validation in Passwords
    * CVE-2026-14010: Uninitialized Use in Codecs
    * CVE-2026-14011: Out of bounds read in SurfaceCapture
    * CVE-2026-14421: Uninitialized Use in Dawn
    * CVE-2026-14012: Side-channel information leakage in CSS
    * CVE-2026-14013: Inappropriate implementation in SVG
    * CVE-2026-14014: Inappropriate implementation in Paint
    * CVE-2026-14015: Inappropriate implementation in WebRTC
    * CVE-2026-14016: Insufficient policy enforcement in SVG
    * CVE-2026-14017: Inappropriate implementation in Navigation
    * CVE-2026-14018: Use after free in Updater
    * CVE-2026-14019: Inappropriate implementation in Passwords
    * CVE-2026-14020: Insufficient validation of untrusted input in WebXR
    * CVE-2026-14021: Insufficient validation of untrusted input in StorageAccessAPI
    * CVE-2026-14022: Insufficient validation of untrusted input in Network
    * CVE-2026-14023: Insufficient validation of untrusted input in SanitizerAPI
    * CVE-2026-14024: Use after free in Ozone
    * CVE-2026-14432: Use after free in V8
    * CVE-2026-14025: Use after free in Views
    * CVE-2026-14026: Incorrect security UI in SplitView
    * CVE-2026-14027: Use after free in SignIn
    * CVE-2026-14028: Incorrect security UI in Chrome for iOS
    * CVE-2026-14030: Incorrect security UI in SplitView
    * CVE-2026-14031: Incorrect security UI in File Input
    * CVE-2026-14032: Use after free in Bluetooth
    * CVE-2026-14033: Insufficient policy enforcement in Media
    * CVE-2026-14034: Inappropriate implementation in WebXR
    * CVE-2026-14035: Insufficient policy enforcement in Bluetooth
    * CVE-2026-14036: Insufficient policy enforcement in Bluetooth
    * CVE-2026-14037: Insufficient policy enforcement in GPU
    * CVE-2026-14038: Insufficient validation of untrusted input in New Tab Page
    * CVE-2026-14039: Insufficient policy enforcement in GetUserMedia
    * CVE-2026-14040: Use after free in BrowserTag
    * CVE-2026-14041: Insufficient policy enforcement in Serial
    * CVE-2026-14042: Inappropriate implementation in Isolated Web Apps
    * CVE-2026-14043: Use after free in GetUserMedia
    * CVE-2026-14044: Use after free in ANGLE
    * CVE-2026-14045: Insufficient validation of untrusted input in Network
    * CVE-2026-14046: Inappropriate implementation in CustomTabs
    * CVE-2026-14047: Insufficient policy enforcement in Extensions
    * CVE-2026-14048: Use after free in Chromecast
    * CVE-2026-14049: Inappropriate implementation in GPU
    * CVE-2026-14050: Insufficient policy enforcement in Passwords
    * CVE-2026-14051: Uninitialized Use in GamepadAPI
    * CVE-2026-14052: Insufficient policy enforcement in FileSystem
    * CVE-2026-14053: Insufficient policy enforcement in Extensions
    * CVE-2026-14054: Insufficient policy enforcement in Network
    * CVE-2026-14055: Insufficient validation of untrusted input in Device Trust
    * CVE-2026-14056: Insufficient validation of untrusted input in Media
    * CVE-2026-14057: Insufficient policy enforcement in FedCM
    * CVE-2026-14058: Policy bypass in Parser
    * CVE-2026-14059: Insufficient policy enforcement in Related-Website-Sets
    * CVE-2026-14060: Insufficient validation of untrusted input in Chromoting
    * CVE-2026-14061: Inappropriate implementation in Dawn
    * CVE-2026-14062: Inappropriate implementation in Views
    * CVE-2026-14063: Out of bounds memory access in Chromecast
    * CVE-2026-14064: Use after free in PageInfo
    * CVE-2026-14065: Insufficient validation of untrusted input in PageInfo
    * CVE-2026-14066: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-14067: Use after free in Chrome for iOS
    * CVE-2026-14068: Inappropriate implementation in Omnibox
    * CVE-2026-14069: Integer overflow in WebNN
    * CVE-2026-14070: Uninitialized Use in WebNN
    * CVE-2026-14071: Side-channel information leakage in WebAudio
    * CVE-2026-14072: Incorrect security UI in SplitView
    * CVE-2026-14073: Insufficient policy enforcement in WebXR
    * CVE-2026-14394: Use after free in V8
    * CVE-2026-14395: Out of bounds write in V8
    * CVE-2026-14074: Side-channel information leakage in WebAuthentication
    * CVE-2026-14075: Policy bypass in Chrome for iOS
    * CVE-2026-14076: Policy bypass in Network
    * CVE-2026-14077: Incorrect security UI in Select
    * CVE-2026-14078: Policy bypass in WebRTC
    * CVE-2026-14079: Policy bypass in Network
    * CVE-2026-14080: Insufficient validation of untrusted input in TabSwitcher
    * CVE-2026-14081: Insufficient policy enforcement in DevTools
    * CVE-2026-14082: Race in Storage
    * CVE-2026-14083: Insufficient validation of untrusted input in HTML
    * CVE-2026-14084: Insufficient validation of untrusted input in Chromoting
    * CVE-2026-14085: Side-channel information leakage in CSS
    * CVE-2026-14086: Insufficient policy enforcement in HID
    * CVE-2026-14087: Insufficient validation of untrusted input in WebNN
    * CVE-2026-14088: Uninitialized Use in Canvas
    * CVE-2026-14089: Insufficient validation of untrusted input in PopupBlocker
    * CVE-2026-14090: Out of bounds read in CameraCapture
    * CVE-2026-14091: Use after free in DevTools
    * CVE-2026-14092: Insufficient policy enforcement in Privacy
    * CVE-2026-14093: Use after free in Cast
    * CVE-2026-14094: Use after free in Installer
    * CVE-2026-14095: Insufficient validation of untrusted input in Browser
    * CVE-2026-14403: Use after free in V8
    * CVE-2026-14096: Object lifecycle issue in Input
    * CVE-2026-14097: Inappropriate implementation in WebAppInstalls
    * CVE-2026-14098: Inappropriate implementation in CSS
    * CVE-2026-14405: Uninitialized Use in V8
    * CVE-2026-14099: Use after free in Chrome for iOS
    * CVE-2026-14100: Insufficient data validation in NetworkCache
    * CVE-2026-14101: Insufficient policy enforcement in Sandbox
    * CVE-2026-14102: Use after free in Passwords
    * CVE-2026-14103: Use after free in SSL
    * CVE-2026-14104: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-14105: Insufficient policy enforcement in Speech
    * CVE-2026-14106: Insufficient validation of untrusted input in Text
    * CVE-2026-14107: Use after free in Scheduling
    * CVE-2026-14108: Use after free in PDFium
    * CVE-2026-14109: Insufficient policy enforcement in Mojo
    * CVE-2026-14110: Inappropriate implementation in DarkMode
    * CVE-2026-14111: Use after free in WebProtect
    * CVE-2026-14112: Inappropriate implementation in Enterprise
    * CVE-2026-14113: Use after free in Updater
    * CVE-2026-14114: Inappropriate implementation in WebAppInstalls
    * CVE-2026-14115: Insufficient validation of untrusted input in Cast
    * CVE-2026-14116: Insufficient validation of untrusted input in DevTools
    * CVE-2026-14117: Insufficient validation of untrusted input in DevTools
    * CVE-2026-14118: Insufficient data validation in DevTools
    * CVE-2026-14119: Type Confusion in Bluetooth
    * CVE-2026-14120: Inappropriate implementation in DevTools
    * CVE-2026-14121: Use after free in Chromoting
    * CVE-2026-14409: Inappropriate implementation in V8
    * CVE-2026-14122: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-14410: Inappropriate implementation in Skia
    * CVE-2026-14123: Incorrect security UI in Chrome for iOS
    * CVE-2026-14124: Inappropriate implementation in CredentialProvider
    * CVE-2026-14125: Uninitialized Use in ANGLE
    * CVE-2026-14126: Incorrect security UI in UI
    * CVE-2026-14127: Inappropriate implementation in Printing
    * CVE-2026-14128: Insufficient data validation in Chrome for iOS
    * CVE-2026-14129: Incorrect security UI in PreviewTab
    * CVE-2026-14130: Incorrect security UI in Omnibox
    * CVE-2026-14131: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-14132: Inappropriate implementation in WebXR
    * CVE-2026-14133: Race in History Embeddings
    * CVE-2026-14134: Inappropriate implementation in Autofill
    * CVE-2026-14135: Insufficient validation of untrusted input in Network
    * CVE-2026-14136: Incorrect security UI in Chrome for iOS
    * CVE-2026-14137: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-14138: Inappropriate implementation in WebAppInstalls
    * CVE-2026-14139: Inappropriate implementation in TabStrip
    * CVE-2026-14140: Insufficient validation of untrusted input in Input
    * CVE-2026-14141: Incorrect security UI in Document Picture-in-Picture
    * CVE-2026-14142: Inappropriate implementation in Extensions
    * CVE-2026-14143: Incorrect security UI in Passwords
    * CVE-2026-14144: Incorrect security UI in Views
    * CVE-2026-14145: Inappropriate implementation in CSS
    * CVE-2026-14146: Inappropriate implementation in CSS
    * CVE-2026-14147: Inappropriate implementation in CSS
    * CVE-2026-14415: Inappropriate implementation in V8
    * CVE-2026-14148: Type Confusion in CSS
    * CVE-2026-14149: Use after free in Audio
    * CVE-2026-14416: Out of bounds read in Dawn
    * CVE-2026-14150: Insufficient validation of untrusted input in Speech
    * CVE-2026-14151: Inappropriate implementation in AI
    * CVE-2026-14152: Out of bounds write in ANGLE
    * CVE-2026-14153: Inappropriate implementation in Glic
    * CVE-2026-14154: Inappropriate implementation in DevTools
    * CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI
    * CVE-2026-14156: Policy bypass in StorageAccessAPI
  - dropped patches:
    * ppc-fedora-fix-rust-linking.patch
  - Chromium 150.0.7871.46 (beta released 2026-06-24)
  - modified patches:
    * chromium-102-regex_pattern-array.patch
    * chromium-125-compiler.patch
    * chromium-144-revert-libxml-2.13.patch
    * ppc-fedora-fix-breakpad-compile.patch
    * ppc-fedora-dawn-fix-ppc64le-detection.patch
    * ppc-fedora-0002-regenerate-xnn-buildgn.patch
    * chromium-146-value_or.patch
  - added patches:
    * chromium-150-toolchain.patch
    * chromium-150-sysroot.patch
    * chromium-150-ffmpeg_no_agtm.patch
    * chromium-150-icubridge_item_length.patch
  - keeplibs:
    added:
    third_party/llvm-libc
    third_party/perfetto/protos/third_party/android
    moved:
    third_party/devtools-frontend/src/front_end/third_party/puppeteer/package/lib/third_party/mitt
    third_party/devtools-frontend/src/front_end/third_party/puppeteer/package/lib/third_party/parsel-js
    third_party/devtools-frontend/src/front_end/third_party/puppeteer/package/lib/third_party/rxjs
    third_party/devtools-frontend/src/front_end/third_party/puppeteer/package/lib/third_party/urlpattern-polyfill
  - bump BR for rust-bindgen to 0.72
    (0.71 ends up with reserved keyword "gen" in boringssl)

++++ container-selinux:

  - Update to version 2.250.0:
    * Allow rpmdb to manage files on mounted container filesystems
    * Add the container_runtime_signull() interface
    * give container_domain perms on container_file_t fifo_files
    * Suppress mmap_zero denials for container_runtime_t
    * rpm: Require policycoreutils >= 3.10 for policydb version 24 support
    * Add the container_spc_signull() interface
    * Allow spc_t execstack and execmem (bsc#1268490)
  - Drop allow-spc_t-execstack-via-boolean-and-execmem-bsc-1268490.patch: included upstream

++++ cpp-httplib:

  - Update to 0.49.0:
    * Escape special characters (", CR, LF) in multipart field names and filenames when serializing multipart/form-data bodies to prevent header injection attacks
    * Escape CR/LF in MultipartFormData::content_type values before writing them to part headers
    * Add public MultipartFormDataWriter for multipart body serialization outside the standard client methods
    * Make the ThreadPool idle timeout for dynamic threads configurable via a new constructor parameter
    * Replace locale-dependent character classification with ASCII-specific helpers across multipart validation, token checks, URI encoding, range parsing, and IPv4 detection (#2482, #2483)
    * Remove the default port from the WebSocket handshake Host header per RFC 6455 §4.1 and fix IPv6 literal bracketing (#2480)
    * Fix query string handling when path encoding is disabled — the query is now sent verbatim instead of being decoded and re-encoded (#2479)
    * Fix unsigned accumulator in base64_encode to avoid undefined behavior with high-bit bytes (#2477)
    * Fix meson build failure on glibc >= 2.34 where getaddrinfo_a is built into libc (#2484)
  - 0.48.0:
    * Complete the IP-host certificate identity fix for the Mbed TLS and wolfSSL backends: IP-literal hosts are now authenticated only via a matching iPAddress SAN, never via Common Name; add IPv6 (16-byte) iPAddress SAN matching (#2476)
    * Replace the strtod-based quality-value parser with a locale-independent hand-written parser to handle comma-decimal locales correctly (#2475)
    * Fix OpenSSL 4.0 deprecation warnings by using X509_STORE_get1_objects() and X509_NAME_get_index_by_NID()
    * decode_query_component() now uses strict hex parsing, rejecting non-hex characters following % (e.g. %-1, %+5) (#2472)
    * Add new OSS-Fuzz fuzzer targets for multipart parsing (#2473)
  - 0.47.0:
    * Fix TLS certificate chain verification bypass for IP-literal hosts on the Mbed TLS and wolfSSL backends where chain validation was skipped entirely or not performed post-handshake
    * Disable SNI for IP hosts on Mbed TLS and wolfSSL per RFC 6066
    * Add Server::set_start_handler() callback invoked when the server is ready to accept connections
    * Add Client/SSLClient/WebSocketClient::enable_system_ca(bool) to load system CA certificates alongside a custom CA (#2471)
    * Add WebSocketClient::set_hostname_addr_map() for IP-specific connection while maintaining the hostname for handshake/verification (#2463)
    * Request body is now read after route matching and the pre-request handler (route matching -> pre-request handler -> body read -> handler), so requests rejected by the pre-request handler no longer buffer the body
    * WebSocketClient with a custom CA no longer merges system certificates (call enable_system_ca(true) for that behavior)
    * Range request headers are now ignored for streaming responses of unknown length (#2465)
    * Fix SSLClient::set_ca_cert_store() breaking custom-CA exclusivity and system certificates being silently merged
    * Fix WebSocketClient dropping the query string during the upgrade handshake (#2468)
    * Fix use-after-free when reconnecting WebSocketClient after set_ca_cert_store() and a related memory leak
    * Fix MSVC C4309 truncation warning in the SHA padding code (#2464)
    * Cast to unsigned char before ctype calls in is_hex and is_token_char to avoid undefined behavior (#2469)

++++ datovka:

  - add 0001-datovka.pro-drop-removal-of-libQt6Core-from-quazip-l.patch
    to fix the build against quazip 1.7.2

++++ debhelper:

  - update to 14.2
    * upgrade-checklist: Remove remnants of the reverted pam change
    * upgrade-checklist: Remove comment regarding pre-stable compat 14
    * dh_installsystemd: also add tmpfiles deps in compat 12
    (Closes: #1140654)
  - update to 14.1
    * dh_installpam: Revert compat 14 change at request of the `pam`
    maintainers.  (Closes: #1140119)
  - update to 14.0
    * Remove noise from lintian about `alien-tag
    * Fix a bug where `debian/compat` was rejected in compat 13 and
    older when compat 14 was stable.
    * Declare compat 14 as stable

++++ dhcp:

  - Update dhcrelay script and service.
    Due to some leftover calls to sysvinit tools the script no longer
    worked. Now the script is a lot leaner and only implements the
    sysconfig arg parsing and makes it more of a native systemd
    service.
    [bsc#1269228]

++++ docker-compose:

  - Update to version 5.3.0:
    This release introduces native support for init containers.
    * Improvements
  - Pre start init containers by @glours in #13862
    * Fixes
  - Fix(oci): route authorizer token fetches through provided
    transport by @glours in #13873
  - Fix(run): scope Running events to project.Services by @glours
    in #13883
    * Internal
  - Chore: migrate cagent-action to docker-agent-action (v2.0.0)
    by @docker-agent in #13869
  - Chore: migrate to docker-agent-action v2.0.1 by @docker-agent
    in #13872
  - Fix(reconcile): hash resolved service refs to match executor
    by @glours in #13880
  - Fix(compose/port): show private port in portNotFoundError
    message by @vmphase in #13875
  - Fix(run): normalize --no-TTY flag to --no-tty by @nickjj in
    [#13885]
    * Dependencies
  - Bump compose-go to version v2.13.0 by @glours in #13886

++++ eksctl:

  - Update to version 0.229.0:
    * Features
  - Add cluster version rollback support with rollbackConfig
    (#8780)
  - Add support for EKS on Outposts with EC2 instance store
    (#8774)

++++ fwupd:

  - Update to version 2.1.6:
    + This release adds the following features:
  - Add --filter-protocol to fwupdmgr and fwupdtool
  - Add a new HSI attribute for coreboot verified boot
  - Add hashes for the latest DBX for offline machines
  - Allow parsing Hayden Bridge Thunderbolt firmware
  - Handle HPE Redfish reset-required updates
  - Ignore efivar free space on VMWare, GCE and EC2 VMs
  - Prevent FwupdClient from downloading the same file multiple times
  - Split UEFI Memory Protection HSI from NX Compat
    + This release fixes the following bugs:
  - Avoid an integer overflow in the ifwi-cpd manifest length check
  - Avoid truncating the AMD Kria FRU board area offset
  - Block dbx updates on ASUSTeK GL553VD
  - Check SMEE hardware bit directly for AMD SME detection
  - Create the ESP OS directory if not found
  - Detect the BCR device on Celeron LPC SPI controllers
  - Fall back to a binary firmware when no specific MTD image type is set
  - Fix AI table clear behavior of the elantp boot code.
  - Fix errors with fwupd-refresh service not working properly
  - Fix Genesys GL32xx device locker crash due to argument mismatch
  - Fix installing KEK updates when using snapd by sending the correct blob
  - Fix integer underflow when Elan firmware is smaller than one page
  - Fix possible NULL pointer dereference when updating SteelSeries firmware
  - Fix the display of the HP UEFI db certificate
  - Improved usi-dock progress reporting behavior
  - Increase the parser item limit from 100 to 1000 for large KEKs
  - Log out of the Redfish session when required on HPE hardware
  - Only show 'authenticating' after a short delay
  - Re-process the device metadata when required after all devices are added
  - Require sealed memfd input to prevent possible TOCTOU attacks
  - Sanitise the Jabra GNP device version in a more secure way
  - Validate raydium-tp buffer size before direct index access
  - Validate that Lenovo dock device-reported program sizes are valid
    + This release adds support for the following hardware:
  - Lenovo dual-bank accessory dongle and paired peripherals

++++ geoclue2:

  - Update to version 2.8.2
    New features:
    * Translations for Georgian an Occitan and instructions for
    translators.
    Fixes:
    * Building translations now works.
    * Fix double free in on_desktop_id_set() and
    on_client_proxy_ready().
    * Fix some gobject-linter rules in the correctness category.
    * Document the command to register network NMEA sources to avahi
  - handle language files

++++ gtk3:

  - Add gtk3-fix-xi2-xatom.patch: Fix wrong display when handling xi2
    xatom. (bsc#1269225, glgo#GNOME/gtk!10105)

++++ girara:

  - Add girara-tests-unset-xdg-vars.patch: run the utils-with-home
    test with all XDG_* environment variables unset, so it no longer
    fails in build environments that export XDG_CONFIG_HOME
    (backport of upstream commit 0f653f2c4e3e)
  - Re-enable the utils-with-home test: drop the meson-version
    dependent test-list skip hack from %check — with the patch
    applied the test passes everywhere

++++ gitg:

  - Update to version 50:
    + Features:
  - Customizable column visibility and order in history
  - New preferences general tab
  - Custom actions
  - Delete remote branches
  - Full feature push action
  - Checkout detached action
  - Show HEAD in history view
  - Edit upstream branch on local branches
  - Rename tags
  - Resolve local tags
  - Allow choosing the default diff view: Unif or Split
  - Add action to fetch all remotes
  - Action to show info for tags
  - Use Alt+Page_Up / Alt+Page_Down for previous/next in the
    commit dialog
    + Bug fixes:
  - Revert visibility of committer name and SHA1
  - Manage global actions outside a repo
  - Resolve shortcut conflict between discard and edit actions
  - Use proper quotes on messages
  - Allow push action to be smart
  - Keep state for wrap lines on commit activity
  - Avoid different diff renderers to keep same dimensions
  - Fix open externally opening gitdir instead of workdir
  - Improve default window size and pane positions
  - Keep commit dialog size
  - Enable translation on open externally action
  - Load custom gitg styles only once
  - Show push output from server
  - Open repository directory externally
  - Honor theme on source view
  - Fetch without tags using Shift key
  - Detect current upstream branch to disable edit upstream
  - Avoid to ignore ssh key credential method
  - Process correctly textconv parameters
  - Detect stash references on sidebar
  - fix details on dialog building
  - Use small "Authored by" & "Committed by" labels
  - Hyperlink emails onto names in commit details
  - Added refresh to reload branch list in interface
  - Add shortcuts and buttons to navigate through search results
  - added quotation marks in branch name
  - Open all references collapsed except for branches
  - Add operational icon and set as add remote for Remotes
  - Add push action only if upstream is set
  - Do not close dialogs on errors
  - Show full branch name in a tooltip in the branches listview
  - Hide unknown refs
  - Warn about destructive action
  - Correct the shortcut documentation for committing
  - Rebase gitg-typelib-dependencies.patch with quilt.
  - Use ldconfig_scriptlets macro for post(un) handling.

++++ gnome-keyring:

  - Add gnome-keyring-Drop-X-GNOME-Autostart-Phase.patch
    gnome-session-service is not responsible anymore for starting
    session services and complains about the presence of X-GNOME-Autostart-Phase.
    Removing this will allow whatever else is responsible (systemd,
    systemd-xdg-autostart-generator or whatever) to act.

++++ gtkmm-documentation:

  - Update to version 4.14.0:
    + RefPtr appendix: Make it clear that widgets don't use RefPtr
    + Replace gtkmm.org by gtkmm.gnome.org
    + Update the Internationalization and Localization chapter
    + Update links for building gtkmm on Windows
    + Add the C++ Resources section
    + Update the link to Frequently Asked Questions
    + Update "The .hg and .ccg files" section
    + Chapter 3. Basics: Use consistent file name
    + Add the "GNU Free Documentation License" appendix
    + Remove obsolete FSF (Free Software Foundation) address in
    example programs
    + Talk about closing a window instead of hiding it
    + others/dnd: Avoid a segfault in on_image_drag_leave()
    + "Generating the .defs files" section: Describe mmgir
    + Updated translations.

++++ haproxy:

  - Update to version e70a708:
    * DOC: otel: test: corrected the test guides and added a tools manual
    * DOC: otel: reconciled the manuals and internals docs with the code
    * DOC: otel: documented the wrapper and HAProxy version requirements
    * MINOR: otel: rebuilt 'flt-otel status' on the table builder
    * MINOR: otel: added a reusable column-oriented table builder
    * MINOR: otel: showed the records carried per export in 'flt-otel status'
    * MEDIUM: otel: logged runtime errors and warnings without flooding syslog
  - Update to version 3.4.1+git12.89814d3b6:
    * BUG/MINOR: http-htx: Don't by-pass HTX API when merging cookie values
    * BUG/MINOR: mux-quic: Fix handling EOM after in qcs_http_rcv_buf()
    * BUG/MAJOR: htx: Don't swap buffers for empty HTX message with an error
    * BUG/MINOR: tools: fix invalid character detection in strl2ic()
    * BUG/MINOR: init: fix default global settings being overwritten by -G
    * MINOR: hbuf: new lightweight hbuf API
    * BUG/MEDIUM: servers: Use a refcount for port_range and free it properly
    * BUG/MINOR: sample: set SMP_F_CONST on srv_name fetch
    * BUG/MEDIUM: server: initialise agent.health in srv_settings_init()
    * BUG/MINOR: hq-interop: support transcoding of absolute URI
    * BUG/MINOR: hq-interop: fix transcoding of wrapping response buffer
    * BUG/MEDIUM: mux_quic: fix memory leak of rx app_buf on stream free

++++ hdjmod:

  - Update to version 1.39
    * Compatibility with Linux 7.2

++++ homebank:

  - Update to 5.10.2
    * bugfix: lp#2156412 safety approve option mixup
    * bugfix: lp#2156372 currency modification date is not persisted
    due to extra space in code
    * bugfix: lp#2155966 main window different colours for 0.00
    account balances
    * bugfix: lp#2155959 cannot inherit a locked reconciled
    transaction
    * bugfix: lp#2155844 quick search no longer works in account
    window (ledger)

++++ json-c:

  - Add no-xxd.patch and bring back the full testsuite.
  - Name the -devel and -doc subpackages based on the SRPM and
    nothing else.
  - Drop xxd BuildRequires to break an OBS build cycle; exclude the
    test_json_parse_cli test (its only consumer) from %check.

++++ jujutsu:

  - update to 0.43.0:
    * Release highlights
  - jj run allows you to run a command over a set of changes,
    each with their own private working copy; the commands may
    update the working copy and changes/conflicts are propagated
    accordingly, e.g., jj run -- cargo check --all-features or jj
    run -- cargo fix behaves as one might expect.
    * Breaking changes
  - The deprecated git_head() and git_refs() functions have been
    removed from revsets and templates.
  - Git-like symbols (e.g. refs/heads/main) are no longer
    resolved to revisions. Use the bookmark/tag <name> or
    <name>@<remote> syntax instead.
  - The deprecated ui.revsets-use-glob-by-default option has been
    removed.
  - jj bookmark track/untrack no longer supports
    <kind>:<bookmark>@<remote> patterns. However, the
    <bookmark>@<remote> symbol syntax is still supported.
    [#9226]
    * Deprecations
  - None
    * New features
  - jj show now supports --reversed flag.
  - jj now looks for config files in /etc/jj.
  - jj config gc will delete configuration of deleted/moved repos
    from ~/.config/jj/repos folder. #9362
  - jj run allows you to run a command over a set of changes,
    each with their own private working copy; the commands may
    update the working copy and changes/conflicts are propagated
    accordingly, e.g., jj run -- cargo check --all-features or jj
    run -- cargo fix behaves as one might expect.  jj gerrit
    upload now supports the -o (--option) flag, which works like
    git push -o (--push-option).
  - jj git fetch now rebases the descendants of revisions that
    were rewritten based on their change IDs. Previously, when
    multiple bookmarked revisions existed in a stack, those
    rewritten revisions and their descendants wouldn't always be
    rebased. Note that immutable descendants will not be rebased.
  - Add a forks() revset function that yields all commits with
    more than 1 child.
  - colors config now supports crossed-out text styling with {
    crossed-out = true }.
    * Fixed bugs
  - On Windows, querying a path's file identity no longer follows
    symbolic links, matching the behavior on Unix. Previously a
    symlink shared the identity of its target, so two symlinks
    pointing at the same target were treated as the same file.
    This identity check is used when writing the working copy to
    detect aliases of the reserved .git and .jj directories.
    [#8924]
  - jj now creates a new working-copy revision during
    snapshotting if the working copy was immutable. Previously,
    the new revision was created immediately after the working
    copy became immutable.
    [#7751]
    [#9338]
  - jj git remote add now warns if the new remote exactly matches
    an existing remote's fetch URL or effective push URL.  #413
  - Fixed corrupt loose Git objects on Intel Raptor Lake CPU and
    aarch64.
    Previously, jj could report a successful commit even though
    git fsck would later fail with incorrect data check, corrupt
    loose object, or missing blob, and later jj operations could
    fail with corrupt deflate stream.

++++ kernel-default:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-source:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-docs:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-kvmsmall:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-obs-build:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-obs-qa:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-syms:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kernel-vanilla:

  - Update
    patches.kernel.org/7.1.1-006-arm64-errata-Mitigate-TLBI-errata-on-various-Ar.patch
    (bsc#1012628 CVE-2026-53354).
  - Update
    patches.kernel.org/7.1.2-004-agp-amd64-Fix-broken-error-propagation-in-agp_a.patch
    (bsc#1012628 CVE-2026-53325 bsc#1269726).
    suse-add-cves
  - commit 992f18c
  - KVM: x86/tdx: Do not print error message on non-present feature
    (bsc#1270053).
  - commit 15c3ef6

++++ kmscon:

  - Update to version 10.0.1:
    * libseat support is disabled by default both build- and run-time
    * kmscon's built-in issue support is lacking features, so the
    default got changed to use agetty again.
    * kmscon listens to locale1 over dbus to update the keyboard layout
    dynamically
  - Full changelog is available on https://github.com/kmscon/kmscon/releases/tag/v10.0.1
  - Drop patches, now upstream:
    * 0001-Revert-systemd-start-login-instead-of-agetty.patch
    * 0002-Revert-Use-kmscon-has-default-TERM.patch

++++ kubernetes:

  - Bump meta package versions:
    * kubernetes (version) - 1.36.2
    * kubernetes (versionminus1) - 1.35.6
    * kubernetes (versionminus2) - 1.34.9
    * kubernetes (versionminus3) - 1.33.13

++++ kubernetes1.33:

  - Update to version 1.33.13:
    * Bump images and versions to go 1.25.11 and distroless iptables
    * fix(endpoint): avoid panic on services with empty IPFamilies

++++ kubernetes1.34:

  - Update to version 1.34.9:
    * Bump images and versions to go 1.25.11 and distroless iptables
    * kubeadm: fix dry-run CA copy paths in init certs
    * fix(endpoint): avoid panic on services with empty IPFamilies
    * fix(csi): preserve mount dir on NodePublish error during remount
    * feat(volume): add IsRemount to MounterArgs
    * Restore ability to plumb binary data through envvar values

++++ libcotp:

  - Update to 4.2.1:
    * Added YAOTP support
    * One-shot whash_sha256 wrapper dispatched by the selected
    backend (gcrypt/openssl/mbedtls)
    * Shared percent-encode/decode codec (utils/pct) used by both the
    otpauth and yaotp URI parsers
    * MbedTLS 4.x: the classic mbedtls_md_hmac_* API was demoted to
    private identifiers in 4.x, which broke the mbedtls HMAC
    backend. It is now a version-guarded dual implementation: PSA
    Crypto (psa_mac_sign_setup/update/finish) for
    MBEDTLS_VERSION_MAJOR >= 4, with the unchanged legacy path for
    2.x/3.x. FindMbedTLS.cmake also links libtfpsacrypto when
    present (TF-PSA-Crypto split).

++++ libfsxfs:

  - Update to release 20260703
    * Support for XFS_ATTR_PARENT

++++ libfwevt:

  - Update to release 20260702
    * An update to autoconf m4 scripts for tests

++++ libjansson:

  - Update to 2.15.1:
    * Include the object key or array index in unpack type mismatch error
    messages (@cwalther in #731)
    * Reject negative string length in the json_pack s# and +# formats
    (@akheron in #740)
    * Limit recursion depth in dump, equal and deep copy to prevent stack
    overflow (@akheron in #741)

++++ libmodbus:

  - Update to version 3.2.0
    * Add modbus_proxy() to bridge two Modbus backends.
    * Add termios2 support to allow custom baud rates (RTU).
    * Return an exception response for READ EXCEPTION STATUS (0x07).
    * Use EMBXILVAL instead of EMBMDATA for illegal data value
    errors.
    * modbus_reply: reject NULL req and mb_mapping arguments..
    * modbus_reply: validate request length before reading
    per-function fields.
    * Fix signed integer overflow in modbus_get_float_*()
    * Fix signed integer overflow in the MODBUS_GET_INT*_FROM_INT*
    macros;
    * MODBUS_GET_INT16_FROM_INT8() now returns a signed int16_t in
    every context.
    * Fix strict aliasing violation in modbus_set_float_*() by using
    memcpy.
    * modbus-rtu: don't use O_EXCL when opening the device (#760).
    * Check if ai_list is null before freeing it (#831).
    * Respect user-provided CFLAGS (closes #836).
    * Fix test to use ctx instead of invalid_ctx (closes #791, #792).
    * Update documentation of float functions (closes #838).
    * Fix documentation examples of modbus_get_float_* functions.
    * modbus_reply_exception: reject a NULL request pointer.
    * modbus_mask_write_register: validate that ctx is not NULL.
    * modbus_write_and_read_registers: validate src/dest pointers and
    counts.
    * modbus_report_slave_id: reject a NULL dest buffer.
    * modbus_get_*_timeout: validate that the output pointers are not
    NULL.
    * modbus_mapping_new_start_address: cap table dimensions.
    * modbus_mapping_new: reject negative counts.
    * modbus_rtu_set_custom_rts: reject a NULL callback.
    * modbus-rtu: avoid integer overflow in the RTS post-send delay.
    * modbus-rtu: check the return values of the RTS ioctl calls.
    * modbus-rtu: check the return value when saving termios settings
    on connect.
    * modbus-rtu: report a failure to restore termios settings on
    close.
    * modbus_new_rtu: reject negative baud rates.
    * modbus-tcp: guard freeaddrinfo() against NULL on resolver
    failure.
    * modbus_new_tcp: NUL-terminate the IP string when ip is NULL.
    * modbus_reply: validate FC22 request length before writing the
    register.
    * modbus-tcp: keep ctx->s consistent across failed or repeated
    connects (no * false success on a stale descriptor, no socket
    leak on reconnect).
    * modbus-tcp: don't override the user error recovery mode in the
    flush overflow path.
    * guard close against a never-opened handle and reset it after
    close).
    * modbus-rtu: sleep the RTS turnaround delay in chunks to stay
    portable with usleep().
    * modbus_new_rtu: validate data_bit and stop_bit arguments.
    * modbus_send_raw_request_tid: reject NULL raw_req with EINVAL.
    * modbus_get_byte_from_bits: remove an always-false assert and
    clamp nb_bits consistently in debug and release builds.
    * tests: don't kill the unit test server on RTU bad-CRC frames.
    * tests: fix integer overflow in the bandwidth-client rate
    computation.

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1086
  - updated tests
  - 4.5.338

++++ melange:

  - Update to version 0.56.0:
    * build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2576)
    * FDO package metadata improvements (#2370)
    * feat(config): add annotations field to subpackages (#2582)

++++ mm-common:

  - Update to version 1.0.8:
    + doc-reference.am: Distribute .svg files from the HTML directory
    + Skeletonmm: Add skeletonmm/tools/generate_from_gir.sh
    + Meson build: Allow -Duse-network=if-no-local-tag-file (new
    default value).

++++ nekobox:

    Update to 5.11.25
  - Added warp profile generator

++++ netbird:

  - Update to 0.74.1
  - [client] Make lazy connections opt-out via NB_LAZY_CONN by
    @lixmal in #6617
  - [client] Run privileged client tests natively with sudo on
    Linux by @pappz in #6635
  - [self-hosted] Remove image override logic in getting started by
    @mlsmaycon in #6636
  - [management] Add vLLM support for Agent Network by @braginini
    in #6643
  - [management] return nil when config is not set by @mlsmaycon in
    [#6642]

++++ netperfmeter:

  - Update to version 2.0.8
    * Further output improvements for the module loader.
    * Added QUIC module loading support to netperfmeter-module-loader
    * Improved detection of GNU getopt, to provide a useful error
    message when it is missing.
    * Improved documentation.

++++ obs-git-init:

  - Update to 0.2.7
    * register format_spec_file as pre-commit hook if available

++++ okteto:

  - Update to version 3.21.0:
    * New Feature
  - feat(stack): native runtime cloud access for Compose services
    via x-okteto-identity-token by @ifbyol in #5064
    * Bug Fix
  - [Backport release-3.21] Fix "okteto destroy --all" hanging on
    sleeping namespaces by @github-actions[bot] in #5073
    * Dependencies
  - build(deps): bump actions/cache from 5 to 6 (#5065)
  - chore(deps): Update docker (#5062)
  - build(deps): bump github.com/containerd/containerd/v2
    (#5063)
  - build(deps): bump renovatebot/github-action from 46.1.15 to
    46.1.16 (#5061)
  - chore(deps): Update module github.com/kubeark/jsonschema to
    v0.3.0 (#5060)
  - chore(deps): Update cli-and-logging to v8 (#5058)
  - build(deps): bump actions/checkout from 6 to 7 (#5059)
  - chore(deps): Update golang-stdlib-extensions to v1.81.1
    (#5056)
  - chore(deps): Update docker to v29.5.1+incompatible (#5055)
  - chore: upgrade Go to 1.26.4 (DEV-1390) (#5050)
  - chore(deps): Update module github.com/heimdalr/dag to v1.5.1
    (#5053)
  - build(deps): bump renovatebot/github-action from 46.1.14 to
    46.1.15 (#5044)
  - chore(deps): Update cli-and-logging to v8 (#5048)
  - chore(deps): Update golang-stdlib-extensions (#5047)
  - chore(deps): Update docker to v0.9.7 (#5046)
  - chore(deps): Update cli-and-logging to v8 (#5039)
  - chore(deps): Update module github.com/fsnotify/fsnotify to
    v1.10.1 (#5041)
  - chore(deps): Update docker (#5036)
  - chore(deps): Update golang-stdlib-extensions to v1.81.0
    (#5037)
  - chore(deps): update github.com/okteto/buildkit to v0.29.0
    (#5034)
  - chore(deps): Update module github.com/google/uuid to v1.6.0
    (#5033)
  - chore(deps): Update module github.com/alessio/shellescape to
    v1.6.0 (#5023)

++++ opa:

  - Update to version 1.18.2:
    This release includes a bug fix for a opa fmt regression
    introduced in v1.18.0.
    The original fix for #8557 had the formatter enforce newlines in
    single-item collections (arrays, objects, sets) rather than
    merely honoring existing ones. As a result, running opa fmt on
    already-formatted policies could introduce a large number of
    unwanted changes. This patch release restores the intended
    behavior: only newlines already present in the source determine
    whether a single-item collection is formatted on one line or
    across multiple lines.
    * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)

++++ openQA:

  - Clarify resolution of three CVEs
    * The following CVEs have been fixed (see previous changelog
    entries that mentioned only the according Bugzilla tickets):
  - bsc#1259005 - CVE-2026-27904
  - bsc#1264376 - CVE-2026-6321
  - bsc#1258632 - CVE-2026-26996
  - Update to version 5.1782995932.ffeb09be:
    * feat: throw 404 for nonexistent groups in overview
    * feat: Avoid logwarn notifications for non-critical auth error
    * chore(deps): Dependency cron 2026-07-02
    * git subrepo pull (merge) external/os-autoinst-common
    * fix: Check also hidden files in checklist plugin
    * test: Enable faster re-connects in full scheduler test consistently
    * test: Avoid silent daemons in verbose mode
    * test: Allow running `t/43-…-scalability.t` in parallel
    * test: Allow running `t/05-scheduler-full.t` in parallel
    * test: Avoid race condition when generating ports in `25-cache.t`
    * test: Avoid wasting seconds in `40-script_load_dump_templates.t`
    * refactor: Remove disabled code in `openqa-load-templates`
    * test: Avoid race condition when generating ports in many tests
    * chore(deps): Dependency cron 2026-07-01
    * fix(ci): format inline comments in workflows to pass yamllint
    * test: Avoid running into "Address already in use" in fullstack test
    * feat(ci): pin GitHub Actions by commit hash

++++ python-backports.zstd:

  - skip for python 3.15

++++ python-click-extra:

  - update to 8.2.0:
    * Add a --export-config FORMAT option to every @command and
    @group: it renders the resolved configuration on <stdout> in
    any writable format (toml, yaml, json, json5, jsonc, hjson,
    xml), then exits. Adds ExportConfigOption,
    @export_config_option and SERIALIZABLE_FORMATS to the public
    API.
    * Add --theme=auto: it selects the dark or light palette from the
    terminal background, detected from CLITHEME, COLORFGBG or a
    live OSC 11 query; the default stays dark. Adds
    resolve_background and query_osc_background to
    click_extra.color, resolve_auto_theme and AUTO_THEME to
    click_extra.theme.
    * Add run_lanes(func, lanes) and resolve_jobs(ctx, count) to
    click_extra.execution: run each lane serially while distinct
    lanes run concurrently, sized by --jobs; expose the
    worker-count policy shared with run_jobs. A serial_at_debug
    keyword collapses both fan-outs to sequential at DEBUG
    verbosity.
    * Add the always-on matrix Sphinx directive, rendering a
    package's release compatibility matrix from its git tags, for
    the Python interpreter ({matrix} python) or a dependency
    ({matrix} <distribution>) axis; a comment-marker form renders
    the embedded table on GitHub too.
    * Add the click-extra refresh-directives command (wrapping
    click_extra.sphinx.matrix.update_matrix_blocks) to regenerate
    the tables embedded in {matrix} directive blocks and <!--
    matrix … --> marker regions; its --check mode flags stale
    tables in CI.
    * Publish format_cli_prompt in click_extra.testing (was the
    private _format_cli_prompt): render a themed, copy-pasteable
    prompt simulating a CLI invocation.
    * Fix Carapace dynamic completion: an option's value or a
    subcommand argument with a custom shell_complete now resolves
    through the generated spec, instead of returning empty or
    root-level candidates.
    * Fix EnumChoice shell completion on Click 8.4.0: completion
    candidates are now normalized, so they match the option's
    accepted values instead of appearing as raw uppercase enum
    names.
    * Fix run_jobs blocking on Ctrl+C during parallel execution: an
    interrupt now drops queued items and returns immediately,
    instead of waiting for every in-flight task to finish.
    * Add a documentation page on Typer compatibility, explaining why
    click-extra cannot be combined with Typer and how to get the
    same options natively.

++++ python-langsmith:

  - Update to 0.9.6:
    * Add optional voice tracing integrations for Pipecat, LiveKit
    and OpenAI Realtime (new extras; not enabled in this package)
    * Record thread_id in trace metadata for Claude Agent SDK runs
    * Fix serialization of trace dictionaries with tuple keys
    * Guard OpenTelemetry span cleanup against exceptions during
    teardown (gh#langchain-ai/langsmith-sdk#3080)
  - Skip new opentelemetry-dependent unit test file
    (test_span_utils.py) in %check, consistent with the existing
    skip policy for optional providers
  - Update to 0.9.5:
    * Expose a datasets v2 resource accessor and a projects resource
    accessor on the client.
    * Apply the output anonymizer to a run's error field as well.
    * Use the current-project issues endpoint.
    * Google ADK integration: capture LLM inputs after the
    before_model_callback runs and set the tool span as the active
    tracing context in wrap_tool_run_async.
    * Sandbox: raise all WebSocket handshake failures as
    SandboxConnectionError.
    * Raise the minimum supported LangSmith backend to 0.16.9rc1.

++++ python-time-machine:

  - add python-315-datetime-patching.patch to fix python 3.15+
    support

++++ rizin:

  - Update to version 0.9.1
    * Scrolling issues in visual mode for meta items.
    * Fixing the fun fortunes.
    * Setting the default newline character for string search to NUL (to match commonly expected behavior).

++++ rz-cutter:

  - Update to version 2.5.0
    * Use Rizin v0.9.1
    * New Preferences tab to query and modify Rizin configuration variables (evars) directly from the UI
    * cutter-rizin-config-variables
    * New window listing all keybindings, browsable and searchable from the preferences
    * cutter-key-bindings
    * Register, variable, and memory value tooltips while debugging or emulating, including sub-register values and previews of values inside brackets
    * Follow conditional branch targets with the Enter/Return key in both Disassembly and Graph views
    * Debugging improvements:
    * Add an interface to change and specify register profiles
    * Allow setting an RzRun profile before starting a debugging session
    * Support debuginfod servers in the initial analysis options dialog
    * Fix a deadlock in remote debug connections
    * Types widget improvements:
    * Make type and variable names clickable
    * Show variables of the selected type in the Types tab
    * Add rename and "set type class" options
    * rizin-types-context-menu
    * Search bars added to the Console and the XRefs dialog
    * Docking is now optional — widgets can be floated freely instead of being forced to dock, with a new "Enable/Disable Docking" shortcut
    * More information shown in the navigation bar
    * Better use of screen space — configurable Quick Filter visibility and item-count label
    * Add a toggle to show raw strings in the Strings widget
    * Add a vertical scrollbar to the Hex panel
    * Add an "Add Flag" option to the hexdump context menu
    * Remember the IO mode (e.g. read-only vs. read-write) for recently opened files
    * Show fewer entries in the Omnibar by default
    * Switch to use Qt 6.11.0
    * Updated translations, with support for languages that have multiple regional variants
    * Various bugfixes and refactoring
    * Drop fix-pyside-for-qt-6.11.patch

++++ skrooge:

  - Update to 26.4.0
    * kde#515099: Missing secondary currency value in Accounts
    totals
    * kde#514649: Fix initial layout when splash screen is not
    displayed
    * kde#514649: Double click issue on table when there is no
    selection
    * kde#438967: Labels in Skrooge Report axis and Legend tend to
    illegible
    * kde#517475: Alarms triggering even when conditions not met
    * kde#515186: Import should remember the directory used last
    when restarted
    * kde#430245: summaries display truncated after searching in
    Operations grouped by Category
    * kde#518461: charts missing in responsive monthly report
    * Correction: Better filtering in categories page
    * Correction: Fix various error in flatpak mode (import,
    download sources, ...

++++ stackit-cli:

  - Update to version 0.66.0:
    * fix(intake): set region to false in ConfigureClient (#1451)
    * chore(dns): migrate to new SDK structure (#1438)
    * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#1445)
    * chore(deps): bump actions/setup-go from 6 to 6.4.0 (#1446)
    * chore(loadbalancer): remove local interface (#1443)
    * fix(iaas): wrong encoding and decoding of user data attribute
    in server commands (#1439)
    * chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#1423)
    * fix(iaas): update examples and fix the payload for boot volumes
    (#1436)
    * chore(kms): migrate kms to new multi version sdk (#1437)
    * chore(load-balancer): sdk migration (#1432)

++++ suse-xsl-stylesheets:

  - Update 2.95.38
    * Fix survey button in single HTML in #810

++++ tik:

  - Actually install tik-functions-helper file

++++ timoni:

  - Update to version 0.27.0:
    * Update cuelang.org/go to v0.17.0 by @stefanprodan in #548
    * Fix capabilities element type by @zhshishkin in #547
    * Expose Bundle, Runtime and Instance CUE schemas by
    @stefanprodan in #549
    * Restrict instance and runtime names to lowercase by
    @stefanprodan in #550
    * Add bundle build --output-dir for manifests export by
    @stefanprodan in #551
    * Add guidance for AI coding agents by @stefanprodan in #552
    * build(deps): bump the ci group with 9 updates by
    @dependabot[bot] in #553

++++ tmux:

  - tmux 3.7b
    * Fix so that the end of a synchronized update again triggers a redraw.
  - tmux 3.7a:
    * Fix crash in break-pane when no name is provided.
    * Scrollbar options are now cached rather than being looked up for every
    redraw
    * Only forbid #( in names, allow #[, empty names, : and .

++++ werf:

  - Update to version 2.72.2:
    * Bug Fixes
  - build, stapel, import: rsync chown "/sys" Read-only file
    system on to: / (#7590) (b6dac9c)
  - Update to version 2.72.1:
    * Bug Fixes
  - deploy: hangs on very long pod lines (#7580) (daefa02)
  - deploy: no more "no match for resource kind" errors (#7585)
    (a3d0a5a)
  - deploy: retry also on conversion webhooks unavailability
    (#7587) (1623efe)
  - deploy: show actual error if webhook retries fail (#7586)
    (1dc615e)
  - Update to version 2.72.0:
    * Features
  - cleanup: delete rejected stages and linked custom tags during
    cleanup/purge (#7576) (b1b0980)
    * Bug Fixes
  - build, buildah: fix multiarch build failing with "image not
    known" for cross-platform images (#7573) (8cd109f)

++++ xsnow:

  - Update to version 3.9.3:
    * 01: add and correct some translations
    it has made it's point: remove surprises from scenery

------------------------------------------------------------------
------------------  2026-7-1  -  Jul 1 2026  -------------------
------------------------------------------------------------------

++++ Mesa:

  - Update to 26.1.4 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.4

++++ Mesa-drivers:

  - Update to 26.1.4 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.4

++++ MozillaThunderbird:

  - Mozilla Thunderbird 140.12.1 ESR
    MFSA 2026-63
    * CVE-2026-57962 (bmo#2042872)
    Denial-of-service via malicious LDAP address-book server
    * CVE-2026-57963 (bmo#2042910)
    Chat UI manipulation by injection

++++ OpenImageIO:

  - Update to 3.1.15.0 (boo#1270101)
  - deepdata: Widen merge_deep_pixels srcpixel to int64_t, change
    its return type, and add OIIO_NODISCARD_ERROR. #5252 #5253 (by
    @luna-y-kim / Luna Kim)
  - ImageBuf: Fix copy ctor of IC-backed ImageBuf zeroing bufspan
    strides. #5244
  - cineon: More robust to invalid numbers of channels and bit
    depths; also fixes a channel-naming counter bug and a memory
    leak in init(). #5250 (3.1.15.0, 3.0.20.0)
  - deepdata: Correct Zback channel in sort(), change int pixel to
    int64_t. #5241 (by @luna-y-kim / Luna Kim)
  - fits: Fix stack overflow from recursive header-block reading on
    corrupt files; convert to an iterative loop with a 10000-header
    safety limit. #5248 (3.1.15.0, 3.0.20.0)
  - fmath.h: Fix typo in convert_type default argument, min()
    should have been max(). #5227 (by @luna-y-kim / Luna Kim)
  - hdr: Make the HDR reader tolerant to CR in the ASCII header.
    [#5261]
  - iff: Fix allocation bug when reading 16 bit RGBA + float z
    (buffer size did not account for the z channel). #5251
    (3.1.15.0, 3.0.20.0)
  - tiff: The "tiff:half" hint was only applying to first MIP
    level. #5240
  - ci: Fixes to build_opencolorio.bash script #5219; upgrade
    'latest' CI tests to OpenEXR v3.4.14, fmt 12.2, PugiXML v1.16
    [#5245].
  - build: Add support for gcc-15 #5126, gcc-16 #5225, and C++26
    [#5230], each tested in CI.
  - build: Suppress warnings in fmt library when building on Mac.
    [#5237] (by @antond-weta / Anton Dukhovnikov) (3.1.15.0,
    3.0.20.0)
  - int: Remove deprecated std::codecvt from strutil.cpp internals.
    [#5107]
  - docs: Fix typos in fmath.h comments. #5222 (by @luna-y-kim /
    Luna Kim) (3.1.15.0, 3.0.20.0)
  - docs: Fix typos and update reference link in deepdata comments.
    [#5238] (by @luna-y-kim / Luna Kim)
  - docs: Clarify plugin.h explanations by saying their Unix-like
    equivalents. #5226
  - docs: Fix typo in bitcast docs. #5255

++++ python-PyCBC:

  - Update to version 2.11.0:
    * No release notes.
  - Changes from version 2.10.0:
    * Adding functionalities to create calibration config files
    [gh#gwastro/pycbc#4537].
    * Avoid unnecessary SNR (re)normalization in multi_inspiral
    [gh#gwastro/pycbc#5157].
    * fix a bug in the mutli loglikelihood method of the gated
    gaussian noise class [gh#gwastro/pycbc#5159].
    * Precision issue in pycbc_plot_singles_timefreq
    [gh#gwastro/pycbc#5164].
    * Expanding help string of --filter-string
    [gh#gwastro/pycbc#5166].
    * Optimize the sgchisq calculation [gh#gwastro/pycbc#5163].
    * multi_inspiral: avoid repeated power chi^2 calculations in the
    critical loop [gh#gwastro/pycbc#5158].
    * Add functionality to sample coalescence time in detector frame
    [gh#gwastro/pycbc#5165].
    * Add script for calculating Savage-Dickey ratio
    [gh#gwastro/pycbc#5167].
    * PyGRB: mark minifollowup subworkflows as parents of
    results_page jobs [gh#gwastro/pycbc#5169].
    * Improve HDF bank splitter [gh#gwastro/pycbc#5172].
    * Implement cached memory in eventmgr [gh#gwastro/pycbc#5154].
    * add gwtc4 [gh#gwastro/pycbc#5174].
    * Upgrade of pycbc_pygrb_plot_skygrid script
    [gh#gwastro/pycbc#5173].
    * first pass to drop 3.9 and 3.10 support
    [gh#gwastro/pycbc#5182].
    * Expand PyGRB tables [gh#gwastro/pycbc#5183].
    * Update pkg_resources (to be deprecated) to use importlib for
    plugins [gh#gwastro/pycbc#5181].
    * Fix rotted link to LALSuite documentation
    [gh#gwastro/pycbc#5187].
    * Fixes to PyGRB found-missed plot [gh#gwastro/pycbc#5178].
    * Update to ligo.skymap 2.1.1 [gh#gwastro/pycbc#5057].
    * Add python 3.13 [gh#gwastro/pycbc#5184].
    * Add functionality to combine posteriors via evidence sampling
    in extract_samples [gh#gwastro/pycbc#5168].
    * Pin dynesty to. <3.0 until the API interface can be updated
    [gh#gwastro/pycbc#5195].
    * Deprecation fixes [gh#gwastro/pycbc#5186].
    * Remove pin on igwn-ligolw [gh#gwastro/pycbc#5196].
    * Use pregenerated injection frame file to perform pregenerated
    injections (resurrected) [gh#gwastro/pycbc#5161].
    * Fix PyGRB clustering [gh#gwastro/pycbc#5199].
    * Remove SNR triggers not close to injection with
    injfilterrejector [gh#gwastro/pycbc#5153].
    * Avoid symlinking OS-wide Python in release virtualenvs
    [gh#gwastro/pycbc#5200].
    * enhance legend setting in pycbc_inference_plot_posterior
    [gh#gwastro/pycbc#4964].
    * New column in PyGRB injections tables [gh#gwastro/pycbc#5207].
    * Update GraceDB test so that it doesn't try to use x509
    credentials [gh#gwastro/pycbc#5202].
    * Correction of pygrb_plot_skygrid script to plot legacy case
    [gh#gwastro/pycbc#5204].
    * Add Effective precession spin chi_p to
    pycbc_pygrb_plot_injs_results [gh#gwastro/pycbc#5203].
    * Fix taper issue [gh#gwastro/pycbc#5191].
    * Update setup.py [gh#gwastro/pycbc#5211].
  - Drop python-PyCBC-tests-numpy-2.0-compat.patch: upstreamed.
  - Disable test TestBHSpecModel since it requires network.
  - Disable test flavour for python3.11 as dependency python-dask is
    no longer built for python3.11 either.

++++ SDL3:

  - Update to release 3.4.12
    * Improved support for external surfaces under Wayland
    * Fixed visual artifacts when switching render targets with the
    Vulkan renderer
    * Fixed crash rendering YUV textures on NVIDIA drivers with the
    Vulkan renderer
    * Added SDL_HINT_ENABLE_STEAM_SCREEN_KEYBOARD to customize
    behavior on Steam Deck and Steam Machine
    * Added hotplug detection support when using libusb for HIDAPI
    controllers
    * Fixed truncated long text input sequences when using
    sdl2-compat

++++ ansible-lint:

  - update to 26.6.0:
    * Features
  - fix: ensure configuration errors are visible to user (#5038)
    @Dotify71
    * Fixes
  - fix: bump cryptography minimum to >=46.0.6 and refresh lock
    file (#5089) @sudhirverma
  - fix: added setup-uv action version pinning to renovate config
    (#5021) @garethahealy
  - fix: detect role roots in namespace subdirectories (#5079)
    (#5080) @santosh7676
  - fix(docs): remove mkdocstrings plugin to unblock docs CI
    (#5084) @rockygeekz
  - fix: suppress ruff PLW0717 to unblock renovate (#5077)
    @rockygeekz
  - Fix risky-shell-pipe false positive on multi-line Jinja
    (#5058) @arpitjain099
  - Fix: fix mock_modules generated stubs failing YAML/doc
    parsing #5031 (#5032) @santosh7676
  - fix: support example format indicator, prevent ansible-lint
    from producing load-failure on valid non-YAML examples
    (#5045) @felixfontein
  - fix: avoid name[casing] auto-fix crash on multi-segment
    prefixes (#5026) @bishalOps
  - fix: preserve multi-hash comments on ansible-lint --fix
    (#5033) @bishalOps
  - fix: preserve trailing blank lines when fqcn auto-fix renames
    a key (#5027) @bishalOps
  - fix(security): update dependencies [SECURITY] (#5061)
    @renovate[bot]
  - fix(ci): switch devel tests from py312 to py313 (#5062)
    @rockygeekz
  - fix: ignore skip lookup across rules (#5060) @mehrdadbn9
  - chore: Add support for Fedora 44 in the meta schema (#5029)
    @jsf9k
  - fix: ensure configuration errors are visible to user (#5038)
    @Dotify71
  - fix: role argument spec: fix typo in attribute schema (#5044)
    @felixfontein
  - fix: handle ignore.txt comments with '#' in them correctly
    (#5028) @felixfontein
  - fix: Evaluate the exit code after applying the skipped rules
    from .ansible-lint-ignore (#5001) @gmuloc
  - fix: Update stale rulebook schema to match upstream
    ansible-rulebook (#5056) @Hrithik-Gavankar
  - fix: update '_extends' syntax for release-drafter v7
    compatibility (#5043) @rockygeekz
  - fix(security): update dependencies [SECURITY] - abandoned
    (#5014) @renovate[bot]
  - fix: update malformed block regex and bump pathspec upper
    bound (#5039) @rockygeekz
    * Maintenance
  - chore: remove previously-synced agent skills (#5078)
    @ansibuddy
  - chore(deps): update all dependencies (#5074) @renovate[bot]
  - fix(security): update dependencies [SECURITY] (#5061)
    @renovate[bot]
  - test: add security-check workflow (integration test) (#5064)
    @cidrblock
  - chore: Add support for Fedora 44 in the meta schema (#5029)
    @jsf9k
  - chore: clarify yaml reformatting under fix (#5057)
    @Himanshuagrawal4
  - chore(deps): update all dependencies pep621 (#5047)
    @renovate[bot]
  - chore(deps): update all dependencies (#5046) @renovate[bot]
  - chore(deps): update all dependencies pep621 (#5041)
    @renovate[bot]
  - chore(deps): update all dependencies (#5040) @renovate[bot]
  - chore(deps): update all dependencies (#5011) @renovate[bot]
  - fix(security): update dependencies [SECURITY] - abandoned
    (#5014) @renovate[bot]
  - chore(deps): update all dependencies pep621 (#5012)
    @renovate[bot]

++++ ansible-navigator:

  - Update to version 26.6.0:
    * Features
  - feat: TUI arrow-key cursor navigation and Enter selection in
    menus (#2105) @Andersson007
    * Fixes
  - fix: add type annotation for USER_ENVIRONMENT to satisfy mypy
    v2.1.0 (#2131) @sathyapramod
  - fix(runner): resolve SSH_AUTH_SOCK symlink on macOS Tahoe
    before container mount (#2114) @stevefulme1
  - fix(command-runner): prevent indefinite deadlock in
    run_multi_process (#2125) @sathyapramod
  - fix: optimize image introspection with section filtering
    (#2124) @sathyapramod
  - fix: handle missing tzdata gracefully for UTC timezone
    (#2123) @cidrblock
    * Maintenance
  - Add unit tests to improve coverage across utility modules
    (#2117) @shatakshiiii
  - chore: remove previously-synced agent skills (#2129)
    @ansibuddy
  - ci: replace coactions/upload-artifact with
    actions/upload-artifact@v7 (#2127) @sudhirverma
  - chore(deps): update pre-commit hook
    renovatebot/pre-commit-hooks (#2118) @renovate[bot]
  - chore: exclude .agents/skills/ from markdownlint and prettier
    (#2119) @shatakshiiii
  - chore(deps): update all dependencies (#2115) @renovate[bot]

++++ apko:

  - Update to version 1.2.20:
    * apk: don't disqualify a package for an unversioned provide
    * Add support for gzip-compressed CPIO output (#2253)
    * build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (#2300)
    * build(deps): bump github.com/chainguard-dev/clog from 1.8.0 to
    1.8.1 (#2302)
    * build(deps): bump imjasonh/setup-crane from 0.6 to 0.7 (#2303)

++++ arkade:

  - Update to version 0.11.105:
    * Improve search ranking and add fallback for unmatched queries
  - Update to version 0.11.104:
    * Initial search command for arkade
  - Update to version 0.11.103:
    * Fix trailing newline
    * Flat option for arkade oci install
    * Remove faasd tool definition
    * Update number of tools after adding pluto
    * Add pluto CLI to find deprecated K8s APIs
    * Make symlink extraction in UntarNested conditional
    * Fix symlink path-traversal escape in UntarNested
    * Remove stray file

++++ blktests:

  - Update to version 0+20260630.3494185:
    * src/Makefile: escape '#' in HAVE_C_DEF

++++ c3p0:

  - Upgrade to upstream version 0.14.1
    * Changes in version 0.14.1
    + Modify c3p0 to use new BeanInfoGen functionality, restoring
    compatibility with Java [7,11).
    + Modify BeanInfoGen to (optionally, but by default) cache
    descriptors rather than regenerating them for each call to an
    introspection method.
    + Modify BeanInfoGen to log items skipped from descriptors due
    to API incompatibility.
    + Modify BeanInfoGen to generate BeanInfo classes in which
    properties/events/methods that existed in the JVM under which
    they were generated and built, but do not exist under the
    runtime JVM, are tolerated and simply omitted at runtime from
    BeanInfo descriptors. This fixes compatibility with Java
    environments before Java 11, under whose API c3p0 and
    mchange-commons-java are currently built.
    * Changes in 0.14.0
    + Update to mill 1.1.6 and fix broken support for reproducible
    builds via the SOURCE_DATE_EPOCH environment variable.
    + Generate explicit BeanInfo classes for c3p0-defined concrete
    DataSource and ConnectionPoolDataSource implementations, which
    exclude "connection" and/or "pooledConnection" from
    introspected bean properties, in order to preclude attacks.
    (bsc#1269941, CVE-2026-55223)
    + Enforce a deterministic ordering on methods produced by the
    code generator DelegatorGenerator, in order to keep builds
    including such generated classes reproducible.
    + Define BeanInfoGen, a code-generation utility that defines
    explicit BeanInfo classes for what otherwise would have been
    introspected via JavaBean naming conventions, but permits
    properties to be excluded from such introspection.
    + JavaBeanObjectFactory now enforces an allowlist of classes it
    is willing to construct from References that call upon it.
    That allowlist is defined by the new config parameter
    com.mchange.v2.naming.referenceableJavaBeanClassWhitelist
    + Define the false-biased config security key
    com.mchange.v2.naming.allowIndirectSerializationViaReference,
    disabling by default indirect serialization/deserialization of
    Referenceable but otherwise non-serializable objects by
    serializing their references. This is a clever mechanism, but
    it is rarely used and provides a place where attackers might
    smuggle a malicious reference.
    * Changes in 0.13.0
    + Ensure sessions are marked as endRequest() is called prior to
    check-in, to eliminate a race condition between DBMS cleanup
    and checkout by a new client.
    + Remove the generic JavaBeanObjectFactory from the allowlist of
    object factories, com.mchange.v2.naming.objectFactoryWhitelist,
    that mchange-commons-java ReferenceableUtils is willing to
    dereference. Only C3P0JavaBeanObjectFactory should be used.
    + Modify C3P0JavaBeanObjectFactory to use
    C3P0JavaBeanReferencePropertyOverrider.
    + Modify the JavaBeanReferenceMaker employed by c3p0 beans to use
    C3P0JavaBeanReferencePropertyOverrider.
    + Define C3P0JavaBeanReferencePropertyOverrider, supporting the
    serialization and deserialization of user-defined config
    key-value pairs (the 'extensions' property).
    + Add support for extensions, in the form of
    JavaBeanReferencePropertyOverrider, that allow
    javax.naming.Referenceable JavaBeans that include non-String,
    non-coercible-to-string, non-SecurelyStringifiable properties
    to use custom serialization to a Reference. Add support for
    such extensions to both the JavaBeanReferenceMaker and
    JavaBeanObjectFactory.
    + Replace the internal use of Java serialization by
    JavaBeanObjectFactory and JavaBeanReferenceMaker with a CSV
    format when tracking reference properties.
    + Eliminate support for decoding BinaryRefAddrs via Java
    (de)serialization in JavaBeanObjectFactory. The capability
    still exists, but one must explicitly extend
    JavaBeanObjectFactory in order to support it. No existing
    classes in c3p0 or mchange-commons-java now use Java
    serialization to unpickle objects from References.
    + Add support for SecurelySerializable to c3p0's code-generated
    bean superclasses, as well as to the concrete derived beans.
    + Define CsvSecurelyStringifiableBeangenGeneratorExtension to
    enable code-generated Java beans that support the new
    SecurelyStringifiable alternative serialization.
    + When generating references with JavaBeanReferenceMaker, gate
    the use of Java serialization to define properties behind a
    new false-biased configuration parameter,
    com.mchange.v2.naming.generateSerializedObjectBinaryRefAddr.
    (This should almost never be reset to true.)
    + Define a SecurelyStringifiable mechanism in com.mchange.v2
    .naming, intended to replace the use of dangerous Java
    serialization in the construction of references.

++++ clamav:

  - update to 1.5.3
    ClamAV 1.5.3 is a patch release with the following fixes:
    * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
    * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
    * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
    * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
    * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
    * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
    * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
    * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
    * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
    * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
    * Metadata preclass scans now run before the final scan verdict.
    * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
    * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.

++++ digger-cli:

  - Update to version 0.6.147:
    * Feat/terragrunt parallelism (#2667)
    * fix: allow digger apply when digger/apply is the sole required
    blocking check (#2661)
    * add block excludes (#2659)
    * docs: add Holocron migration spike (#2656)
    * fix: drift exclude patterns excluding all projects when include
    is unset (#2653)
    * Feat/exclude drift (#2650)
    * conditionally enable summary (#2619)
    * Fix default image repos (backend ee -> ce), add podAnnotations
    (#2598)
    * fix: add target url to link to workflow run (#2606)
    * docs: secuirty page (#2605)

++++ e-antic:

  - Add flint-3.6.patch to fix FTBFS with flint 3.6.0

++++ easyeffects:

  - Update to version 8.2.7:
    * Updated NEWS
    * Making sure KAboutData uses the correct desktop file name
    * Bump actions/cache from 6.0.0 to 6.1.0
    * Using QtCore calls to set the application name
    * Updated NEWS
    * Removing the StartupWMClass key from our desktop file
    * Translated using Weblate (Spanish)

++++ etcd:

  - Update to version 3.6.13: (GHSA-3wh4-j44w-pg92 boo#1270046)
    * version: bump up to 3.6.13
    * Reject the client request if the client certificate has been
    revoked
    * Update incorrect log message
    * server/auth: accept bearer-prefixed auth tokens
    * Bump OpenTelemetry dependencies to v1.43.0 (CVE-2026-29181
    CVE-2026-39883)
    * build(deps): bump distroless/static-debian12 from `20bc6c0`
    to `9c346e4`
    * Bump golang.org/x/crypto to v0.52.0
    * Update Go to 1.25.11
    * Add V2Depr1WriteOnlySkipCheck to bypass the v2 data store check

++++ flux2-cli:

  - Update to version 2.9.0:
    Flux v2.9.0 is a feature release. Users are encouraged to upgrade
    for the best experience.
    For a compressive overview of new features and API changes
    included in this release, please refer to the Announcing Flux 2.9
    GA blog post.
    https://fluxcd.io/blog/2026/06/flux-v2.9.0/
    * Overview of the new features:
  - Flux CLI Plugin System with the Mirror and Schema plugins
    (flux plugin)
  - Server-Side Apply field ignore rules for fine-grained drift
    control (Kustomization)
  - SOPS decryption with the Age post-quantum cipher
    (Kustomization)
  - Kubernetes Workload Identity authentication for OpenBao and
    Vault (Kustomization)
  - Helm post-render strategies, including chart hooks support
    (HelmRelease)
  - Literal mode for Helm values references mirroring helm
  - -set-literal (HelmRelease)
  - Allow empty kind in CEL health check expressions
    (Kustomization, HelmRelease)
  - Git commit signing and verification with SSH keys
    (GitRepository, ImageUpdateAutomation)
  - AWS CodeCommit authentication using Workload Identity
    (GitRepository)
  - Custom Sigstore trusted root for keyless verification in
    air-gapped environments (OCIRepository)
  - Path pattern directory discovery for monorepos
    (ArtifactGenerator)
  - Secret-less, OIDC-secured webhook Receivers (Receiver)
    * Components changelog
  - source-controller v1.9.1
  - kustomize-controller v1.9.1
  - notification-controller v1.9.1
  - helm-controller v1.6.1
  - image-reflector-controller v1.2.1
  - image-automation-controller v1.2.1
  - source-watcher v2.2.1
    * CLI changelog
  - Add backport label for Flux 2.8 by @matheuscscp in #5732
  - Remove no longer needed workaround for Flux 2.8 by
    @matheuscscp in #5733
  - Update toolkit components by @fluxcdbot in #5740
  - Add missing things to release notes template by @matheuscscp
    in #5743
  - ci: add top-level permissions to upgrade-fluxcd-pkg workflow
    by @gaganhr94 in #5763
  - build(deps): bump the ci group across 1 directory with 11
    updates by @dependabot[bot] in #5764
  - Update fluxcd/pkg dependencies by @fluxcdbot in #5766
  - Update toolkit components by @fluxcdbot in #5769
  - Add target branch name to update branch by @matheuscscp in
    [#5773]
  - Fix/resume exit code by @Aman-Cool in #5701
  - Mark RFC 0010, 0011 and 0012 as implemented by @stefanprodan
    in #5776
  - Update toolkit components by @fluxcdbot in #5780
  - Add --resolve-symlinks flag to build and push artifact
    commands by @rohansood10 in #5724
  - fix: validate --source flag in create kustomization command
    by @gma1k in #5798
  - Update toolkit components by @fluxcdbot in #5821
  - Add --show-source to flux get ks and flux get hr by
    @rafaelperoco in #5828
  - Add flux create secret receiver command by @stefanprodan in
    [#5835]
  - fix: handle multiple symlinks to same target in build
    artifact by @Iam-Karan-Suresh in #5833
  - Add --in-memory-build to flux build ks and flux diff ks by
    @rycli in #5794
  - Migrate end-to-end test to latest cloud SDKs by @stefanprodan
    in #5840
  - docs: Add AI Coding Assistants Guidance by @stefanprodan in
    [#5841]
  - Add AI Agents guidance by @stefanprodan in #5847
  - [RFC-0013] Flux CLI Plugin System by @stefanprodan in #5795
  - Add --ignore-not-found to flux diff ks by @rycli in #5845
  - [RFC-0013] Implement plugin system by @stefanprodan in #5849
  - build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 by @dependabot[bot] in #5853
  - Update toolkit components by @fluxcdbot in #5856
  - Add digest pinning support to flux plugin install by
    @Iam-Karan-Suresh in #5872
  - Add --ns-follows-kube-context global flag for using the
    kubeconfig context namespace by @jtyr in #5831
  - include source-watcher in install.yaml manifests by @tmmorin
    in #5881
  - Update toolkit components by @fluxcdbot in #5890
  - Update toolkit components by @fluxcdbot in #5903
  - Update fluxcd/pkg dependencies by @fluxcdbot in #5907
  - Validate Helm source URL schemes by @immanuwell in #5909
  - Introduce flux trigger receiver by @matheuscscp in #5908
  - refactor(api): migrate MakeDependsOn to shared apis/meta func
    by @vecil in #5912
  - Update to Kubernetes 1.36 and Go 1.26 by @stefanprodan in
    [#5924]
  - build(deps): bump the ci group across 1 directory with 19
    updates by @dependabot[bot] in #5925
  - Run conformance tests for Kubernetes 1.36 by @stefanprodan in
    [#5926]
  - Add support for AWS CodeCommit to flux bootstrap git by
    @taraspos in #5868
  - Validate plugin binary path by @stefanprodan in #5927
  - Update fluxcd/pkg dependencies by @fluxcdbot in #5928
  - fix: preserve invalid metadata.labels in flux build ks by
    @raffis in #5906
  - build: target host arch for local builds/envtest by
    @stealthybox in #5932
  - build(deps): bump the ci group with 6 updates by
    @dependabot[bot] in #5938
  - Support specifing sparseCheckout in flux bootstrap by
    @piny940 in #5918
  - Update toolkit components by @fluxcdbot in #5944
  - Honor ks.spec.postBuild.substituteStrategy by @matheuscscp in
    [#5945]
  - Add DriftIgnoreRules support to flux diff kustomization by
    @dipti-pai in #5923
  - Allow signing commits using SSH key by @hiddeco in #5920
  - Update toolkit components by @fluxcdbot in #5950
  - Update fluxcd/pkg dependencies by @fluxcdbot in #5937
  - cmd: support type!=status in get --status-selector by
    @3uzbcqje in #5952
  - Fix flux get all --status-selector for empty results and
    notification resources by @matheuscscp in #5954
  - Upgrade go-git-providers to v0.27.0 by @matheuscscp in #5956
  - Fix using Receiver adapter for ArtifactGenerator by
    @matheuscscp in #5957
  - feat: Install Plugins alongside Flux setup in gh actions by
    @gat786 in #5955
  - Update fluxcd/pkg dependencies by @fluxcdbot in #5960
  - Add CLI support for OCIRepository.spec.layerSelector in flux
    create source oci by @dme86 in #5892
  - Update toolkit components by @fluxcdbot in #5963

++++ ft2-clone:

  - Update to version 2.20
    * Sinc interpolation now uses up 74kB RAM instead of 2.4MB and
    thus is less hard on the CPU cache. In some cases this means
    even faster rendering. The way this change works is that the
    polyphase look-up tables now use 256 phases/branches instead of
    8192, coupled with linear interpolation between the phases when
    in use. This method is equal to having many more pre-computed
    phases than 8192, which in theory also means better precision.
    * Cubic spline interpolation now doesn't use a look-up table.
    Again, this is less hard on the CPU cache.
    * (Hopefully) fixed "Alt Gr" key not working on some systems.
    * "About" screen rendering has been optimized (big whoop).

++++ glab:

  - Update to version 1.106.0:
    * Features
  - ca99cc32: feat(packages): add delete command (Oscar Tovar
    otovar@gitlab.com)
  - 2ffa2f05: feat(packages): add download command (Oscar Tovar
    otovar@gitlab.com)
  - b323eaca: feat(stack): add --reword flag to fix commits
    without staging files (Gary Holtz is no longer with GitLab
    gary@holtz.tech)
    * Documentation
  - d0f83885: docs(whatsnew): document show_whats_new config and
    env var (Kai Armstrong karmstrong@gitlab.com)
  - 15b64e4e: docs: refine packages and container-registry
    command help text (Brendan Lynch blynch@gitlab.com)
    * Dependencies
  - 45b73a0f: chore(deps): update module github.com/docker/cli to
    v29.6.0+incompatible (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - 28d5db5c: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.42.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - b14d7c7c: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.43.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 0987f270: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.44.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
    * Maintenance
  - 2661db6c: chore: explain that token env will work in snap
    (Tomas Vik tvik@gitlab.com)

++++ gnome-remote-desktop:

  - Update to version 50.2:
    + Fix and enable hardware acceleration for amdgpu
    + Fix failure to reconnect
    + Updated translations.

++++ grype-db:

  - Update to version 0.54.1:
    * chore(deps): update anchore dependencies (#1034)
    * chore(deps): update tool versions (#1053)
    * chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#1051)
    * chore(deps): Bump the actions-minor-patch group with 3 updates
    (#1052)
    * bump grype to pull in db build fixes (#1050)
    * chore(deps): Bump github.com/containerd/containerd/v2 (#1047)
    * chore(deps): Bump the actions-minor-patch group with 2 updates
    (#1046)
    * Revert "refactor release pipeline: TAG_TOKEN tag push,
    skip-checks gate, depe…" (#1045)
    * refactor release pipeline: TAG_TOKEN tag push, skip-checks
    gate, dependabot/zizmor/gci cleanup (#1042)
    * chore(deps): update tool versions (#1041)

++++ gzip:

  - Add CVE-2026-41991.patch: fix insecure temporary file
    handling in the gzexe utility (and zdiff) when the mktemp
    utility is not available in the user's PATH. Backport of upstream commit
    4e6f8b24ab823146ab8776f0b7fe486ab34d4269.
    (CVE-2026-41991, bsc#1269622)

++++ harbor-cli:

  - Update to version 0.0.23:
    * fix: Missing windows binary (#970)
    * feature: add error_test.go in pkg/utils (#984)
    * fix(doc): resolve file descriptor leaks in documentation
    generators (#992)
    * fix(user): add email format validation to user create command
    (#816)
    * fix(ci): retry cosign transparency log failures (#965)
    * feat : project preheat execution (#925)
    * fix(registry): handle missing registry lookup in delete by name
    (#841)
    * fix(webhook): normalize endpoint URL before validation (#800)
    * build: address Go security findings (#960)
    * fix(docs): Update maintainer from Nucleo Fusion to Lakshit
    Singh (#963)

++++ icinga2:

  - Update to version 2.16.3:
    * Release v2.16.3
    * Add Dominik Bay to AUTHORS
    * Restore single-argument Json.decode() in the DSL
    * Add upgrading docs explaining the config file change for logrotate

++++ isa-l:

  - v2.32.1: Update
  - Removed 0001-crc-fix-x86-CRC-dispatcher.patch to fix dispatcher issue.
  - Fixed x86 CRC dispatcher (removed internal patch).
  - Fixed various compilation issues/warnings on MinGW and CMake.
  - Fixed various security issues.
  - Fixed in-place aliasing bug in RISC-V xor_gen and pq_gen functions.
  - Fixed memory leak in the zlib shim library.

++++ jfrog-cli:

  - Update to version 2.112.0:
    * New Features
  - [jfrog-cli-security] XRAY-145721 - Added fallback logic for
    Poetry #783 (@Phavya-jfrog)
    * Bug Fixes
  - [jfrog-cli] Fix ghost frog install to honour default ModePass
    tools #3579 (@ehl-jf)
  - [jfrog-cli-security] Fix - Gradle dep tree references missing
    output files #791 (@attiasas)
    * Internal Changes
  - [jfrog-cli-security] Update Xray lib plugin default version
    to 1.4.0 #788 (@attiasas)
  - [jfrog-cli-security] Update dependencies #792 (@attiasas)
    * Other Changes
  - [jfrog-cli-artifactory] XRAY-139364 - Automatically set VSC
    properties from local git on uploaded artifacts #484
    (@attiasas)
  - [jfrog-cli-security] XRAY-144147 Support Yarn v4 for curation
    audit #778 (@gauriy-tech)
    * Dependencies
  - Bump actions/checkout in the github-actions group across 1
    directory (#3564)
  - Bump github.com/moby/moby/api in the go group across 1
    directory (#3570)

++++ jline3:

  - Update to upstream version 3.30.15
    * Security Fixes
    + fix: guard regex matching against catastrophic backtracking
    (ReDoS) (#2018, backport of #2012)
    ° Adds SafeRegex utility with TimeoutCharSequence to enforce
    wall-clock deadlines during regex matching
    ° Fixes 8 locations across terminal, reader, and builtins
    where user-controlled input could trigger catastrophic
    backtracking
    ° Addresses GHSA-r2xf-8xr9-62gw, GHSA-2v9w-34q6-wpqx,
    GHSA-ph9c-7hw9-vhhw, GHSA-5q95-hrpc-m3w3
    + fix: backport security hardening (#1986, #1995)
    ° Create persisted history file with owner-only permissions
    ° Use exclusive create for extracted native library temp files
    * Bug Fixes
    + fix: warn on insecure permissions when history file created
    concurrently
    * Dependency Updates
    + chore: bump eu.maveniverse.maven.njord:extension3 from 0.9.8
    to 0.9.9 (#1999)
    + chore: bump com.palantir.javaformat:palantir-java-format
    (#1991)
    + chore: bump actions/cache from 5 to 6 (#1989)
  - Modified patch:
    * 0001-Remove-optional-dependency-on-universalchardet.patch
    + rebase

++++ k0sctl:

  - Update to version 0.31.1:
    * Bump github.com/k0sproject/rig from 0.21.10 to 0.21.11 (#1107)
    * fix: normalize k0s node names before maintenance (#1095)
    * Bump actions/checkout from 6 to 7 (#1105)

++++ k6:

  - Update to version 2.1.0:
    * This release includes:
  - An opt-in feature-flag system — --features, the K6_FEATURES
    environment variable, and a k6 features discovery command —
    shipping with experimental native histograms for trend
    metrics as its first flag.
  - A context-level proxy option for browser contexts.
  - Subcommand discovery in k6 x, so binaries can report which
    extension commands they expose.
    * Breaking changes
  - There are no breaking changes in this release.
    * New features
  - k6 cloud test list command #6007
    A new k6 cloud test command group has been added, with a k6
    cloud test list subcommand that lists the load tests of a
    Grafana Cloud k6 project. It complements the k6 cloud project
    list command introduced in v2.0.0.
    The project to list tests for is resolved in the following
    order:
  - The --project-id flag.
  - The K6_CLOUD_PROJECT_ID environment variable (cloud config
    projectID).
  - The default project of the configured stack, populated by
    k6 cloud login.
    Output defaults to a human-readable table. Pass --json to
    emit a JSON array instead, mirroring the format established
    by k6 cloud project list.
    k6 cloud test list
    k6 cloud test list --project-id 12345
    k6 cloud test list --json
  - Feature flags and experimental native histograms #6055, #6056
    k6 now has an opt-in feature-flag mechanism for trialing new,
    not-yet-stable behavior without affecting existing runs.
    Flags can be enabled on k6 run and k6 cloud run through the
  - -features flag (comma-separated or repeated), the
    K6_FEATURES environment variable, or the features key in
    config.json. Enabled flags are surfaced as metric tags and
    propagated into archives and cloud workers so a run behaves
    consistently wherever it executes.
    Use k6 features (or k6 features --json) to discover the
    available flags and their lifecycle:
    $ k6 features
    FEATURE             LIFECYCLE      DESCRIPTION
    native-histograms   Experimental   Use native histograms for trend metrics
    The first flag shipped is native-histograms, an experimental
    flag that makes k6 use native histograms for trend metrics:
    k6 run --features native-histograms script.js
    [#] or
    K6_FEATURES=native-histograms k6 run script.js
  - Subcommand discovery in k6 x #5972
    Running k6 x now lists the available subcommands — both the
    ones baked into the binary and those advertised by the
    extension registry (official and community). Tab-completion
    surfaces the same set once the catalog has been cached
    locally by a prior k6 x run, so completion never blocks on
    the network.
    $ k6 x
    ...
    Available Commands:
    agent       Bootstrap an AI-assisted k6 testing workflow in any editor
    docs        CLI k6 docs for AI agents and users
    explore     Explore k6 extensions for Automatic Resolution
    mcp         An MCP server for k6 for AI agents
    This makes a k6 binary self-describing — particularly useful
    for AI agents driving k6, which previously had no way to
    introspect which extension subcommands were available.
  - Browser context proxy option #5924
    Browser contexts can now be configured with a context-level
    proxy option, letting you route a context's traffic through a
    proxy without launching a custom-built binary or relying on
    environment proxy variables (which only affected k6's
    DevTools WebSocket connection). The option is wired to
    Chromium through Target.createBrowserContext, and invalid
    proxy configuration now fails early when proxy.server is
    missing. Thanks, @nightt5879!
    const context = await browser.newContext({
    proxy: {
    server: 'http://proxy.test:8080',
    bypass: 'localhost,127.0.0.1',
    },
    });
  - Browser locator.isInViewport() #6023
    A new locator.isInViewport() method reports whether an
    element intersects the browser viewport. It accepts an
    optional ratio (0 to 1) that sets how much of the element
    must be visible, defaulting to 0 so any visible pixel counts,
    matching Playwright's toBeInViewport semantics. The call
    waits for the element to attach, honoring the timeout option,
    then measures the intersection once. Thanks, @Anuragp22!
    const button = page.locator('button#submit');
    if (await button.isInViewport()) {
    await button.click();
    }
  - Basic auth for the OpenTelemetry HTTP exporter #5997
    The OpenTelemetry output's HTTP exporter can now send HTTP
    Basic Auth credentials. Set them through the
    K6_OTEL_HTTP_EXPORTER_USERNAME and
    K6_OTEL_HTTP_EXPORTER_PASSWORD environment variables, or the
    username and password keys in the output config.
    K6_OTEL_HTTP_EXPORTER_USERNAME=user \
    K6_OTEL_HTTP_EXPORTER_PASSWORD=secret \
    k6 run --out opentelemetry script.js
  - single() selection helper in k6/html #6002
    Selection.single(selector) returns at most one matching
    element, backed by goquery's Single matcher for a faster
    lookup than find() when you only need the first match.
    import { parseHTML } from 'k6/html';
    const doc = parseHTML(content);
    const title = doc.single('h1').text();
    * UX improvements and enhancements
  - #5971 Tags browser API failures with module=browser so that
    browser errors surfaced in Grafana Cloud Logs can be filtered
    separately from other log sources.
    * Bug fixes
  - #5794 Makes the --vus flag work as a standalone execution
    shortcut instead of being silently ignored when a script
    defines scenarios. Running k6 run script.js --vus N now
    creates a shared-iterations scenario with N VUs and N
    iterations, overriding any script-defined scenarios with a
    warning — consistent with how --iterations, --duration, and
  - -stages already behave. Thanks, @Reranko05!
  - #6013 Rejects invalid threshold percentiles. A percentile
    aggregation value outside the 0 to 100 range (or NaN) now
    fails parsing with a clear message instead of being silently
    accepted. Thanks, @immanuwell!
  - #6011 Writes the on-disk k6 config file with owner-only
    permissions (0o600, inside a 0o700 directory). The file can
    hold the Grafana Cloud API token (collectors.cloud.token), so
    tightening it keeps other local users on shared hosts (CI
    runners, multi-user boxes, sidecar containers) from reading
    the token. Existing configs are upgraded on the next write,
    for example the next k6 cloud login.
    * Maintenance and internal improvements
  - #6033 Moves Docker Hub image publishing to a Google Artifact
    Registry mirror.
  - #5953 Installs s3cmd via apt instead of pip to fix the
    k6packager image build.
  - #6052 Fixes the browser end-to-end test workflow.
  - #5984 Routes per-test logger output to the test instance
    instead of the global logrus, improving test isolation.
  - #5985 Fixes the flaky TestPageScreenshotFullpage browser
    test.
  - #5981 Lets Renovate track the Go minor version in the
    setup-go workflows.
  - #5968 Honors the caller-pinned ref in the shared lint action.
  - #6041, #6054 Aligns the Go module directive and toolchain
    (1.25.0 / 1.25.11).
  - #5967 Updates the release notes template after v2.0.0.
  - #6015 Updates golang.org/x/net to v0.55.0 [security].
  - #6026 Updates golang.org/x/crypto to v0.52.0 [security].
  - #5962, #6028 Updates google.golang.org/grpc to v1.81.1.
  - #5960 Updates grafana/shared-workflows/get-vault-secrets to
    v1.3.2.
  - #5958 Updates grafana/shared-workflows/azure-trusted-signing
    to v1.0.2.
  - #5957 Updates github/codeql-action to v4.35.4.
  - #5959 Updates grafana/shared-workflows/dockerhub-login to
    v1.0.4.
  - #6009 Moves the browser PageScreenshotOptions parsing into
    the mapping layer.
  - #5964 Adds the k6 feature-flags specification under
    openspec/.
  - #6067 Forces the legacy x/net/http2 implementation on the
    gotip CI test job.
  - #6065 Lets Renovate update the Dockerfile on the v1.x branch.
  - #6031 Updates go.opentelemetry.io/otel to v1.44.0.
  - #6086 Updates golang.org/x dependencies (crypto to v0.53.0,
    net to v0.56.0, term to v0.44.0).
  - #6061 Updates golang.org/x/sync to v0.21.0.
  - #6030 Updates github.com/tidwall/gjson to v1.19.0.
  - #6029 Updates github.com/mccutchen/go-httpbin/v2 to v2.23.0.
  - #6063 Updates github.com/mattn/go-colorable to v0.1.15.
  - #6062 Updates the Golang Docker image to 1.26.4.
  - #6084 Updates the Alpine Docker image to 3.24.0.
  - #6027 Updates the Debian Docker image to trixie-20260518.

++++ kargo-cli:

  - Update to version 1.10.8:
    no CLI-related changes or dependency updates

++++ kquickimageeditor6:

  - Udpate to 0.6.2.1
    * Fix a crash caused by lack of ARGB32 support when built with
    OpenCV

++++ ksystemstats6:

  - Prepare for CAP_PERFMON on ksystemstats_intel_helper
  - Add patch for hardening (boo#1262779):
    * 0001-Guard-ksystemstats_intel_helper-against-path-travers.patch
  - Remove workaroud for Leap 16, works meanwhile

++++ kubectl-cnpg:

  - Update to version 1.29.2:
    * Important changes
  - Updated the deprecation notice for native (in-tree) Barman
    Cloud support to reflect that it will now be removed in
    CloudNativePG 1.31.0, rather than 1.30.0. Users are still
    encouraged to migrate to the Barman Cloud Plugin. (#11083)
  - The cluster reference is now immutable on the Database,
    Pooler, Publication, Subscription, and ScheduledBackup
    resources. Pointing one of these objects at a different
    cluster has no well-defined semantics and previously left the
    controllers in an inconsistent state; the update is now
    rejected at the API server via a CEL validation rule.
    (#10743)
    * Enhancements
  - Enabled pg_upgrade in-place major upgrades to PostgreSQL 19
    or later for clusters that use Image Volume extensions,
    building on the extension-path support added to pg_upgrade in
    PostgreSQL 19. During the upgrade Job, the source- and
    target-version extension images are mounted side by side, so
    the old server keeps its libraries and a failed upgrade
    reverts cleanly. (#10366)
  - Added a label selector to the Cluster scale subresource
    (status.selector), making a Cluster a valid targetRef for the
    Vertical Pod Autoscaler (VPA) and Horizontal Pod Autoscaler
    (HPA), which can now map a Cluster to its instance pods.
    Contributed by @sebv004. (#8996)
  - The operator now emits a Warning PrimaryStatusCheckFailed
    event on the Cluster when the primary pod is Ready from the
    kubelet perspective but the operator's /pg/status check fails
    and failover is deferred, giving users visibility into the
    deferral via kubectl describe cluster. (#10509)
  - The operator now reloads a CNPG-i plugin automatically when
    its pods are rolled: it watches the EndpointSlices backing
    plugin Services and re-enqueues every cluster using the
    plugin once the new pods become Ready, so an upgraded plugin
    is picked up without waiting for the next resync. (#10836)
    * Security and Supply Chain
  - CVE-2026-55769 / GHSA-x8c2-3p4r-v9r6: search_path pinning on
    operator-issued connections: a database owner could plant
    overloaded built-in operators in the public schema and alter
    the search_path so that operator introspection probes,
    running as the cluster superuser, resolved those overloads
    before pg_catalog, a CWE-426 privilege-escalation chain (same
    class as CVE-2018-1058) that could lead to in-pod RCE via
    COPY ... FROM PROGRAM. The operator now pins search_path =
    pg_catalog, public, pg_temp on every pooled connection so it
    ships in the startup message and takes precedence over
    tenant-controlled defaults. (#10774, GHSA-x8c2-3p4r-v9r6)
  - CVE-2026-55765 / GHSA-w3gf-xc94-wvmj: operator-side
    SCRAM-SHA-256 password encoding: the operator now
    SCRAM-SHA-256 encodes cleartext role passwords before issuing
    CREATE/ALTER ROLE ... PASSWORD, so the literal PostgreSQL
    parses (and that extensions such as pg_stat_statements or
    pgaudit may capture) is the SCRAM verifier rather than the
    cleartext secret. Pre-hashed (MD5 or SCRAM) values are
    forwarded unchanged, and the per-Secret annotation
    cnpg.io/passwordPassthrough: "enabled" opts out. (#10724,
    GHSA-w3gf-xc94-wvmj)
    * Changes
  - Added support for Kubernetes 1.36. (#10900)
  - Updated the default PostgreSQL version to 18.4. (#10719)
  - Updated the Kubernetes versions used to test the operator on
    public cloud providers. (#10720, #10563, #11033)
    * Fixes - cnpg plugin:
  - Fixed kubectl cnpg psql on Windows, where execution relied on
    a Unix-only system call and failed with "not supported by
    windows"; Windows now launches kubectl exec as a child
    process. Contributed by @Utkarsh-sharma47. (#10972)
  - Fixed an unbounded memory leak in kubectl cnpg logs -f on
    busy clusters, where a per-log-group timer was never
    released; timers are now reused across iterations.
    Contributed by @Anand-240. (#10976)

++++ kubernetes1.35:

  - Update to version 1.35.6:
    * Bump images and versions to go 1.25.11 and distroless iptables
    * kubeadm: fix dry-run CA copy paths in init certs
    * Fix DRA scoring bug with mixed allocated and unallocated claims
    * fix(endpoint): avoid panic on services with empty IPFamilies
    * fix(csi): preserve mount dir on NodePublish error during remount
    * feat(volume): add IsRemount to MounterArgs
    * Restore ability to plumb binary data through envvar values
    * Cache selinux conflicts
    * controller/selinuxwarning/cache: Add reverse index
    * controller/selinuxwarning: Pre-parse SELinux label
    * DRA: fix AllocationModeAll with consumed counters

++++ kubernetes1.36:

  - Update to version 1.36.2:
    * Bump images and versions to go 1.26.4 and distroless iptables
    * DRA E2E: simplify kind.yaml
    * kubeadm: fix dry-run CA copy paths in init certs
    * Fix DRA scoring bug with mixed allocated and unallocated claims
    * batch/job: Fix scheduling directives mutation for not-yet-started suspended Jobs
    * fix(endpoint): avoid panic on services with empty IPFamilies
    * fix(csi): preserve mount dir on NodePublish error during remount
    * feat(volume): add IsRemount to MounterArgs
    * DRA: account for shared devices when rebuilding counters
    * Restore ability to plumb binary data through envvar values
    * Only emit non-dupicated values as metrics
    * Optimize how deletions are handled
    * Improve performance characteristic of selinux metric emission
    * DRA: fix AllocationModeAll with consumed counters

++++ kubescape:

  - Update to version 4.0.10:
    * feat(httphandler): add SSRF-hardened scan-completion webhook
    callback (#2447)
    * feat(operator): add `operator remediate` CLI subcommand
    (annotate + dry-run) (#2448)
    * Add CEL evaluator (#2443)
    * feat(reportcrypto): decrypt resource source metadata in reports
    (#2440)
    * fix(coverage) : penalise silent failed GVR pulls in coverage
    score (#2420)
    * Add offline request stub for the CEL engine (#2439)
    * fix(diff): validate format input and clean up status handling
    (#2438)
    * test: add missing unit tests for cautils session initialization
    and scan scope (#2436)
    * feat(report): add encrypted report decryption (#2425)
    * fix(diff): move --fail-on-new exit to cmd layer so output
    writer is closed (#2434)

++++ lact:

  - Added prevent-strip.patch to stop stripping binaries after compilation
  - Added fix-clang-args.patch to fix lact-daemon build

++++ lact-headless:

  - Added prevent-strip.patch to stop stripping binaries after compilation
  - Added fix-clang-args.patch to fix lact-daemon build

++++ languagetool:

  - Use the jline3 bundle jar to make an eventual upgrade of jline3
    easier

++++ libfsxfs:

  - Update to release 20260701
    * FUSE3 support
    * Updates to documentation, manpages and command line utility
    help texts

++++ libfwevt:

  - Update to release 20260701
    * The testsuite was updated

++++ lkl:

  - Merge opensuse-kernel/SLE15-SP6-LTSS d6d8d8ea6026f7

++++ miniz:

  - Updat eto version 3.1.2
    * Fix central directory offset overflow when reading zip file
    header.
    * Add tdefl_write_image_to_png_file_in_memory_ex parameter
    validation.
    * Add fuzz targets for ZIP validation, writing, and compression
    APIs.
    * Support cmake4.
    * Guard against code_len==0 infinite loop in tinfl_decompress.

++++ onnxruntime:

  - Update to version 1.27.0:
    * [CUDA] Optimize QMoE SoftmaxTopK router for small-batch decode (#29026)
    * fix: NodeJS pkging stage needs to use CFS (#29007)
    * Disable OrtEp::ort_version_supported sanity check to work around EPs that don't set it correctly. (#28960)
    * 1.27.0 - cherry pick 2 (#28900)
    * 1.27.0 - cherry pick 1 (#28817)
    * Switch NPM publishing to consume from CUDA 13 pipeline (#28773) (#28792)
    * Skip SetupDi device discovery if Win32k system calls are disabled (#28535)
    * fix(quantization): validate bias scale in QDQ Conv → QLinearConv fusion (#28229)
    * Use abseil for readable POSIX stack traces in debug builds (#28405)
    * feat(quantization): add opset-21 block_size attribute to QDQ (#28522)
    * fix: preserve Q/DQ around Resize when mode is linear or cubic (#28414)
    * Fix PRelu returning NaN for infinite inputs on CPU EP (#28750)
    * [MLAS][KleidiAI] Apply fp16 split independent fixes (#28720)
    * Zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#28037)
    * [CoreML EP] Add GatherND builder (#28598)
    * Fix ARM CPUIDInfo bounds handling for unknown CPU vendors (#28344)
    * Honor disable_synchronize_execution_providers for CUDA graph replay (#28686)
    * [MLAS] Fix MatMulNBits CPU LUT GEMM path to apply optional bias (#28742)
    * [WebGPU] Support models with opset 24 ops and KV-shared decoder layers (Gemma 4) (#28501)
    * Add LpNormalization support for CUDA Execution Provider (#28724)
    * Unify path validation in EPs, address security gaps (#28725)
    * Add boundary checks for input validation (#28747)
    * [CoreML EP] Support bool Cast in ML Program (#28595)
    * [CUDA] Add QMoE tests for standard swiglu and update doc (#28741)
    * Add Implicit inputs for conditional nodes branches part of node fusio… (#28690)
    * Fix CUDA 13 nuget packaging pipeline failures and enable CUDA 13.3 builds (#28736)
    * [CUDA] Chunked dequant+GEMM in MatMulNBits to reduce peak GPU memory for large N (#28712)
    * Fix IsInfTest (T4 GPU does not support BF16) (#28727)
    * [CUDA Plugin EP] Add provider options: user_compute_stream, do_copy_in_default_stream, use_ep_level_unified_stream, external allocator (#28603)
    * [NvTensorRTRTX EP] Skip GPU JIT during compile-only sessions (#28503)
    * Bump tmp from 0.2.5 to 0.2.7 in /js/web (#28694)
    * Bump tmp from 0.2.4 to 0.2.6 in /onnxruntime/test/wasm (#28683)
    * Bump qs and body-parser in /onnxruntime/test/wasm (#28644)
    * Fix CPU QLinearConv: support per-channel weight zero points with distinct values (#28456)
    * Build onnxruntime with training, training_apis, tests and gcc-15 (#27191)
    * Update microsoft_gsl from v4.0.0 to v4.2.1 (fixes C4875 deprecation) (#28527)
    * Introduce checks to prevent buffer overflow, add tests (#28713)
    * CUDA Plugin EP: NHWC Cleanup & Hardening (#28612)
    * Add explicit CUDA version suffix to GPU release artifacts (#28691)
    * Update CUDA 12.8 to 13.0 in CI workflows (#28458)
    * Add `tools/python/compile_contributors.py` `--paths` option (#28710)
    * Flash Attention style tiled computation for CPU GQA quantized KV cache (#28695)
    * Address external path references in loaded models (#28709)
    * fix(partitioning_utils): include Loop/If/Scan implicit inputs in MetaDef (#28608)
    * fix(quantization): emit axis on DequantizeLinear for per-channel dynamic quantization (#28228)
    * Replace direct inclusion of <cub/cub.cuh> with "core/providers/cuda/cu_inc/cub.cuh" wrapper. (#28705)
    * [WebGPU EP] Add environment variable to dump shader code to a file, move shader key validation to nightly build (#28674)
    * Address CUDA ReduceL2 negative results and add test coverage (#28681)
    * [WebGPU] QKV and MLP layer fusions for Qwen3-style models (#28280)
    * Update protobuf version to 6.33.5 (#28684)
    * [webgpu] Per-graph buffer manager for WebGPU multi-graph capture (#28260)
    * Update GQA op schema (#28689)
    * Use fp32 accumulation in SkipLayerNorm/EmbedLayerNorm CUDA kernels (#28682)
    * [WebGPU plugin EP] Enforce minimum ORT version specified by `plugin-ep-webgpu/MIN_ONNXRUNTIME_VERSION` (#28687)
    * Guard removed APIs in TRT 11 (#28611)
    * [CoreML EP] Add Sin and Cos unary ops (#28596)
    * Speed up CUDA CI build: split into per-arch OBJECT libraries, add --flash_nvcc_threads, and enable quick build mode (#28645)
    * Propagate outer scope type info to subgraphs during verification (#27707)
    * Fix CUTLASS FMHA BiasLoader alignment for unaligned kernel path (#28369)
    * remove some webgpu ci tasks to speedup ci (#28642)
    * Check weight shape dimensions in ConvTranspose shape inference msrc116345 (#28524)
    * Add --test_parallel to reduce CTest concurrency for ASan builds (#28675)
    * Fix plugin EP test failure when host ORT lacks newer data types (#28659)
    * lstm support for webgpu (#27881)
    * rev some npm packages (#28547)
    * Update GatherBlockQuantized to support 2-bits (#28530)
    * Raise protobuf minimum version in Python requirements (#28558)
    * [Annotations] Address cuda orginal matching (#28623)
    * Optimize MatMulNBits 2-bit + float zero_point CPU dequantization with multi-threaded kernel (#28589)
    * Fix Erf NaN preservation on x86_64 FMA3 path (#28615)
    * Additional diagnostics for DML failure path (#28495)
    * Add example and documentation for kOrtEpDevice_EpMetadataKey_OSDriverVersion (#28282)
    * [MLAS] RVV-Optimized LLM Operators for RISC-V (#28518)
    * Fix: Accept 'CPU' as a valid provider name in SessionOptionsAppendExecutionProvider (#28625)
    * Fix Reshape with allowzero=1 producing wrong shape for zero-size tensor in chained Reshape (#28455)
    * [WebGPU] LinearAttention: increase tile_v when subgroups are available (#28519)
    * fix(qdq): skip DQ forward propagation when DQ input is constant (#28521)
    * Optimize MLAS quantized KV-cache GEMM kernels (follow-up to #28578) (#28606)
    * Fix CUDA build with contrib ops disabled (#28554)
    * QMoE CUDA: input validation, prepack cleanups, and packaging pipeline fix (#28607)
    * [NVEP]: fix test for multi-gpu situation (#27837)
    * Parallelize CPU ScatterElements kernel via ThreadPool (#28588)
    * Validate seqlens_k against cos_cache bounds in GroupQueryAttention to… (#28277)
    * Add component governance manifest for WebGPU EP (#28599)
    * [CoreML EP] Support Gather with scalar 'indices' (#28278)
    * Validate conv bias shape in WordConvEmbedding to prevent OOB read (#28279)
    * Fix oob bias access for MatMulIntegerToFloat and DynamicQuantizeMatMul (#28499)
    * [WebGPU plugin EP] Add Win ARM64 Python package (#28526)
    * Address MaxUnpool shortcomings msrc116345 (#28550)
    * Move `OrtEp` sanity checks to plugin EP creation and remove check for `OrtEp::ort_version_supported` upper bound (#28601)
    * Fix Whisper genai_config context_length using wrong config attribute (#28600)
    * QMoE CUDA: Rename build options, refactor PrePack, add GPU kernels (#28583)
    * CPU GroupQueryAttention: Quantized KV Cache with SIMD-optimized MLAS kernels (#28578)
    * Fail loudly when MatMulNBits receives unsupported block_size on CPU EP (#28590)
    * feat(orttraining): add CPU fallback for FusedAdam optimizer (#28233)
    * fix: propagate output_dtype attribute when inserting Q after DQ (#28144)
    * fix: guard ORT_USE_CPUINFO on __linux__ to fix FreeBSD build (#28362)
    * Fix EpGraphAssignmentInfo missing issue on nodes assigned to CPU-EP by InsertCastTransformer (#28268)
    * [CoreML EP] Add Identity, Ceil, Tile builders + drop trivial-only partitions (#28293)
    * Add linux-arm64 binaries to the foundry nuget package (#28579)
    * Derive ORT_TEST_VERBOSE from System.Debug via runtime coalesce in plugin test pipelines (#28517)
    * Add quantized KV cache support in CPU GroupQueryAttention (#28576)
    * add more ORT_ENFORCE when building the tree structure of TreeEnsemble operators (#27677)
    * QMoE CUDA EP — FP4/FP8/WFP4AFP8 Quantized Mixture-of-Experts + MoE GEMM Refactor (#28467)
    * [MLAS] Correcting Compilation Errors: onnxruntime/onnxruntime/core/mlas/lib/riscv64/sconv_depthwise_kernel_rvv.cpp:138:18: error: unused variable 'pad_bottom' (#28506)
    * Fix Cargo registry auth for network-isolated Linux Python wheel builds (#28556)
    * Fix protoc error when cross compiling on a linux aarch64 host (#28567)
    * Add EP and hardware device type to Windows ML telemetry (#28477)
    * [MLAS] test: accept canonical NaN in activation NaN round-trip check (#28538)
    * Validate sparse tensor external file paths (#28408)
    * Fix XNNPACK Gemm SIGSEGV on missing and scalar 'C' bias (#28546)
    * Fix int32 overflow in CUDA Cast and UnaryElementWise kernels for tensors with >2^31 elements (#28386)
    * [Security] Validate CPU cache_indirection beam indices (#28486)
    * Skip file path validation in CreateEpContextModel when the output is not a file (#28431)
    * Add unit test for fix of plugin EP library handle leak in PR 28396 (#28430)
    * Support kquant mixed for whisper export (#28515)
    * contrib: add mask/input shape consistency checks in MaxpoolWithMask::Compute (#28223)
    * Reject recursive local function definitions during model load (#28187)
    * [WebGPU plugin EP] Package improvements (#28525)
    * webgpu: Generalize FlashAttention prefill shared-memory path (#28520)
    * fix: avoid vector copies in CheckIfSubtreesAreEqual (#27854)
    * Fix Inverse kernel rank underflow before indexing trailing dims (#28400)
    * [MLAS] Fix scratch buffer over-allocation in batched/grouped NCHW Conv (#28482)
    * Fix mlasi_sve.h preprocessor guards to allow clang compilation (#28507)
    * [QNN EP] ETW log level rule change (#27593)
    * Fix input validation and null-pointer dereference in STFTDecomposition graph transformer (#28465)
    * Fix WeaklyCanonicalPath ERROR_ACCESS_DENIED in Windows AppContainers (#28509)
    * Build issues on AIX for POWER10 and POWER11 (#26704)
    * Fill LSTM CUDA operator opset gap: extend coverage from opset 14 to opset 22 (#27737)
    * Validate per-column weight_scale/weight_zero_point shape in CPU QAttention; harden integer arithmetic in QAttention and AttentionBase (#28480)
    * enable dynamic max_k_step in FA for nvidia (#28511)
    * [MLAS] Add an NHWC implementation of convolution to avoid transposes (#26834)
    * Improve error reporting for pre-allocated outputs with a wrong shape (#28481)
    * fix(security): add SafeInt overflow protection in Expand and constant folding output size limit (#28055)
    * fix: support N-D weights with unit leading dims in MatMulNBitsQuantizer (#28178)
    * Fix out-of-bounds read in CropBase: validate scale attribute length (#28399)
    * CUDA Plugin Packaging Pipeline Fix TSAUpload and Timeout (#28497)
    * fix: auto-upgrade model opset to 21 for int16/uint16 QDQ quantization (#28202)
    * Bump next from 16.1.5 to 16.1.7 in /js/web/test/e2e/exports/testcases/nextjs-default (#27705)
    * Address string attribute issue (#28494)
    * Optimize FlashAttention for M4 Max (20x speedup) (#27780)
    * Address latent bug in LabelEncoder (#28496)
    * Fill opset gap for RandomNormal, RandomNormalLike, RandomUniform, RandomUniformLike CUDA ops with BFloat16 support (#27759)
    * Fixes for unicode path handling (#28390)
    * Add float zero point support for 2-bit LUT GEMM in MatMulNBits (#28354)
    * Bound total output allocation size in Tile kernel (#28070)
    * Fix OOB reads in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
    * Use weights_only=True for remaining torch.load() calls (#28421)
    * Add LabelEncoder_4 fast path for session creation (#27526)
    * Add RVV (RISC-V Vector Extension) optimized convolution and pooling kernels for the NCHWc blocked format in MLAS (#28411)
    * Address Resize kernel shortcomings (#28402)
    * [webgpu] Optimize LinearAttention Op with subgroup (#28412)
    * Fill CUDA EP opset gap for Sin and Cos operators (7→22) (#27756)
    * Use symbol file to export symbols in onnxruntime library on AIX platform as well (#28016)
    * [WebGPU] Correct MatMul bias input indexing in `MatMul::ComputeInternal` (#28475)
    * fix: skip DQ->MatMulNBits fusion when weight/scale initializer is shared (#28326)
    * [WebGPU] Fix SkipSimplifiedLayerNormalization bias (#28427)
    * Add CPU QMoE 2-bit support and LUT GEMM fast path (#28185)
    * [ Cuda] ConvTranspose-22 (#27710)
    * Fix sigmoid transformation in TreeEnsembleClassifier for all-positive weights with LOGISTIC post_transform (#27536)
    * Enable QuickGeluFusion on WebGPU EP and fix fp16 shader (#28410)
    * Fix runtime-unresolvable type annotations in Session and InferenceSession (#27802)
    * Add DiT attention fusion for F5-TTS and diffusion transformer models (#27999)
    * Add CPU Cast op support for Float8E8M0 (#28435)
    * [CUDA] PagedAttention: use exact max_query_len on FA path (#28409)
    * [GQA] Make present_key/present_value outputs optional and add Gemma4 support (#28242)
    * Validate NodeArg creation (#28429)
    * Fix CUDA plugin EP test pipeline (#28453)
    * Address tokenizer shortcomings (#28428)
    * Fix Clang + libc++ compilation and portability issues (#28049)
    * Handle empty initializers gracefully in optimizer passes (#27976)
    * [WebGPU Plugin EP] Packaging pipelines minor updates (#28460)
    * Harden OneHot operator input validation and output size computation (#28014)
    * Remove data hash from hashing code, to prevent unbounded growth issue (#28363)
    * Don't pin SelectorActionTransformer replacement nodes to CPU (#28288)
    * [WebGPU] Fix numerical stability issue in QMoE op (#28434)
    * feat(quantization): add ActivationRestrictedAsymmetric option (#28237)
    * Fix session use-after-free when UserLoggingFunction is used (#28314)
    * Fix CrossEntropyLoss block to support multi-output models (#28232)
    * Add PEP 561 `py.typed` marker to the `onnxruntime` package (#28438)
    * Add FLOAT8E8M0 data type support in ONNX Runtime (#28381)
    * [CoreML EP] Add FusedConv support (#28289)
    * Fix loader-refcount leak in ProviderLibrary::Load on GetProvider miss (#28396)
    * Fix CUDA plugin EP packaging test pipeline: host network and add cudnn to path (#28373)
    * Fix dangling pointer of temporary return value (#28419)
    * Remove Universal Package publishing from plugin EP packaging pipelines. (#28418)
    * [Plugin EP] Session options getters (#28377)
    * [C#] Add EP tests for Cuda Plugin (#28375)
    * [CUDA Plugin EP] Add NuGet packaging pipeline (#28378)
    * Fix CPU Attention softcap/attn_mask ordering (onnx#7867, #7913) + consolidate CUDA spec coverage tests from #28371 (#28379)
    * Suppress test warnings in transformers tests and fix CUDA CI (#28391)
    * Fix Subgraph_t issues with TRT RTX ver 1.5.x (#28361)
    * [WebGPU plugin EP packaging] Remove explicit ORT package dependency (#28384)
    * feat(quantization): add calibration cache to quantize_static (#28221)
    * Refactor and modernize StringNormalizer. (#28320)
    * [Plugin EP] Add OrtEp::OnSessionInitializationEnd() (#28319)
    * [CoreML EP] Support pre-opset-13 Split via 'split' attribute (#28270)
    * Add M-tile loop with dispatch capping for Intel Xe2/3-LPG (#28250)
    * Prevent double-free in OrtModelEditorApi ownership transfer (#28123)
    * webgpu: Support QKV bias in FlashAttention for MultiHeadAttention (#28380)
    * Fill CUDA EP opset gaps for Round and Equal operators (#27754)
    * Bump brace-expansion in /js/react_native/e2e (#27894)
    * Fill Reshape CUDA operator opset gap from 23 to 25 (#27742)
    * Fill RNN CUDA operator opset gap (14 → 22) (#27743)
    * Fill CUDA opset gap for ReduceMax and ReduceMin (18 → 20) (#27755)
    * Fill CUDA Cast operator opset gap: extend registration from opset 23 to 25 (#27744)
    * [WebGPU plugin EP] NuGet packaging (#28313)
    * Add CUDA plugin EP Python package pipeline (#28299)
    * Fix round_prefer_ceil nearest mode for negative halfway values in Resize op (#28345)
    * fix(ci): 'rc' qualifier ignored when packaging `onnxruntime-node` (#28350)
    * Bump postcss from 8.5.3 to 8.5.13 in /js/web/test/e2e/exports/testcases/vite-default (#28304)
    * Fix CApi tests on S390x (#28074)
    * Fix CUDA Attention dispatch: skip MEA when head_size != v_head_size in GQA (#28358)
    * chore: rename `ort_api_1_to_26` to `ort_api_1_to_27` (#28341)
    * fix(ci): test pipeline didn't correctly specify `ReleaseVersionSuffix` (#28346)
    * fix: make sympy an optional runtime dependency (#28141)
    * Fix ReshapeFusion dropping allowzero on inferred 0-sized intermediate dims (#28349)
    * Suppress -Wmaybe-uninitialized for onnxruntime_pybind11_state under pybind11 3.0 (#28251)
    * adds foundry local packaging to webgpu plugin ep packaging pipeline (#28300)
    * Fix BitShift UB when shift amount >= bit width (#28272)
    * Eliminate Legacy MHA Unfused path from ONNX Attention; unify on 3-tier dispatch with causal alignment fix (#27992)
    * Add plugin-ep-webgpu/RELEASE.md (#28321)
    * refactor(ci): simplify build date/time metadata propagation (#28294)
    * Bump plugin-ep-webgpu/VERSION_NUMBER to 0.2.0. (#28322)
    * Bump version for 1.27.0 (#28324)
    * Support ONNX overloaded functions (IR version 10+) (#28275)
    * docs: add opset version notation legend to OperatorKernels.md (#28143)
    * Add option to memory map .ORT model loads (#28164)
    * add support for DFT with onesided=True and inverse=True (irfft) (#27028)
  - Move bundled() provides (date, onnx, SafeInt; eigen3 on Leap/SLE)
    from the main preamble into the libonnxruntime1 and python3XX-
    onnxruntime subpackages, so they ship on the built binaries (no
    standalone onnxruntime package is produced) and are found by
    bundled-library tracking.

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1085
  - provide functions for mkfs and tune options using vector of
    strings
  - use string_view to reduce number of functions
  - 4.5.337

++++ libvirt:

  - Update to libvirt 12.5.0
  - bsc#1268382
  - Many incremental improvements and bug fixes, see
    https://libvirt.org/news.html#v12-5-0-2026-07-01

++++ maven4:

  - Added patch:
    * jline-4.1.x.patch
    + implements a new interface funcion added in jline3 4.1.0
    + applied if the jline3 version is >= 4.1
    + allows upgrading to jline3 versions >= 4.1 if needed

++++ mchange-commons:

  - Update to 0.6.1
    * No structured changelog provided by upstream
    * needed by c3p0 0.14.0 that contains security fixes

++++ melange:

  - Update to version 0.55.0:
    * fix(build): make MutateWith deterministic for forwarded inputs
    (#2577)
    * feat: pipelines: split/dev: Add prefix input (#2574)
    * feat: pipelines: autoconf: Add targets input for make and
    make-install (#2573)

++++ mesheryctl:

  - update to 1.0.50:
    * General
  - Remove premature maintainer assignment @alexquincy (#20337)
  - Delete scripts directory @winkletinkle (#20322)
  - [Server] Sync wasm module to meshkit v1.0.19 (fix Build image
    CI) @marblom007 (#20318)
  - Delete server/meshmodel directory @pontusringblom (#20315)
  - Bump launch-editor from 2.12.0 to 2.14.1 in
    /install/docker-extension/ui @dependabot[bot] (#20104)
  - feat(model): add AWS VPC core relationship definitions
    @Junnygram (#20274)
  - [Models] added relationships for aws-mq-controller
    @YASHMAHAKAL (#17656)
  - added 4 relationships for aws-node-termination-handler-2
    @YASHMAHAKAL (#17700)
  - Added 15 relationships for aws-ecr-controller @YASHMAHAKAL
    (#17632)
  - relationships for aws-route53-controller @YASHMAHAKAL
    (#17617)
  - non-binding visual relationships for AWS CloudFront
    Distribution to Kubernetes Ingress, Kubernetes Service
    @YASHMAHAKAL (#17488)
  - [Model] Adition of AWS Glue Controller @YASHMAHAKAL (#17582)
  - added 10 aws applicationautoscaler controller relationships
    @YASHMAHAKAL (#17524)
  - Add lambda sqs relationship @Sanjana2906 (#18671)
  - Add ElasticsearchDomain and Cloudwatch LogGroup relationship
    @ey22 (#18195)
  - feat(mesh model): add nvidia-gpu-operator and
    node-feature-discovery @srivastavasujay (#18677)
  - [Server] Add Azure BatchAccount relationships @aviralgarg05
    (#18824)
  - [Models]Add AWS relationships for IAM Role → EKS Cluster /
    NodeGroup @Debashich (#17506)
  - [Models] Add hierarchical relationships for AWS APIGatewayV2
    controller @Debashich (#17518)
  - [Models] Add edge relationships for AWS APIGatewayV2
    controller @Debashich (#17556)
  - [models] Add CloudWatch LogGroup to ECS TaskDefinition
    relationship for aws-ecs-controller @farhann-saleem (#17708)
  - add(relationships): add hierarchical relationships for flux
    model @adityaupasani2 (#17836)
  - [models] Add ECS TaskDefinition to Cluster hierarchical
    relationship for aws-ecs-controller @farhann-saleem (#17796)
  - feat(meshmodel): add AWS DynamoDB Table and SQS Queue
    relationships to Kubernetes Deployment and Pod @aahil62
    (#19490)
  - feat(meshmodel): add Azure Service Bus Queue and Event Hub
    relationships to Kubernetes Deployment and Pod @aahil62
    (#19493)
  - feat(meshmodel): add AWS RDS DBInstance and Lambda Function
    relationships to Kubernetes Deployment and Pod @aahil62
    (#19502)
  - add(relationships): add hierarchical relationships for
    karpenter model @adityaupasani2 (#19747)
  - add(relationships): add hierarchical relationships for
    metallb model @adityaupasani2 (#19769)
  - [Models] Add VirtualNetworksSubnet relationships for Azure
    FlexibleServer resources @ObaidAbdullah16 (#19791)
  - feat: aws-ecs relationship @Junnygram (#20183)
  - add(relationships): add hierarchical relationships for
    stackgres-operator model @adityaupasani2 (#19797)
  - feat(meshmodel): add Azure NetworkSecurityGroup →
    SecurityRule hierar… @Sanjana2906 (#19019)
  - [Models] Add relationships for AWS APIGatewayV2 controller
    @Debashich (#17619)
  - Add 12 new relationship definitions for AWS S3 components
    @yi-nuo426 (#17470)
  - [Models] Implemented AWS APIGatewayV2 Bindings & Refactored
    Hierarchical Relationships to v1alpha3 schema @AhmedAzzam-Web
    (#17631)
  - feat(meshmodel): fix typo and add ManagedClustersAgentPool
    relationship for azure-container-service @adityaupasani2
    (#17760)
  - [Models] Add relationships for AWS ElastiCache controller
    @Suhani1234-5 (#17655)
  - feat(meshmodel): add hierarchical relationships for KEDA
    components @adityaupasani2 (#17790)
  - Feat/cert manager relationships @adityaupasani2 (#17792)
  - [AWS ElasticSearch Service] Fix invalid vpcOptions patch
    references in ElasticsearchDomain relationships
    @AyushSharma0209 (#18837)
  - [Models] Add AWS routing and NAT Gateway relationships for
    aws-ec2-controller @akshayghalme (#19087)
  - add lambda-to-pod relationships @YASHMAHAKAL (#17267)
  - feat: add aws-kms-controller relationships @YASHMAHAKAL
    (#17462)
  - Add SNS Topic → Kubernetes Deployment/Pod Relationships
    @YASHMAHAKAL (#17444)
  - [Models] Add 11 AWS cross-service relationship definitions
    (Lambda, S3, DynamoDB, EC2, RDS, SNS, SQS, IAM, CloudWatch,
    ApiGatewayV2) @Silapareddy-Praveen-Kumar-Reddy (#17964)
  - [server] Add ECS Service to TargetGroup relationship
    @FreemanBoss (#17450)
  - feat: add EventBridge Rule → Lambda, SQS, SNS edge network
    relationships @sooovamm (#17512)
  - Add GitHub ConnectionDefinition to meshery-core model
    @leecalcote (#20311)
  - [models] Add ECR Repository to ECS TaskDefinition
    relationship for aws-ecs-controller @farhann-saleem (#17626)
  - feat: add API Gateway V2 → Lambda relationship @Sanjana2906
    (#18413)
  - feat: add SQS → Lambda event source mapping relationship
    @Sanjana2906 (#18689)
  - feat(meshmodel): add AWS ElastiCache ReplicationGroup
    relationships to Kubernetes Deployment and Pod @aahil62
    (#19506)
  - feat(meshmodel): add AWS SNS Topic relationships to
    Kubernetes Deployment and Pod @aahil62 (#19507)
  - feat(meshmodel): add AWS EventBridge EventBus relationships
    to Kubernetes Deployment and Pod @aahil62 (#19528)
  - feat(meshmodel): add AWS Secrets Manager Secret relationships
    to Kubernetes Deployment and Pod @aahil62 (#19508)
  - [Models] feat: add RouteTable to InternetGateway relationship
    @adithyaganesh999 (#19587)
  - feat(meshmodel): add AzureIdentity→AzureIdentityBinding
    relationship for aad-pod-identity @abuzar200 (#19666)
  - fix(meshmodel): populate svgComplete for Exoscale icons
    @ShubhamSoni09 (#19939)
  - Add sqs dlq relationship @Sanjana2906 (#18823)
  - feat(meshmodel): add AWS RDS DBProxy → VPC parent
    relationship @AditiCoderr (#18674)
  - [Models] Improve relationships for ms-catalogs-worker
    component @BasavarajBankolli (#18360)
  - Secret-to-DBInstance and Secret-to-DBCluster secret-rotation
    relationship @CloudWithHannah (#18340)
  - feat(relationships): add ECS TaskDefinition → IAM Role
    permission relationships @YaoyiW27 (#18311)
  - feat(meshmodel): add Azure VirtualNetwork → Subnet network
    relationship @Sanjana2906 (#18968)
  - feat(meshmodel): add Azure Public IP → Network Interface
    relationship @Sanjana2906 (#18892)
  - Added AWS RDS hierarchical relationships for snapshots and
    database instances @Debashich (#17378)
  - [Models] Add AWS API Gateway relationships with Kubernetes
    Service and Ingress @ANKANJAGTAP (#17326)
  - [Relationships] Add AWS Secrets Manager to Kubernetes
    workloads @devrajmandal (#17186)
  - [Models] Add AWS Secrets Manager relationships for Deployment
    and Pod workloads @sarika-03 (#17260)
  - feat(meshmodel): add AWS CloudWatch monitoring relationships
    →Deployment/StatefulSet @Debashich (#17181)
  - [Relationships] Add S3 Bucket to Deployment and Pod reference
    relationships @YASHMAHAKAL (#17030)
  - [Relationships] Add Pod to PVC reference relationship
    @YASHMAHAKAL (#16938)
  - Add Kubernetes Deployment to Service relationship
    @chandan009s (#16954)
  - feat: add AWS RDS database connectivity relationships
    @Debashich (#17014)
  - Catalog: [Issue 9289] Add Redis ConfigMap configuration
    sample @Raja-89 (#16841)
  - [Docs] condense AGENTS.md and add CLAUDE.md alias @marblom007
    (#20310)
  - Bump ws in /install/docker-extension/ui @dependabot[bot]
    (#20110)
    * Meshery CLI
  - [mesheryctl] Wrap raw validation error in system channel
    command @emphor11 (#20136)
  - Docs: restructure contributing docs @miacycle (#20333)
  - fix: validate design ID in DeleteMesheryPatternHandler
    @manoj-1407 (#19234)
  - Rewire model data references to repo-root models/ and bump
    meshkit v1.0.19 @miacycle (#20312)
  - [mesheryctl] Fix variable name typo: channelNameSeperated ->
    channelNameSeparated @shivv23 (#19871)
  - [Relationships] Add meaningful relationships for Azure App
    Service @shri33 (#18553)
  - feat(meshmodel): add DocumentDB→Deployment/StatefulSet,
    DynamoDB→Depl… @Debashich (#17177)
  - [mesheryctl] Fix minimum() returning max on argument ties
    @Priyanshu6968 (#20285)
    * Maintenance
  - fix: validate design ID in DeleteMesheryPatternHandler
    @manoj-1407 (#19234)
  - Rewire model data references to repo-root models/ and bump
    meshkit v1.0.19 @miacycle (#20312)
  - Bump tmp from 0.2.6 to 0.2.7 in /ui @dependabot[bot] (#20080)
  - [mesheryctl] Fix variable name typo: channelNameSeperated ->
    channelNameSeparated @shivv23 (#19871)
  - ci: pin actions/checkout from @master to @v6 @MrDadhich456
    (#20314)
  - [Relationships] Add meaningful relationships for Azure App
    Service @shri33 (#18553)
  - feat(meshmodel): add DocumentDB→Deployment/StatefulSet,
    DynamoDB→Depl… @Debashich (#17177)
    * Documentation
  - Docs: restructure contributing docs @miacycle (#20333)
  - fix: validate design ID in DeleteMesheryPatternHandler
    @manoj-1407 (#19234)
  - Rewire model data references to repo-root models/ and bump
    meshkit v1.0.19 @miacycle (#20312)
  - [Docs] Colorize documentation scrollbar to match meshery.io
    @shteypandey28-hue (#20272)
  - Docs/ai provider production notes @Cloud-Architect-Emma
    (#19753)
  - [mesheryctl] Fix variable name typo: channelNameSeperated ->
    channelNameSeparated @shivv23 (#19871)
  - [Relationships] Add meaningful relationships for Azure App
    Service @shri33 (#18553)
  - Add lambda dynamodb relationship @Sanjana2906 (#18313)
  - feat(meshmodel): add DocumentDB→Deployment/StatefulSet,
    DynamoDB→Depl… @Debashich (#17177)

++++ molecule:

  - update to 26.6.0:
    * Features
  - feat: enable command borders and report by default (#4632)
    @cidrblock
    * Fixes
  - fix: upgrade cryptography and cairosvg to patch known
    vulnerabilities (#4652) @sudhirverma
  - fix: add missing build_ignore entries to galaxy.yml (#4650)
    @sudhirverma
  - fix: merge runtime environment in run_command to preserve
    ANSIBLE_ROLES_PATH (#4634) @Dotify71
  - fix(docs): update docs about tmp dir (#4639) @MaKaNu
  - fix: update '_extends' syntax for release-drafter v7
    compatibility (#4638) @rockygeekz
  - fix(security): update dependencies [SECURITY] (#4630)
    @renovate[bot]
    * Maintenance
  - chore: remove previously-synced agent skills (#4648)
    @ansibuddy
  - chore(deps): update all dependencies pep621 (#4645)
    @renovate[bot]
  - chore(deps): update all dependencies (#4644) @renovate[bot]
  - chore(deps): update all dependencies pep621 (#4643)
    @renovate[bot]
  - chore(deps): update all dependencies (#4636) @renovate[bot]
  - chore(deps): update pep621 (#4637) @renovate[bot]
  - chore(deps): update pep621 (#4629) @renovate[bot]
  - fix(security): update dependencies [SECURITY] (#4630)
    @renovate[bot]
  - chore(deps): update all dependencies (#4621) @renovate[bot]

++++ netbird:

  - Update to 0.74.0
    New Feature: Agent Network
    This release introduces Agent Network, a per-account LLM gateway
    that gives people and agents keyless, identity-based access to
    LLM APIs and internal resources over the tunnel. It is built on
    top of the existing reverse proxy and private services, so the
    transport is still NetBird's WireGuard overlay and the identity
    model is still your IdP. Have a tunnel, get access; no tunnel, no
    access.
    Agents point at a tunnel-only endpoint instead of the provider's
    URL. NetBird holds the upstream provider key server-side, injects
    it per request, and ties every call to a real identity from your
    IdP. Client-supplied auth headers are stripped before the request
    is forwarded, so a hardcoded key never reaches the provider. The
    whole thing is default deny: nothing reaches a provider until a
    policy explicitly allows it.
    Core capabilities:
  - Keyless access to LLM APIs. No keys stored or shared on the
    client. The tunnel is the credential.
  - Provider catalog. First-party APIs (OpenAI, Anthropic, Azure
    OpenAI, AWS Bedrock, Google Vertex AI, Mistral), AI gateways
    (LiteLLM Proxy, Portkey, Bifrost, Cloudflare AI Gateway, Vercel
    AI Gateway, OpenRouter), and any custom/self-hosted
    OpenAI-compatible endpoint (Ollama, vLLM, local GPU hosts).
  - Policies. A policy connects a Source Group (users or agent
    devices from your IdP) to one or more providers.
  - Limits. Token caps and budget (USD) caps per user and per
    group, plus account-wide Global Limits that can only tighten a
    policy, never loosen it.
  - Guardrails. Model allowlist, optional prompt capture, and PII
    redaction on captured logs.
  - Usage and access logs. Per-request accounting (identity,
    provider, model, tokens, cost) plus a full access log (method,
    path, status, duration, and prompt/completion when capture is
    on), with denied-request reasons, 7-90 day or indefinite
    retention, and filtering by user or group.
  - Agentic access to internal resources. Databases, internal APIs,
    and self-hosted models reachable over peer-to-peer WireGuard,
    no proxy in the path, governed by the same identities and
    policies.
  - Bring your own gateway. When forwarding to LiteLLM, NetBird
    passes the calling identity along by writing IdP groups into
    metadata.tags and the identity into the x-litellm-end-user-id
    header.
  - The dashboard ships copy-paste Agent Config for Claude Code,
    Codex, the OpenAI SDK, and cURL, with the endpoint pre-filled
    and no API key involved.
    Overview: https://docs.netbird.io/agent-network
    Quickstart: https://docs.netbird.io/agent-network/quickstart
    How it works: https://docs.netbird.io/agent-network/how-it-works
    Providers: https://docs.netbird.io/agent-network/providers
  - Agent Network
  - Added the per-account LLM gateway (Agent Network): store,
    manager, policy engine, provider catalog, and management HTTP
    + proxy gRPC surfaces, with the reverse-proxy middleware
    chain handling limit checks, cost metering, guardrails,
    identity injection, and response parsing. #6555
  - Added agent-network telemetry metrics. #6561
  - Added management-controlled client metrics push. #5886
  - Added per-provider skip_tls_verification for Agent Network.
    [#6630]
  - Added Agent Network preset for self-hosted deployments. #6569
  - Added Agent Network documentation and banner updates. #6562
    [#6564]
  - Added Agent Network nightly/manual E2E workflows. #6629
  - Client Improvements
  - Added management-controlled client metrics push. #5886
  - Eliminated packet loss during lazy connections. #6355
  - Reinject captured first packet on lazy connection activation.
    [#6572]
  - Improved network address filtering. #6515
  - Fixed empty profile handle regression in debug config. #6514
  - Skip re-resolving cached management cache domains. #6518
  - Suppress Quick Actions popup when DisableAutoConnect=true.
    [#6542]
  - Fix blocked status lock via relay manager path. #6547
  - Lower ICE handshake offer/answer log level to debug. #6565
  - Keep signal stream alive while receive loop is blocked on
    worker handoff. #6530
  - Wait for signal receive watchdog to stop before reconnect.
    [#6574]
  - Report management unhealthy while Sync stream is failing.
    [#6575]
  - Refresh receive liveness when worker handoff drains. #6594
  - Raise duration validation limit to 24 hours. #6598
  - Skip firewall ruleset rebuild when config is unchanged. #6508
  - Bound system info and posture-check gathering with a timeout
    to prevent sync-loop freeze. #6512
  - Categorize privileged tests behind a build tag and run them
    in Docker. #6425
  - Forward non-address DNS record types through route
    forwarders. #6455
  - Add per-phase timing metrics for sync processing. #6533
  - Use dedicated IsHealthy RPC for management health checks.
    [#6421]
  - Fix pointer comparisons in profile config apply. #6622
  - Fix race between WG watcher initial handshake read and
    endpoint creation. #6626
  - Management Improvements
  - Rescheduled inactivity expiration when a peer disconnects.
    [#6523]
  - Validate posture checks on metadata changes before updating
    the account. #6527
  - Relaxed metaHash validation when blocking peers. #6531
  - Simplified affected peers processing by ignoring disabled
    peers. #6540
  - Optimized affected posture checks and added additional
    logging. #6522
  - Restored client version checks in the login filter hash.
    [#6552]
  - Added peer expiration reason to activity metadata. #6619
  - Detached JWT group synchronization from request cancellation.
    [#6621]
  - Enabled Lazy Connections by default for new accounts. #6571
  - Infrastructure & Miscellaneous
  - Applied small GitHub workflow fixes. #6546
  - Updated the careers page link. #6538
  - Bumped GitHub Actions dependencies. #6550
  - Updated the project to v0.74.0. #6563
  - Required on-premise EULA acceptance in Enterprise
    installation scripts. #6596

++++ obs-service-tar_scm:

  - Update to version 0.12.4:
    * improve option sanitising revision/url
    * Fixes: boo#1269546
    * Fixes: CVE-2026-56004

++++ onedrive:

  - Update to version 2.5.11:
    * Feature Requests
  - Implement Feature Request: Added CI smoke test for
    monitor-mode clean shutdown across Ubuntu and Fedora (#3678)
  - Implement Feature Request: Added support for Microsoft
    Identity Broker 3.0.1 (#3686)
  - Implement Feature Request: Added push-triggered E2E testing
    across Personal, Business and SharePoint accounts with 64
    test cases and dedicated Shared Folder testing (#3644)
  - Implement Feature Request: Implemented stream hashing to
    support 'on-demand' development work (#3653)
  - Implement Feature Request: Added --mirror-local-state to
    ensure online state is a mirror of local state (#3742)
  - Implement Feature Request: Added capability to display the
    Admin Consent URL via --display-admin-consent-url (#3739)
  - Implement Feature Request: Added a new SVG notification icon
    for improved desktop integration with GNOME and KDE
    environments. (#3743)
  - Implement Feature Request: Implemented GUI-based OAuth
    callback handling using local loopback listener (#3750)
    * Bug Fixes
  - Fix Bug: Fix that the internal websocket trigger is not woken
    to sync with --download-only (#3631)
  - Fix Bug: Fix internal crash when WebSocket initialisation
    fails in monitor mode (#3639)
  - Fix Bug: Fix that broken symlinks log error despite
    skip_symlinks = true (#3656)
  - Fix Bug: Fix 'sync_list' retention handling so
  - -download-only --cleanup-local-files no longer removes
    directories that should be preserved (#3657)
  - Fix Bug: Fix skip_size flagging for local files is respected
    (#3659)
  - Fix Bug: Fix reserved Windows device name validation to block
    names with extensions (e.g. CON.txt, NUL.tar.gz) (#3661)
  - Fix Bug: Fix crash when parsing invalid 'resume_download.*'
    metadata during --resync (#3668)
  - Fix Bug: Fix to ensure use of local timestamp when uploading
    files when using --upload-only & --local-first (#3669)
  - Fix Bug: Fix SIGSEGV during shutdown caused by logging
    subsystem teardown race condition (#3676)
  - Fix Bug: Fix to defer local directory recreation when
    processing simulated /delta response (#3682)
  - Fix Bug: Fix SIGSEGV on shutdown, implement signal-safe
    termination handling, and preserve itemdb thread safety
    (#3687)
  - Fix Bug: Fix to prevent new transfers during SIGINT shutdown
    and support forced transfer abort (#3691)
  - Fix Bug: Fix relocated shared-folder shortcut path
    reconstruction (#3690)
  - Fix Bug: Fix that empty directories included by 'sync_list'
    are added to the database but not created locally (#3703)
  - Fix Bug: Fix 'sync_list' wildcard exclusion rules can
    incorrectly exclude ancestor directories (#3707)
  - Fix Bug: Fix that azure_tenant_id entries for intune based
    authentication were being ignored (#3711)
  - Fix Bug: Fix inotify move handling so local file and
    directory moves within sync_dir are processed as remote moves
    instead of delete/re-upload operations. (#3720)
  - Fix Bug: Fix impact of the official Microsoft Graph API
    'sharedWithMe' deprecation on --sync-shared-files
    functionality (#3729)
  - Fix Bug: Fix SharePoint Shared Library query failure where
    the application incorrectly reports that 'onedrive' is
    already running (#3734)
  - Fix Bug: Fix that CurlEngine 'fresh_connect' option may not
    be reset after successful retry, impacting connection reuse
    (#3735)
  - Fix Bug: Fix that Transfer Metrics duration includes
    non-transfer processing time (#3737)
  - Fix Bug: Fix download error handling so filesystem attribute
    failures are handled cleanly instead of interrupting file
    downloads. (#3741)
  - Fix Bug: Fix single-tenant authentication redirect URI
    handling and add administrator consent support (#3745)
  - Fix Bug: Fix elapsedTime calculation for monitor loop cycles
    (#3749)
  - Fix Bug: Fix monitor mode stability and long-running delta
    processing efficiency (#3754)
  - Fix Bug: Fix FreeBSD RSS memory telemetry calculation (#3757)
  - Fix Bug: Harden monitor lifecycle, event handling, and DB
    reconciliation (#3756)
  - Fix Bug: Avoid duplicate online item conversion during
    modified file upload (#3759)
  - Fix Bug: Reduce idle CPU usage in WebSocket monitor loop
    (#3762)
  - Fix Bug: Add the missing remove_source_folders entry to
  - -display-config output. (#3764)
    * Other Changes | Fixes
  - Enhance logging output for safeSetTimes() when the client
    runtime user does not own the file requiring timestamp
    changes (#3654)
  - Optimise monitor cleanup cadence for download-only mode
    (#3697)
  - Remove from code deprecated commands (--synchronize and
  - -get-O365-drive-id) in v2.5.0 (#3732)
  - Improve delta processing performance and reduce GC overhead
    (#3746)
  - Reduce forced garbage collection in synchronisation and
    CurlEngine cleanup paths (#3748)
  - Improve remote deletion success and failure logging (#3752)
  - Optimise client-side filtering directory mask evaluation
    (#3755)
  - Clarify error message for 'sync_list' rule (#3761)
  - Updated all supported Docker build environments to use
    current upstream base images and toolchains for improved
    security, maintenance, and long-term support.
  - Updated completion files to align to release application
    functionality
  - Updated 'config' file to align to release application
    functionality
  - Updated documentation

++++ opa:

  - Update to version 1.18.1:
    This release fixes a memory leak introduced in OPA v1.17.0. It is
    advised to update if you notice excess memory usage when running
    OPA server.
    * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01

++++ os-autoinst:

  - Update to version 5.1782917048.dcc97e9:
    * fix: Check also hidden files in checklist plugin
    * feat(ci): disable Mergify interactive queue controls in PR comments
    * fix(ci): format inline comments in workflows to pass yamllint
    * feat(ci): pin GitHub Actions by commit hash
    * test: assert pipe size adjustment dynamically
    * test: assert terminal session boundary safety
    * refactor: support pretty markers in script_sudo and become_root
    * fix: mmapi test failures and infinite loop hangs
    * test: simplify Level 3 pretty marker detection
    * fix: exclude virt-firmware on all older Leap archs

++++ osc:

  - 1.27.2
  - Command-line:
  - Extend 'osc maintained' to also display maintained branches in git
  - Add 'mergeable' field to the output of 'git-obs pr get' and other places using the same output format
  - Add 'osc build' --buildinfo and --buildinfo-debug options
  - Fix 'osc buildinfo --alternative-project' in git checkouts
  - Fix superseding in 'osc submitrequest' command to be resilient to 403 HTTP errors
  - Display a descriptive error message when token is not specified in git-obs
  - Library:
  - Fix Manifest.get_package_paths_bare_git() by using normpath() in path comparison
  - Enable allow_maintainer_edit setting, src.opensuse.org is now on gitea 1.26.2
  - Make 'osc up' and possibly other operations more robust by ignoring FileNotFoundError exception during deletions

++++ perl-CGI-Session:

  - updated to 4.490.0 (4.49)
    see /usr/share/doc/packages/perl-CGI-Session/Changelog.ini
    * SECURITY: Strengthen cryptographic randomness of MD5 driver, CVE-2026-56016
    (Robert Rothenberg, Mark Stosberg) bsc#1269983

++++ perl-CSS-Minifier-XS:

  - updated to 0.150.0 (0.15)
    see /usr/share/doc/packages/perl-CSS-Minifier-XS/Changes
    0.15      2026-06-30 11:19:01-07:00 America/Vancouver
  - Fix bug which resulted in zeroes being collapsed when they shouldn't,
    affecting filenames with zeroes in them (e.g.  "url(status-0.png)").
    Thanks to Stefan Berger for reporting GH#5.

++++ perl-JSON-Any:

  - updated to 1.420.0 (1.42)
    see /usr/share/doc/packages/perl-JSON-Any/Changes
    1.42      2026-06-30 21:25:05Z
  - fix test error with allow_non-ref and JSON::XS >= 4.0 when
    Cpanel::JSON::XS is not installed (RT#127753)

++++ plasma6-keyboard:

  - Pass '-DQT_QML_NO_CACHEGEN:BOOL=TRUE' to CMake to make builds
    reproducible (related: boo#1248369)

++++ prek:

  - Update to version 0.4.6:
    * Enhancements
  - Verify managed toolchain downloads before installation
    (#2229)
  - Add PREK_DOCKER_NO_INIT to opt-out Docker --init (#2242)
  - Improve subprocess error messages (#2257)
  - Split run concurrency knobs: PREK_CONCURRENT_HOOKS and
    PREK_CONCURRENT_BATCHES (#2276)
    * Performance
  - Avoid allocating markdown extensions per file (#2245)
  - Avoid unchanged config tracking writes (#2247)
  - Delay trailing whitespace output buffer (#2244)
  - Prefilter VCS permalink lines (#2253)
  - Skip unnecessary submodule updates during hook repo clone
    (#2255)
    * Documentation
  - Document language_version inferring for Python and Go (#2241)
    * Other changes
  - Refactor env var handling (#2277)
  - Use serde-saphyr for YAML string quoting (#2228)

++++ python-Genshi:

  - update to 0.7.11:
    * Replace use of `pkg_resources` with `importlib.resources` (or
    `importlib_resources` for Python < 3.9)
    * Update CI release workflow to use Ubuntu 22.04. (#96 by Simon
    Cross)

++++ python-ansible-compat:

  - update to 26.6.0:
    * Fixes
  - fix: use absolute paths for roles and library in
    ANSIBLE_ROLES_PATH (#583) @Dotify71
  - fix(security): update dependencies [SECURITY] (#592)
    @renovate[bot]
  - fix: update '_extends' syntax for release-drafter v7
    compatibility (#587) @rockygeekz
    * Maintenance
  - chore(deps): bump cryptography and cairosvg constraints
    (#601) @sudhirverma
  - chore: remove previously-synced agent skills (#599)
    @ansibuddy
  - chore(deps): update all dependencies pep621 (#595)
    @renovate[bot]
  - chore(deps): update all dependencies (#594) @renovate[bot]
  - chore(deps): update all dependencies (#585) @renovate[bot]
  - chore(deps): update all dependencies pep621 (#593)
    @renovate[bot]
  - fix(security): update dependencies [SECURITY] (#592)
    @renovate[bot]
  - chore(deps): update pep621 (#586) @renovate[bot]
  - chore(deps): update pep621 (#580) @renovate[bot]
  - chore(deps): update all dependencies (#579) @renovate[bot]
  - fix(security): update dependencies [SECURITY] (#578)
    @renovate[bot]
  - chore(deps): bump the uv group across 1 directory with 3
    updates (#581) @dependabot[bot]
  - chore(deps): update pep621 (#574) @renovate[bot]
  - chore(deps): update all dependencies (#573) @renovate[bot]

++++ python-pytest-ansible:

  - Update to version 26.6.0:
    * Fixes
  - fix(security): update dependencies [SECURITY] (#587)
    @renovate[bot]
  - fix: suppress ruff PLW0717 to unblock renovate (#586)
    @rockygeekz
  - fix(security): update dependencies [SECURITY] (#583)
    @renovate[bot]
  - fix(security): update dependencies [SECURITY] (#582)
    @renovate[bot]
  - fix: reorder pyproject.toml sections to match tombi canonical
    ordering (#579) @Hrithik-Gavankar
  - fix: update '_extends' syntax for release-drafter v7
    compatibility (#576) @rockygeekz
    * Maintenance
  - chore: remove previously-synced agent skills (#590)
    @ansibuddy
  - fix(security): update dependencies [SECURITY] (#587)
    @renovate[bot]
  - [pre-commit.ci] pre-commit autoupdate (#566)
    @pre-commit-ci[bot]
  - chore(deps): update all dependencies (#573) @renovate[bot]
  - fix(security): update dependencies [SECURITY] (#583)
    @renovate[bot]
  - chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3
    (#577) @dependabot[bot]
  - chore(deps): bump idna from 3.13 to 3.15 (#578)
    @dependabot[bot]
  - fix(security): update dependencies [SECURITY] (#582)
    @renovate[bot]
  - chore(deps): update pep621 (#574) @renovate[bot]
  - fix(security): update dependencies [SECURITY] - abandoned
    (#568) @renovate[bot]
  - chore(deps): update pep621 (#565) @renovate[bot]
  - chore(deps): bump pillow from 12.1.1 to 12.2.0 (#570)
    @dependabot[bot]
  - chore(deps): update all dependencies (#564) @renovate[bot]
  - chore(deps-dev): bump pip from 26.0.1 to 26.1 (#572)
    @dependabot[bot]
  - chore(deps-dev): bump cryptography from 46.0.6 to 46.0.7
    (#567) @dependabot[bot]
  - chore(deps-dev): bump pytest from 9.0.2 to 9.0.3 (#571)
    @dependabot[bot]
  - chore(deps-dev): bump uv from 0.11.2 to 0.11.6 (#569)
    @dependabot[bot]

++++ python-Flask-Security:

  - Drop ignore-resourcewarning.patch, not nedded anymore

++++ python-aiohappyeyeballs:

  - Update to 2.7.1
    * Use defaultdict to help with performance.
  - Update to 2.7.0
    * Add Python 3.14 support.
  - Update to 2.6.2
    Bug Fixes
    * Clear error on empty addr_infos in start_connection.
    Refactoring
    * Optimize obtaining event-loop down to 1 line.
    Testing
    * Stop verify_no_lingering_tasks from leaking an event loop.
  - Drop not longer needed patch:
    * event_loop.patch (fixed upstream)

++++ python-biopython:

  - Add a legal notice about examples not being distributed
    As some files under Tests/* are under CC BY-NC 4.0
    (bsc#1269823)

++++ python-click-extra:

  - update to 8.1.4:
    * Skip the EnumChoice shell-completion case-folding test on Click
    8.3.
  - update to 8.1.3:
    * Mark test as network-dependent
  - update to 8.1.2:
    * The runner pytest fixture now pins HOME and its platform
    equivalents inside its isolated filesystem, making
    configuration-file discovery independent of the ambient
    environment.
    * The Sphinx, MkDocs and Carapace tests now self-skip when their
    optional dependencies are missing, so downstream packagers no
    longer need to --ignore them.
  - update to 8.1.1:
    * Fix multiple and variadic (nargs=-1) options typed with
    EnumChoice: their tuple default was stringified as a whole
    (str((MyEnum.FOO,))) instead of per member, so the default
    tripped Click's Value must be an iterable check when the option
    was left unset.
    * Fix decorator_factory leaking options across uses of a
    pre-instantiated decorator: when command() is stored (e.g. in a
    pytest parametrize list) and reused, Click mutated the shared
    params list by extending it with each decorated function's
    options, adding duplicates on every reuse. The fix re-evaluates
    params_func() fresh on each application.
  - update to 8.1.0:
    * Breaking:
  - Rename the test-plan subcommand to test-suite, its
  - -plan-file/--plan-envvar options to
  - -suite-file/--suite-envvar, its [tool.<cli>.test-plan]
    config section to [tool.<cli>.test-suite], the
    click_extra.test_plan module to click_extra.test_suite, and
    the
    TestPlanConfig/parse_test_plan/run_test_plan/DEFAULT_TEST_PLAN
    API to
    TestSuiteConfig/parse_test_suite/run_test_suite/DEFAULT_TEST_SUITE.
    The CLITestCase class and the [[cases]] file structure keep
    their names.
  - Replace the test-suite config's inline field with a native
    cases array under [tool.<cli>.test-suite.cases] (or set file
    to a suite path). Adds the cases field to TestSuiteConfig and
    the cases_from_data helper.
  - ClickExtraConfig, TestSuiteConfig, and PrebakeConfig are no
    longer re-exported from the top-level click_extra namespace;
    import them from click_extra.config.
    * Add a Carapace completion exporter: the click_extra.carapace
    module serializes a Click command tree to carapace-spec YAML
    for native shell completion, behind a new carapace extra. The
    to_carapace_spec, dump_carapace_spec, write_carapace_spec and
    install_carapace_spec API answers click#3188.
    * Add a --carapace mode to the wrap command: click-extra wrap
  - -carapace SCRIPT prints the target CLI's spec, and --install
    writes it into Carapace's user spec directory. Mutually
    exclusive with --man and --show-params.
    * The wrap command now accepts a local project directory, reading
    its console-script entry point from pyproject.toml or setup.cfg
    so a checked-out project can be wrapped without installing it
    first.
    * Add the @sort_by_option decorator for the --sort-by table
    option, composing with option groups and constraints; it
    accepts ColumnSpec definitions and a columns= registry so one
    column tuple drives both --columns and --sort-by. Closes
    click-extra#1777.
    * Decorators built by decorator_factory carry proper signatures:
    their option class's constructor surfaces in help(), the REPL
    and autodoc, and overloaded type hints let basedpyright,
    pyright and mypy infer the produced command or decorated
    callback. Closes click-extra#1781.
    * @version_option accepts an explicit version string as its first
    positional argument (@version_option("1.2.3")), for drop-in
    compatibility with Click.
    * A test-suite file may now be in any list-capable config format
    detected from its extension: TOML and JSON (built-in), plus
    YAML, JSON5, JSONC and Hjson (with their extras). Adds the
    load_test_suite helper and SUITE_FORMATS constant.
    * Accept a bare integer timeout in a test-suite case, coercing it
    to a float instead of rejecting it.
    * Default the test-suite config file to
    ./tests/cli-test-suite.toml, which parses with the built-in
    tomllib and so needs no optional extra.
    * Add an all extra that pulls in every optional feature at once.
    * Centralize config format reading, serialization, and detection
    in click_extra.config with the new serialize_content,
    read_file, and format_from_path helpers, joining the existing
    parse_content.
    * Add iter_subcommands and make_resilient_context to
    click_extra.parameters for enumerating a group's visible
    subcommands and building a parse-free introspection context.
    * Add the CONFIG_PATH_METADATA_KEY and
    NORMALIZE_KEYS_METADATA_KEY named constants for the schema
    field-metadata keys, alongside the existing
    EXTENSION_METADATA_KEY.
    * Man pages now render optional-value options like --color as
  - -color[=auto|always|never] and drop the spurious value metavar
    on repeatable count options like -v/--verbose.
    * When introspection (--man, --show-params, --carapace) cannot
    find a Click command in the resolved module, the error now
    explains that an entry point importing its command lazily must
    be addressed with module:function notation.
    * Unify the "missing optional dependency" error messages behind a
    shared missing_extra_message helper, pointing at the canonical
    pip install click-extra[<extra>] install target.
    * Restrict pytest collection to the tests folder and switch to
    importlib import mode, fixing import file mismatch errors when
    building from a packaged source tree alongside an installed
    copy. Closes click-extra#1779.
    * Show the same configuration across all eight supported formats
    (TOML, YAML, JSON, JSON5, JSONC, Hjson, INI, XML) in a tabbed
    block in the configuration docs.
    * Silence ambiguous cross-reference warnings in the Sphinx
    documentation build for the ColumnSpec, ConfigFormat,
    ConfigValidator and LogLevel classes re-exported at the package
    root.

++++ python-fakeredis:

  - update to 2.36.2:
    * fix: replace async `can_read` busy-poll with event-based
    wakeup
    * fix: enforce `GT`/`LT` conditions in `ZADD` with `INCR`
    * fix: reject negative `LIMIT` in `SINTERCARD` and `ZINTERCARD`
    * fix: EXPIRE GT/LT mishandle keys with no existing TTL
    * fix: restore missing `addr`/`laddr`/`fd` fields in `CLIENT
    LIST`/`CLIENT INFO`
    * fix: SORT/SORT_RO BY <constant> must keep natural order
    * fix: `TypeError` on import in Python 3.8 due to `list[Any]`
    annotation in `sort` command
    * fix: Using path in connection
    * fix(async): `_decode` recurses into `dict` so RESP3 `HGETALL`
    responses are decoded
    * fix: `Database` now uses stable identity-based
    `__hash__`/`__eq__` (previously returned an unstable hash)

++++ python-fsspec:

  - update to 2026.6.0:
    * FTP: preserve filenames containing whitespace in _mlsd2
    * Prevent attribute error for 'forced' before flushing cache
    * Reflect async _walk correctly
    * Fix infinite recursion in expand_path with glob magic
    characters
    * Do not strip trailing slashes from data URIs
    * Fix referenceFS for new zarr and pandas
    * Omit get_ident() from cache token for async impl in sync mode
    * Fix AsyncFileSystem._cat_ranges on_error handling
    * Forward kwargs from cat_ranges to cat_file
    * Don't parse refFS templates by default
    * fix s3fs ci
    * fix: pass on_error when mv calls copy
    * proper install in ci to grab versions
    * encode URLs in HTTP pipe_file
    * implement delete and write_test for dirFS
    * allow multiple local protocols
    * context closing for tar and zip
    * fix cat_file and cat_ranges for WholeFileCache
    * usage warning to HTTP FS
    * update adl: message following retirement

++++ python-gp-libs:

  - update to 0.0.18:
    * refreshes the project documentation and maintainer workflow
    around the shared git-pull docs stack.

++++ python-hcloud:

  - update to 2.22.0:
    * The endpoints `GET /v1/datacenters` and `GET
    /v1/datacenters/{id}` are now deprecated and will be removed
    after 1 Oct. 2026. After this date, requests to these
    endpoints will return `HTTP 410 Gone`.
    * The `DatacentersClient`, `Datacenter` and related classes are
    now deprecated.
    * deprecate datacenters
    * retry requests on api bad_gateway error

++++ python-httpcore2:

  - update to 2.5.0:
    * Propagate the timeout through the SOCKS5 handshake.

++++ python-httpx2:

  - update to 2.5.0:
    * Propagate the timeout through the SOCKS5 handshake.

++++ python-inline-snapshot:

  - update to 0.34.2:
    * Fixed snapshot updates when pytest reuses stale assertion-
    rewrite cache files after a test folder is moved, which could
    leave cached code objects pointing at the old source path
    * Fixed `snapshot_arg()` to use the `fix` category (instead of
    `create`) when creating an argument with an existing non-
    ellipsis default argument value.
    * `get_snapshot_value()` now accepts a `which` parameter
    (`"new"` or `"old"`) to select whether to return the new
    (just-compared) or the old (previously stored) snapshot value
    (#336).
    * `Example.run_pytest`: deterministic test order by using `-p
    no:ranodmly`

++++ python-joserfc:

  - update to 1.7.2:
    * Avoid trailing padding for JWTs.

++++ python-librt:

  - update to 0.12.0:
    * Sync mypy and bump version

++++ python-libtmux:

  - update to 0.60.0:
    libtmux 0.60.0 completes tmux 3.7 feature parity. Building on the
    3.7 compatibility shipped in 0.59.0, it adds first-class floating
    panes via Pane.new_pane() and Window.new_pane(), types tmux 3.7's
    new server, session, window, and pane options, exposes the new
    pane format variables on Pane, and wraps tmux 3.7's new command
    flags. Every 3.7-only surface is version-gated, so tmux 3.2a–3.6
    keep working unchanged.
    * What's new
  - Floating panes (new-pane) (#694)
    tmux 3.7's flagship feature is now reachable through
    Window.new_pane() and Pane.new_pane(). A floating pane sits
    above the tiled layout like a popup but behaves like a real
    pane. Pass width/height to size it and x/y to position it,
    alongside the usual shell, start_directory, environment,
    zoom, and empty, plus style, active_border_style,
    inactive_border_style, message, and keep (remain-on-exit).
    The returned Pane reports pane_floating_flag == "1". Requires
    tmux 3.7+; see the floating panes guide.
  - Typed tmux 3.7 options (#694)
    The option dataclasses now type tmux 3.7's new options. On
    the server, get-clipboard; on the session,
    focus-follows-mouse, message-format, and
    prompt-command-cursor-style; and on the window, the copy-mode
    line-number options, the tree-mode preview options, and the
    window-pane status formats (of these,
    tree-mode-preview-format is also pane-scoped). The pane
    remain-on-exit option gained tmux 3.7's key value, and
    pane-active-border-style / pane-border-style (widened to pane
    scope in 3.7) now type on the pane too.
  - tmux 3.7 pane format variables (#694)
    Pane now exposes tmux 3.7's new pane format variables: the
    floating-pane geometry and flags (pane_floating_flag, pane_x,
    pane_y, pane_z, pane_flags, pane_zoomed_flag), the OSC 9;4
    progress report (pane_pb_progress, pane_pb_state),
    pane_pipe_pid, and the bracket_paste_flag and
    synchronized_output_flag screen-mode flags. Each is
    version-gated, so the format template stays clean on tmux
    3.2a–3.6.
  - tmux 3.7 command flags (#694)
    New tmux 3.7 flags are exposed on existing wrappers:
    Pane.capture_pane() gains hyperlinks (-H), line_numbers (-L),
    and line_flags (-F); Window.split() / Pane.split() gain empty
    (-E) plus style/active_border_style/inactive_border_style
    (-s/-S/-R), message (-m), and keep (-k); Session.kill() gains
    group (-g); and Pane.paste_buffer() gains no_vis (-S). On the
    server, Server.command_prompt() gains no_freeze (-C),
    Server.list_keys() gains format_ (-F), Server.run_shell()
    accepts trailing args expanded as #{1}/#{2}, and
    Server.refresh_client() gains request_clipboard (-l). Each
    warns and is ignored on tmux < 3.7.
    * Compatibility
    Purely additive — no breaking changes. New 3.7 parameters are
    gated on tmux's reported version; unsupported flags warn and
    are ignored on older tmux, and floating-pane creation raises
    there because new-pane does not exist before 3.7. tmux 3.2a–3.6
    remain supported and tested.
    * What's Changed
  - Add tmux 3.7 feature parity: floating panes, options, formats
    by @tony in #694
  - update to 0.59.0:
    * Restore compatibility with tmux 3.7 by @tony in #693

++++ python-libusb1:

  - update to 3.4.0:
    * Fix Python 3.14 DeprecationWarning caused by implicit ctypes
    layout when using _pack_ = 1.
    * Bundle libusb1 1.0.29 dlls in Windows wheels
    * Fix a licence inconsistency: the old pypi classifier was
    refering to the LGPL2+ instead of the LGPL2.1+ .

++++ python-libvirt-python:

  - Update to 12.5.0
  - Add all new APIs and constants in libvirt 12.5.0

++++ python-markdownify:

  - update to 1.2.3:
    * fix: allow `None` to be used for `strip_pre` and `warp_width`
    params in types
    * fix: preserve text nested inside `` by html.parser

++++ rke2-1.33:

  - Update to version 1.33.13+rke2r1:
    * This release updates Kubernetes to v1.33.13, and fixes a number
    of issues.
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.33.13+rke2r1
    * Warning
    This release upgrades Traefik chart to v40.x which includes a
    breaking change for the ingress-nginx migration: the provider
    name changes from kubernetesIngressNginx to
    kubernetesIngressNGINX. Check
    https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0
    for more details

++++ rke2-1.34:

  - Update to version 1.34.9+rke2r1:
    * This release updates Kubernetes to v1.34.9, and fixes a number
    of issues.
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.34.9+rke2r1
    * Warning
    This release upgrades Traefik chart to v40.x which includes a
    breaking change for the ingress-nginx migration: the provider
    name changes from kubernetesIngressNginx to
    kubernetesIngressNGINX. Check
    https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0
    for more details

++++ rke2-1.35:

  - Update to version 1.35.6+rke2r1:
    * This release updates Kubernetes to v1.35.6, and fixes a number
    of issues.
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.35.6+rke2r1
    * Warning
    This release upgrades Traefik chart to v40.x which includes a
    breaking change for the ingress-nginx migration: the provider
    name changes from kubernetesIngressNginx to
    kubernetesIngressNGINX. Check
    https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0
    for more details

++++ rke2:

  - Update to version 1.36.2+rke2r1:
    * This release updates Kubernetes to v1.36.2, and fixes a number
    of issues.
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.36.2+rke2r1
    * Warning
    This release upgrades Traefik chart to v40.x which includes a
    breaking change for the ingress-nginx migration: the provider
    name changes from kubernetesIngressNginx to
    kubernetesIngressNGINX. Check
    https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0
    for more details

++++ rpm-plugin-imaevmsign:

  - split imaevmsign plugin into a multibuild flavor

++++ ruby-build:

  - Update to version 20260701.
    Changelog: https://github.com/rbenv/ruby-build/releases/tag/v20260701
    * Added 3.4.10

++++ rubygem-bundler:

  - Regenerate spec file to drop update-alternatives dependency

++++ rumdl:

  - Update to version 0.2.27:
    * Fixed
  - MD077: detect latent list markers past an unstable heading
    (05d273e)
  - MD013: keep reference-style links atomic when reflowing
    (a991a71)
  - Update to version 0.2.26:
    * Added
  - wasi: add wasi build feature, make target, and CI coverage
    (8b9b027)
  - lsp: add enableSymbols setting to gate symbol providers
    (b80f001)
    * Fixed
  - workspace-index: make cache temp file names unique per write
    (d3aa269)
  - allow building for WASI (8d0b44a)
  - MD060: preserve trailing blank lines and skip table-free
    content (0223b30)
  - Update to version 0.2.25:
    * Added
  - lsp: document LSP settings and scope link-completion triggers
    (18fae1b)
  - MD013: reflow lists with configured marker spacing (#692)
    (b00b117)
    * Fixed
  - MD052: preserve author casing in undefined-reference messages
    (6d1cb96)
  - MD013: preserve single-tilde strikethrough content during
    reflow (#701) (a2387ce)
  - rules: resolve complex link handling in reflow and MD052
    (#702) (d57a61a)
  - rules: prevent front-matter and skippable region leakage
    (#699) (e09fa06)
  - MD007: align nested lists to a widened parent's content
    column (#700) (595cc4d)

++++ s390-tools:

  - Ammended the .spec file for `chreipl_helper` (bsc#1266436)
    * Moved `chreipl_helper*` to the main package
    * Added `Requires: %{name} = %{version}` in `chreipl-fcp-mpath subpackage`
  - Re-vendor-ed vendor.tar.zst

++++ scala:

  - Use the jline3 bundle jar to make an eventual upgrade of jline3
    easier

++++ scummvm:

  - Update to 2026.3.0
    * see https://downloads.scummvm.org/frs/scummvm/2026.3.0/ReleaseNotes.html for notes

++++ skillspector:

  - Switch source acquisition to an obs_scm git snapshot of upstream
    main: NVIDIA/skillspector publishes no git tags, no GitHub releases
    and nothing on PyPI, so no downloadable release tarball exists
  - Version changed from 2.3.10 (a locally-built sdist that exists
    nowhere upstream) to the snapshot 2.3.9~git20260701.326a2b48
    (upstream main HEAD, commit 326a2b48)
  - Add _service; drop the hand-built skillspector-2.3.10.tar.gz

++++ sonobuoy:

  - Update to version 0.57.5 (there is no .4):
    * Updating Go version from 1.25.11 to 1.26.4
    * Fix cve scan failures by updating go and x/net module
    * Upgrade golangci-lint to avoid CI error
    * Fix some CVEs
    * release v0.57.4 (#2034)
    * Fix some CVEs (#2019)
    * Add weekly linux vuln scan (#2015)
    * Fix CVEs (#2012)
    * Add unit tests for functions (#2014)
    * Release v0.57.3 (#2008)

++++ sops:

  - Update to version 3.13.2:
    * build(deps): Bump the go group with 3 updates by
    @dependabot[bot] in #2185
    * build(deps): Bump github/codeql-action from 4.35.4 to 4.35.5 in
    the ci group by @dependabot[bot] in #2184
    * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2193
    * build(deps): Bump the ci group with 4 updates by
    @dependabot[bot] in #2192
    * build(deps): Bump serde_json from 1.0.149 to 1.0.150 in
    /functional-tests in the rust group by @dependabot[bot] in
    [#2191]
    * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2197
    * build(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    in the ci group by @dependabot[bot] in #2196
    * test: unset all age env vars in make test target by
    @arpitjain099 in #2208
    * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2212
    * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2211
    * build(deps): Bump the go group with 15 updates by
    @dependabot[bot] in #2218
    * build(deps): Bump alpine from 3.23 to 3.24 in /.release in the
    docker group by @dependabot[bot] in #2217
    * fix: handle pointers when serializing context by @tlercher in
    [#2219]
    * docs: fix typo in exec-file --filename help text by @s3onghyun
    in #2221
    * JSON store: preserve large integers that fit into int64 by
    @s3onghyun in #2222
    * Fix panic when expecting an encrypted string, but a non-string
    is encountered by @felixfontein in #2227
    * Fix INI store no longer double-encoding newlines by
    @felixfontein in #2189
    * exec-file/exec-env: reset supplementary groups when changing
    user by @felixfontein in #2194
    * build(deps): Bump the go group with 6 updates by
    @dependabot[bot] in #2229
    * build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the
    ci group by @dependabot[bot] in #2228
    * Fix issue when changing user in exec subcommands by @sabre1041
    in #2230
    * Shorten .md lines by @felixfontein in #2206
    * Update all Go dependencies with go get -t -u ./... by
    @felixfontein in #2231
    * build(deps): Bump github.com/opencontainers/runc from 1.2.8 to
    1.3.6 by @dependabot[bot] in #2233
    * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2236
    * Release 3.13.2 by @felixfontein in #2232

++++ terragrunt:

  - Update to version 1.1.0:
    * New Features
  - Stack dependencies
    A stack generates a tree of units from a single
    terragrunt.stack.hcl file. Wiring one of those units to
    another used to mean defining dependency blocks in your
    catalog and threading dependency paths through values. Stack
    dependencies let you declare those relationships up front
    instead.
    Add an autoinclude block inside a unit or stack block, and
    Terragrunt generates a partial configuration (a
    terragrunt.autoinclude.hcl file) next to the generated
    terragrunt.hcl or terragrunt.stack.hcl that's automatically
    merged into the unit or stack definition. The new
    unit.<name>.path and stack.<name>.path references resolve to
    generated paths, so you don't have to hardcode them:
    [#] terragrunt.stack.hcl
    unit "vpc" {
    source = "github.com/acme/catalog//units/vpc"
    path   = "vpc"
    }
    unit "app" {
    source = "github.com/acme/catalog//units/app"
    path   = "app"
    autoinclude {
    dependency "vpc" {
    config_path = unit.vpc.path
    }
    inputs = {
    vpc_id = dependency.vpc.outputs.vpc_id
    }
    }
    }
    Anything that's valid in a unit configuration is valid in its
    autoinclude block, so you can also patch catalog units with
    configuration they don't ship with, like retry rules:
    [#] terragrunt.stack.hcl
    unit "app" {
    source = "github.com/acme/catalog//units/app"
    path   = "app"
    autoinclude {
    errors {
    retry "transient_errors" {
    retryable_errors   = [".*Error: transient network issue.*"]
    max_attempts       = 3
    sleep_interval_sec = 5
    }
    }
    }
    }
    The same works for nested stacks: an autoinclude block inside
    a stack block patches the generated terragrunt.stack.hcl, so
    you can, for example, add an extra unit to one environment
    without forking the stack in your catalog.
    Stack configurations also gained two capabilities along the way:
  - include blocks now work in terragrunt.stack.hcl files, so
    shared stack configuration can live in a parent folder.
  - dependency blocks can target stack directories, and the run
    queue expands them to the units inside. Note that this
    relationship only goes one way: units can depend on stacks,
    but stacks cannot depend on stacks or units.
    See the stacks documentation for the full reference.
    https://docs.terragrunt.com/features/stacks/explicit
    Previously gated behind the stack-dependencies experiment,
    all of this is now enabled by default.
  - Content Addressable Store (CAS)
    The Content Addressable Store (CAS) deduplicates source
    downloads across configurations. It addresses repositories
    and modules by their content, stores them locally, and serves
    later requests from that local store instead of repeating the
    fetch. This speeds up catalog cloning, OpenTofu/Terraform
    source fetching, and stack generation, and identical files
    occupy disk space once regardless of how many configurations
    use them.
    The CAS is no longer limited to Git. It also deduplicates
    HTTP, Amazon S3, Google Cloud Storage, Mercurial, and SMB
    sources, along with OpenTofu/Terraform registry sources
    fetched via tfr://. See supported sources for how each one
    resolves and deduplicates content.
    CAS is enabled by default. Use the --no-cas flag (or
    TG_NO_CAS=true) to opt out of it for a run:
    terragrunt run --all --no-cas -- plan
    Two new attributes give you finer control, and both default
    to off:
  - update_source_with_cas makes a generated stack
    self-contained. Set it on a unit, stack, or terraform block
    with a relative source, and terragrunt stack generate
    rewrites that source into a content-addressed cas::
    reference, so the generated tree no longer depends on the
    surrounding repository layout. Catalog authors can keep
    relative paths in their sources and still ship a portable,
    reproducible stack:
    [#] stacks/networking/terragrunt.stack.hcl
    unit "vpc" {
    source = "../..//units/vpc"
    path   = "vpc"
    update_source_with_cas = true
    }
    After terragrunt stack generate, the relative path is
    replaced by a reference to the exact tree the CAS stored:
    [#] Generated output
    unit "vpc" {
    source = "cas::sha1:f39ea0ebf891c9954c89d07b73b487ff938ef08b"
    path   = "vpc"
    update_source_with_cas = true
    }
  - mutable controls how the CAS places fetched content on
    disk. By default, the CAS hard links files from its shared
    store into .terragrunt-cache and marks them read-only,
    which is fast and uses no extra space, but means the files
    can't be edited in place. Set mutable = true on a terraform
    block to copy the content instead, making the working tree
    safe to edit at the cost of extra I/O and disk space:
    [#] units/vpc/terragrunt.hcl
    terraform {
    source = "github.com/acme/catalog//modules/vpc"
    mutable = true
    }
    Previously gated behind the cas experiment, the CAS no longer
    requires --experiment cas.
  - Redesigned terragrunt catalog
    The catalog command has been redesigned. It now starts
    without any configuration, discovers components across your
    catalog repositories in the background, and streams them into
    the TUI as they're found.
    Discovery is no longer limited to a modules/ directory;
    components can live anywhere in a catalog repository. To
    control what gets discovered, add a
    .terragrunt-catalog-ignore file with .gitignore-style globs
    for the paths you want filtered out.
    Components in the TUI now carry metadata to help you navigate
    a large catalog: each one shows a kind label (template,
    stack, unit, or module) and optional tags defined in the
    front-matter of its README.md. From the component list, press
    s to open a new screen that interactively collects the values
    used to scaffold the component into your repository.
    Previously gated behind the catalog-redesign experiment, the
    redesigned catalog is now the default terragrunt catalog
    experience.
  - Reading detection for local module sources
    Terragrunt can select units by the files they read, which is
    the basis of change-based runs in CI. Previously, pointing a
    unit's terraform block at a local directory didn't mark the
    files inside that directory as read, so a change to the
    module wouldn't select the unit.
    When a unit's source is a local module, Terragrunt now
    records the module's *.tf, *.tf.json, *.hcl, *.tofu, and
    * .tofu.json files as read by that unit, so --filter
    'reading=<path>' and --queue-include-units-reading select the
    unit when a module file changes:
    terragrunt run --all --filter 'reading=./modules/vpc/main.tf' -- plan
    For files that reading detection doesn't track on its own,
    the new mark_glob_as_read() HCL function expands a glob and
    marks every matching file as read in one call:
    locals {
    configs = mark_glob_as_read("${get_terragrunt_dir()}/config/{*.yaml,**/*.yaml}")
    }
    Existing pipelines built on --queue-include-units-reading or
    reading= filters may select more units than before, because
    changes to local module files now count as reads. Previously
    gated behind the mark-many-as-read experiment, these
    behaviors no longer require --experiment mark-many-as-read.
  - Skip auth during discovery with
  - -no-discovery-auth-provider-cmd
    By default, Terragrunt runs your --auth-provider-cmd once for
    every unit it discovers, so HCL functions that need
    credentials resolve correctly during parsing. In a large
    repository, that can mean hundreds of invocations before any
    unit runs, which can dominate wall-clock time on change-based
    runs.
    The --no-discovery-auth-provider-cmd flag (env:
    TG_NO_DISCOVERY_AUTH_PROVIDER_CMD) skips those invocations
    during the discovery phase, leaving auth to run only for the
    units that actually execute:
    terragrunt run --all \
  - -no-discovery-auth-provider-cmd \
  - -queue-include-units-reading=./changed-file.txt \
  - - plan
    Warning
    Use this only when you know parsing resolves without
    credentials. Units whose configuration depends on values from
  - -auth-provider-cmd during discovery (for example, via
    get_aws_account_id()) will fail to parse when the flag is
    set.
    Previously gated behind the opt-out-auth experiment, the flag
    now works without --experiment opt-out-auth.
  - Run queue displayed as a dependency tree
    Before a run --all, Terragrunt lists the units it's about to
    run. That list now renders as a dependency tree by default
    instead of a flat list, with units nested under their
    dependencies, so the run order and the relationships between
    units are visible before anything executes:
    The following units will be run, starting with dependencies
    and then their dependents:
    .
    ├── monitoring
    ╰── vpc
    ╰── database
    ╰── backend-app
    The header adapts to direction: dependencies come before
    dependents on apply, and the order reverses on destroy.
    Previously gated behind the dag-queue-display experiment, the
    tree display no longer requires --experiment
    dag-queue-display.
    * Tips Added
  - Tip when filtering a stack leaves nested stacks ungenerated
    terragrunt stack generate --filter './my-stack | type=stack'
    generates only the selected stack, not the nested stacks it
    contains, which can be surprising for a stack of stacks.
    When a non-glob | type=stack filter leaves a stack's nested
    stacks ungenerated, Terragrunt now prints a tip showing how
    to generate them too, for example --filter './my-stack |
    type=stack' --filter './my-stack/** | type=stack'.
    * Bug Fixes
  - Fix permission denied when generated files overwrite
    CAS-materialized files
    With the CAS enabled, Terragrunt fetches sources as read-only
    files. Writing a generated file over one of them no longer
    fails with permission denied:
  - Files from generate blocks with if_exists = "overwrite",
    when the module ships the target file (for example, its own
    versions.tf).
  - terragrunt.values.hcl, when the unit or stack source
    already contains one.
  - terragrunt.autoinclude.hcl, when the unit or stack source
    already contains one.
  - .terraform.lock.hcl, when the provider cache server updates
    a committed lock file during init -upgrade.
    In each case, the read-only file is replaced with a writable
    one, and the shared CAS store is never modified.
  - Fix permission denied when CAS fetches a git source across
    filesystems
    With the CAS enabled, fetching a git:: source could fail with
    permission denied on .git/HEAD or .git/config, sending
    Terragrunt back to the standard getter. It happened when the
    CAS store and the module's working directory sit on different
    filesystems, so the files are copied rather than hard-linked,
    and a read-only leftover from an interrupted run was in the
    way. Terragrunt now recovers from the leftover and completes
    the fetch.
  - Reject update_source_with_cas on a terraform block when CAS
    is disabled
    terragrunt stack generate --no-cas now fails when a generated
    unit's terraform block sets update_source_with_cas = true,
    instead of silently emitting the unit with its relative
    source unchanged. The relative source has no meaning once CAS
    is disabled, so the generated unit could not resolve its
    module. This matches the existing behavior for the same
    attribute on unit and stack blocks, and for a run invoked
    with --no-cas.
  - Apply extra_arguments env vars when resolving dependency
    outputs
    Resolving a dependency block's outputs now applies the
    env_vars from the unit's terraform extra_arguments blocks
    whose commands include output.
  - Resolve dependency outputs for units whose before_hook
    references a dependency
    Resolving a unit's dependency outputs no longer evaluates
    that unit's terraform hooks, so a before_hook (or after_hook)
    that interpolates ${dependency.<name>.outputs.<key>} no
    longer fails downstream units with There is no variable named
    "dependency". Dependency output resolution still applies the
    unit's extra_arguments env_vars and source.
  - Select units reading added or deleted glob files in Git-based
    filters
    Git-based filters (for example terragrunt run --all --filter
    '[HEAD^1...HEAD]' -- plan) now select units that read an
    added or deleted file through mark_glob_as_read, even when
    that file lives outside the unit's own directory. Previously
    only modified files outside a unit reached those units;
    adding or deleting a file the glob matched left the reading
    unit out of the run, so its real config change was skipped.
    Added files are matched against the newer reference, and
    deleted files against the older one where the file still
    exists.
  - mark_glob_as_read constrains its walk to a boundary
    mark_glob_as_read now confines glob expansion to a boundary
    directory. By default the boundary is the enclosing Git
    repository root; outside a Git repository it is unset. A
    pattern whose walk would begin outside the boundary returns
    an error instead of expanding.
    This bounds patterns that resolve higher than intended. For
    example, "${local.dir}/{*.yaml}" becomes /{*.yaml} when
    local.dir is empty, which previously walked the entire
    filesystem. A ? : conditional does not prevent this, because
    HCL evaluates both branches of a conditional before selecting
    one. Wrapping the call in try lets the error fall back to a
    default:
    locals {
    files = sort(try(mark_glob_as_read("${local.dir}/{*.yaml,*.yml,*.json}"), []))
    }
    Pass a leading --terragrunt-boundary argument to set the
    boundary explicitly, for example to scope the walk to a
    subdirectory or to widen it to the filesystem root:
    locals {
    scoped = mark_glob_as_read("--terragrunt-boundary=/etc/terragrunt", "/etc/terragrunt/{*.yaml}")
    all    = mark_glob_as_read("--terragrunt-boundary=/", "/{*.yaml}")
    }
  - Scaffold only detects variables in the module directory
    terragrunt scaffold now reads input variables from the module
    directory itself, matching what OpenTofu and Terraform load
    for a root module. Previously it scanned subdirectories too,
    so variable blocks defined in nested modules or examples
    leaked into the scaffolded inputs even though the module
    never exposes them.
  - Resolve interpolated object keys in autoinclude blocks
    terragrunt stack generate now resolves interpolated object
    keys in autoinclude blocks (for example {
    "${local.prefix}_key" = ... }), even when the value
    references dependency.*. Previously the generated unit kept
    the key verbatim, leaking a stack-only reference that is not
    valid in the unit scope.
  - Fix panic on non-string literal interpolation in autoinclude
    templates
    terragrunt stack generate no longer panics when an
    autoinclude template interpolates a non-string literal (for
    example "${0}" or "${true}") alongside a dependency.*
    reference. The interpolated literal is now rendered to its
    string form (${0} becomes 0) and the dependency reference is
    preserved for the unit.
  - Resolve transitive autoinclude dependencies on a stack
    directory
    run --all no longer fails with "does not contain a
    terragrunt.hcl file" when an autoinclude dependency points at
    a stack directory (one holding terragrunt.stack.hcl) and the
    unit is reached transitively through another unit. The
    dependency cycle check now skips a target with no unit
    config, matching the direct dependency case.
    * Experiments Updated
  - Six experiments completed
    The following experiments graduated to general availability
    in this release, and the features they gated are now enabled
    by default:
  - stack-dependencies
  - cas
  - catalog-redesign
  - mark-many-as-read
  - opt-out-auth
  - dag-queue-display
    Each feature is described in the New Features section above.
    The corresponding --experiment flags (and TG_EXPERIMENT
    values) are no longer needed. Passing one still works, but
    emits a warning about the completed experiment, so you can
    drop it at your convenience.
    Thank you to everyone who ran these experiments early and
    filed the feedback that got them here.
    * Process Updates
  - Immutable releases
    Starting with this release, Terragrunt releases are published
    as immutable releases on GitHub. Once a release is published,
    its tag and assets can no longer be modified or deleted, so
    the binary you download is guaranteed to be the same binary
    that was uploaded when the release was published.
  - Install script verifies release attestations The install
    script now checks downloaded release assets against the
    release attestation that ships with immutable releases. For
    releases starting with v1.1.0, when an authenticated GitHub
    CLI (v2.81.0 or later) is available, the script verifies the
    checksums file and the binary against the attestation before
    installing, and aborts if either does not match the published
    release. The check is skipped with a warning when gh is
    unavailable, too old, or unauthenticated. Use
  - -no-verify-attestation to opt out.
    Commits
    * Features
  - feat: Tip how to run a stack's units when a stack filter
    matches no units by @denis256 in #6387
    * Bug Fixes
  - fix: autoincludes variables interpolation by @denis256 in
    [#6318]
  - fix: generate overwrite of read-only CAS-materialized files
    by @denis256 in #6329
  - fix: CAS integration with committed module lockfiles by
    @yhakbar in #6330
  - fix: improved resolving of complex objects in keys by
    @denis256 in #6317
  - fix: Fixing update_source_with_cas integration with --no-cas
    by @yhakbar in #6363
  - fix: Adding support for adding/deleting files in Git diffs by
    @yhakbar in #6352
  - fix: Adding --terragrunt-boundary to mark_glob_as_read by
    @yhakbar in #6351
  - fix: Only detect variables in root directory of module by
    @yhakbar in #6381
  - fix: resolve transitive autoinclude dependency on a stack
    directory by @denis256 in #6389
  - fix: apply extra_arguments env_vars when resolving dependency
    outputs by @denis256 in #6396
  - fix: Fixing indenter style by @yhakbar in #6402
  - fix: Fixing legacy Windows per-drive key for environment
    variables by @yhakbar in #6412
  - fix: Fixing Git materialization race HEAD update by @yhakbar
    in #6411
  - fix: fixed reference of dependency outputs in terraform hooks
    by @denis256 in #6423
  - fix: Fixing deleted changed files by @yhakbar in #6424
    * Documentation
  - docs: Documenting --parallelism tweaking considerations
    better by @yhakbar in #6313
  - docs: Adding TGS 'Terragrunt at scale' page by @yhakbar in
    [#6307]
  - docs: v1.1.0 changelog polish by @yhakbar in #6333
  - docs: Improving performance docs by @yhakbar in #6332
  - docs: Adding immutable releases docs by @yhakbar in #6337
  - docs: Cleaning up 1.1.0 docs by @yhakbar in #6339
  - docs: Updating provider size claims for provider cache server
    docs by @yhakbar in #6341
  - docs: Documenting Discovery as a term by @yhakbar in #6359
  - docs: Cleaning up catalog tabs docs by @yhakbar in #6369
    * Chores
  - chore: marking as completed stack dependencies experiment by
    @denis256 in #6249
  - chore: Completing mark-many-as-read experiment by @yhakbar in
    [#6310]
  - chore: Completing cas experiment by @yhakbar in #6254
  - chore: Addressing feedback from #6254 by @yhakbar in #6324
  - chore: Completing dag-queue-display experiment by @yhakbar in
    [#6320]
  - chore: Completing opt-out-auth experiment by @yhakbar in
    [#6321]
  - chore: Dropping go-git by @yhakbar in #6325
  - chore: Addressing PR #6325 feedback by @yhakbar in #6335
  - chore: bump cicd to use opentofu 1.12.2 by @denis256 in #6343
  - chore: Signing GHA update by @denis256 in #6340
  - chore: multiple dependencies update by @denis256 in #6356
  - chore: Updating CI w/ Terragrunt guide to have more accurate
    screenshots by @yhakbar in #6357
  - chore: drop usage of github.com/NYTimes/gziphandler by
    @denis256 in #6364
  - chore(deps): bump astro from 6.3.2 to 6.4.6 in /docs by
    @dependabot[bot] in #6366
  - chore: Completing catalog-redesign experiment by @yhakbar in
    [#6271]
  - chore: Bumping JS dependencies by @yhakbar in #6368
  - chore: Adding release attestation verification to install
    script by @yhakbar in #6344
  - chore: Addressing weekly test stats by @yhakbar in #6354
  - chore: Addressing #6351 feedback by @yhakbar in #6373
  - chore: Adding mise.toml lockfile by @yhakbar in #6372
  - chore: Making progress on lll by @yhakbar in #6377
  - chore: autoinclude fuzzing tests improvements by @denis256 in
    [#6342]
  - chore: Expand pure testing through venv by @yhakbar in #6090
  - chore: Dropping TestWindowsTflintIsInvoked by @yhakbar in
    [#6382]
  - chore: Continuing with progress on lll #2 by @yhakbar in
    [#6385]
  - chore: added CICD guard for detecting not run tests by
    @denis256 in #6383
  - chore: Addressing weekly tests stats (2026-06-22) by @yhakbar
    in #6390
  - chore: Addressing #6390 feedback by @yhakbar in #6391
  - chore: go deps update by @denis256 in #6392
  - chore: Running go fix ./... by @yhakbar in #6398
  - chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 by
    @dependabot[bot] in #6394
  - chore: Update cfg locking for units by @yhakbar in #6401
  - chore: Move log flags off writers by @yhakbar in #6403
  - chore: Adding env and writers to venv by @yhakbar in #6404
  - chore: aws-sdk-go-v2/service/s3 upgrade by @denis256 in #6413
  - chore: Downgrading render log to a debug by @yhakbar in #6429
  - chore: Engine per unit shutdown by @yhakbar in #6426
    * Other Changes
  - Adding Terragrunt Patterns section by @karlcarstensen in
    [#6379]
  - Add FAQ section for docs.terragrunt.com by @karlcarstensen in
    [#6378]
  - Fixing codespell lint error and adding codespell lint
    commands by @karlcarstensen in #6386

++++ tomcat:

  - Update to Tomcat 9.0.119
    * Fixed CVEs:
    + CVE-2026-55956: Security constraints for default servlet ignored method
    (bsc#1269907)
    + CVE-2026-55955: EncryptInterceptor not protected against replay attacks
    (bsc#1269908)
    + CVE-2026-55276: Logged effective web.xml is incomplete (bsc#1269909)
    + CVE-2026-53434: Invalid CRL configuration doesn't trigger failure for FFM
    Connector (bsc#1269824)
    + CVE-2026-53404: Bad ornext processing in RewriteValve (bsc#1269910)
    + CVE-2026-50229: XSS in number guess example (bsc#1269791)
    * Catalina
    + Add: Add support for literal '%' characters in access log output. Based on
    pull request #1002 by Fabian Hahn. (markt)
    + Fix: Prevent duplicate log messages when clustering JARs are not present
    on startup. (csutherl)
    + Code: Remove unnecessary code from the SSI processing engine that was
    duplicating some of the normalisation checks. (markt)
    + Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    + Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
    (remm)
    + Fix: Incorrect session average life calculation. (remm)
    + Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
    (remm)
    + Fix: Avoid any init parameter updates when conflicts are found for
    filters, similar to what is done for servlets, as required by the servlet
    specification. (remm)
    + Fix: Fix container event cleanups in some edge cases. (remm)
    + Fix: Check for last-modified header in ExpiresFilter when a servlet uses
    addDateHeader to avoid wrongly considering it has been set. (remm)
    + Fix: Fix hour unit used by ExpiresFilter. (remm)
    + Fix: Remove exception swallowing in DataSourceStore to align it with
    FileStore and avoid session loss on errors. (remm)
    + Fix: Add support for single-quote escaped literal as well as quoted
    literals in DateFormatCache. (schultz)
    + Fix: On JAAS logout, clear out role principals on the subject that were
    added on commit, as recommended by the JAAS specification. (remm)
    + Fix: MemoryRealm should not add a dummy role when none is specified in the
    configuration. (remm)
    + Fix: DataSourceUserDatabase should return a null principal on a non
    existing user. (remm)
    + Fix: Fix shared lock expiration in WebDAV. (remm)
    + Fix: Inaccurate session exipration statistics when using the persistent
    manager. (remm)
    + Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    + Fix: Mixup of WrapperListener and WrapperLifecycle elements in
    storeconfig. (remm)
    + Fix: Incorrect processing of modified users in DataSourceUserDatabase.
    (remm)
    + Update: Clarify behavior in the UserDatabase for user, role and group
    creation that it does not immediately override existing elements. Removal
    (or update) needs to be used instead. (remm)
    + Fix: 70049: Align the web application class loader with parent class
    loaders and swallow any errors caused by invalid paths when looking up
    resources and behave as if the resources were not found in that case.
    (markt)
    + Fix: Improve validation of Range and Content-Range parsers so invalid
    ranges trigger a 4xx response rather than a 500 response. Pull request
    [#1012] provided by Sahana Surendra Bogar. (markt)
    + Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off
    rather than true or false to align with httpd. (markt)
    + Fix: Reset the encoding used for query string parameters between requests
    in case an application changed the encoding in a previous request. (markt)
    + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce
    to URLs that are known not to require it. (markt)
    + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least
    one sub realm is available. (remm)
    + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
    (markt)
    + Fix: Improve the detection of cross-context dispatches when using a
    RequestDispatcher. (markt)
    + Fix: Fix various instances of double decoding of URL patterns configured
    either programmatically or in web.xml. (remm/markt)
    + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,
    which follows a purely sequential evaluation strategy. (remm)
    + Fix: Change the default for the useRedirect attribute of the
    ProxyErrorReportValve from true to false. (markt)
    + Add: Add support for the showReport attribute in JsonErrorReportValve and
    ProxyErrorReportValve. When set to false, detailed error information
    (message, description, stack trace) is suppressed from error responses.
    (dsoumis)
    + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is
    removed but catalina-ha.jar is present and the Cluster element is enabled
    in server.xml. Cluster digester rules are now fully conditional on both
    JARs being available. (dsoumis)
    + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)
    + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list
    of reserved prefixes for SSI variables and request attributes. (markt)
    + Fix: Missing URL decoding when processing addMapping on a Servlet
    registration. (remm)
    + Fix: The Timeout WebDAV header allows comma separated values (according to
    the examples in the RFC). Use the first acceptable value. (remm)
    + Fix: Fix various issues when logging the effective web.xml for a web
    application. Empty sections are no longer logged. Special roles and empty
    authorisation constraints are included. (markt)
    + Fix: Expand the write lock for the save process in the MemoryUserDatabase
    to avoid concurrency issues with the file save operations. (markt)
    + Fix: Ensure atomic session persistence in FileStore. Based on pull request
    [#1016] by sahvx655-wq. (markt)
    + Fix: Do not ignore methods configured on security constraints that map to
    the default servlet. (markt)
    * Cluster
    + Fix: Expand wording and increase visibility of log message when cloud
    membership is configured without a trust store as all certificates will be
    trusted in this configuration. (markt)
    + Fix: Ensure listeners are correctly added and removed when configuring the
    channel coordinator. (markt)
    + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)
    + Fix: Fix some concurrency issues in OrderInterceptor. (markt)
    + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)
    + Fix: Fix concurrency issues generating MD5 digests in the
    CloudMembershipProvider implementations. (markt)
    + Add: Add replay protection to the EncryptInterceptor. This is a breaking
    change for the EncryptInterceptor. (markt)
    * Coyote
    + Add: Log a suitable warning if an encrypted PEM file is detected using an
    insecure form for encryption. (markt)
    + Fix: If TLS groups have been configured, use the configured groups rather
    than using OpenSSL's default TLS groups when using Tomcat Native with
    OpenSSL based connectors. (markt)
    + Fix: For HTTP/2, ensure that any in progress request body reads are
    cancelled if the container resets the associated stream. This prevents
    delays waiting for reads to time out when it is known that no more data
    will be received. (markt)
    + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream
    reset do so, rather than triggered a connection close. (markt)
    + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)
    + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,
    following refactor clean-up of header buffer. (remm)
    + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)
    + Fix: Fix MessageByte.equals if called on a null MB. (remm)
    + Fix: Call the delegate key manager in JSSE to retrieve the server key.
    (remm)
    + Fix: Avoid overflow scenarios in Asn1Parser. (remm)
    + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that
    allows the consistency check for the scheme provided by the user agent to
    be bypassed. (markt)
    + Fix: isTrailerFieldsReady was always returning true. (remm)
    + Fix: Align OpenSSL/Panama TLS implementation with other implementations
    and throw an exception if there is an error loading the provided CRL(s).
    (markt)
    + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if
    @STRENGTH was encountered, ignoring any subsequent expressions. (markt)
    + Fix: Handle the case where the HTTP/2 payload length is insufficient for
    the mandatory data required by the flags set in the header. (markt)
    + Fix: 70102: Correct expected size of ticket keys when calling
    setSessionTicketKeys with an FFM connector. (markt)
    + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken
    by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)
    + Fix: When processing an OpenSSL cipher specification, fully align the
    order of the resulting ciphers with the order produced by OpenSSL. (markt)
    + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
    (schultz)
    + Update: Update both the minimum and recommended version for Tomcat Native
    1.x to 1.3.8. (markt)
    * Jasper
    + Fix: Fix possible EL argument mismatch when it was set to null. (remm)
    + Fix: Fix thread safety of TagPluginManager. (remm)
    + Fix: Correctly use flush on JSP include. (remm)
    * Web applications
    + Add: Manager: Add checks to ensure that any uploaded files are uploaded to
    the expected location. (markt)
    + Add: Manager: Add checks to ensure that the requested context path for a
    deployed WAR, directory or descriptor file is valid. (markt)
    + Add: Documentation: Expand the description of some of the attributes of
    the CrawlerSessionManagerValve. (markt)
    + Fix: Documentation: Clearer description and correct documented default for
    ocspSoftFail. (markt)
    + Fix: Fix double escaping in the context names for the JSON mode of the
    manager servlet. (remm)
    + Fix: Manager: Ensure automatic deployment does not trigger an undeployment
    during a Manager triggered web application reload. (markt)
    + Fix: Documentation: Provide better documentation for the scheme and secure
    attributes of a Connector. (markt)
    * Websocket
    + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)
    + Fix: Trigger standard WebSocket error handling if a call to
    Endpoint.onOpen() fails for a programmatic endpoint. (markt)
    + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a
    programmatic endpoint. Test case provided by uabdur. (markt)
    + Fix: If a client presents invalid parameters when negotiating a WebSocket
    extension, decline the negotiation offer that includes the invalid
    parameters rather than failing the connection. Pull request #1019 provided
    by sahvx655-wq. (markt)
    * Other
    + Fix: Wrong references to jakarta instead of javax. (remm)
    + Fix: Restore default authenticator to nullafter executing an Ant task.
    (remm)
    + Update: Update Commons Daemon to 1.6.1. (markt)
    + Update: Improvements to French translations. (remm)
    + Update: Improvements to Japanese translations provided by tak7iji. (markt)
    + Update: Update Tomcat Native to 1.3.8. (markt)

++++ tomcat10:

  - Update to Tomcat 10.1.56
    * Fixed CVEs:
    + CVE-2026-55956: Security constraints for default servlet ignored method
    (bsc#1269907)
    + CVE-2026-55955: EncryptInterceptor not protected against replay attacks
    (bsc#1269908)
    + CVE-2026-55276: Logged effective web.xml is incomplete (bsc#1269909)
    + CVE-2026-53434: Invalid CRL configuration doesn't trigger failure for FFM
    Connector (bsc#1269824)
    + CVE-2026-53404: Bad ornext processing in RewriteValve (bsc#1269910)
    + CVE-2026-50229: XSS in number guess example (bsc#1269791)
    * Catalina
    + Add: Add support for literal '%' characters in access log output. Based on
    pull request #1002 by Fabian Hahn. (markt)
    + Fix: Prevent duplicate log messages when clustering JARs are not present
    on startup. (csutherl)
    + Fix: 70038: Cookie.clone() should also clone the internal attribute map.
    (markt)
    + Code: Remove unnecessary code from the SSI processing engine that was
    duplicating some of the normalisation checks. (markt)
    + Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    + Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
    (remm)
    + Fix: Incorrect session average life calculation. (remm)
    + Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
    (remm)
    + Fix: Avoid any init parameter updates when conflicts are found for
    filters, similar to what is done for servlets, as required by the servlet
    specification. (remm)
    + Fix: Fix container event cleanups in some edge cases. (remm)
    + Fix: Check for last-modified header in ExpiresFilter when a servlet uses
    addDateHeader to avoid wrongly considering it has been set. (remm)
    + Fix: Fix hour unit used by ExpiresFilter. (remm)
    + Fix: Remove exception swallowing in DataSourceStore to align it with
    FileStore and avoid session loss on errors. (remm)
    + Fix: Add support for single-quote escaped literal as well as quoted
    literals in DateFormatCache. (schultz)
    + Fix: On JAAS logout, clear out role principals on the subject that were
    added on commit, as recommended by the JAAS specification. (remm)
    + Fix: MemoryRealm should not add a dummy role when none is specified in the
    configuration. (remm)
    + Fix: DataSourceUserDatabase should return a null principal on a non
    existing user. (remm)
    + Fix: Fix shared lock expiration in WebDAV. (remm)
    + Fix: Inaccurate session exipration statistics when using the persistent
    manager. (remm)
    + Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    + Fix: Mixup of WrapperListener and WrapperLifecycle elements in
    storeconfig. (remm)
    + Fix: Incorrect processing of modified users in DataSourceUserDatabase.
    (remm)
    + Update: Clarify behavior in the UserDatabase for user, role and group
    creation that it does not immediately override existing elements. Removal
    (or update) needs to be used instead. (remm)
    + Fix: 70049: Align the web application class loader with parent class
    loaders and swallow any errors caused by invalid paths when looking up
    resources and behave as if the resources were not found in that case.
    (markt)
    + Fix: Improve validation of Range and Content-Range parsers so invalid
    ranges trigger a 4xx response rather than a 500 response. Pull request
    [#1012] provided by Sahana Surendra Bogar. (markt)
    + Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off
    rather than true or false to align with httpd. (markt)
    + Fix: Reset the encoding used for query string parameters between requests
    in case an application changed the encoding in a previous request. (markt)
    + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce
    to URLs that are known not to require it. (markt)
    + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least
    one sub realm is available. (remm)
    + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
    (markt)
    + Fix: Improve the detection of cross-context dispatches when using a
    RequestDispatcher. (markt)
    + Fix: Fix various instances of double decoding of URL patterns configured
    either programmatically or in web.xml. (remm/markt)
    + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,
    which follows a purely sequential evaluation strategy. (remm)
    + Fix: Change the default for the useRedirect attribute of the
    ProxyErrorReportValve from true to false. (markt)
    + Add: Add support for the showReport attribute in JsonErrorReportValve and
    ProxyErrorReportValve. When set to false, detailed error information
    (message, description, stack trace) is suppressed from error responses.
    (dsoumis)
    + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is
    removed but catalina-ha.jar is present and the Cluster element is enabled
    in server.xml. Cluster digester rules are now fully conditional on both
    JARs being available. (dsoumis)
    + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)
    + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list
    of reserved prefixes for SSI variables and request attributes. (markt)
    + Fix: Missing URL decoding when processing addMapping on a Servlet
    registration. (remm)
    + Fix: The Timeout WebDAV header allows comma separated values (according to
    the examples in the RFC). Use the first acceptable value. (remm)
    + Fix: Fix various issues when logging the effective web.xml for a web
    application. Empty sections are no longer logged. Special roles and empty
    authorisation constraints are included. All session cookie attributes are
    included. (markt)
    + Fix: Expand the write lock for the save process in the MemoryUserDatabase
    to avoid concurrency issues with the file save operations. (markt)
    + Fix: Ensure atomic session persistence in FileStore. Based on pull request
    [#1016] by sahvx655-wq. (markt)
    + Fix: Do not ignore methods configured on security constraints that map to
    the default servlet. (markt)
    * Cluster
    + Fix: Expand wording and increase visibility of log message when cloud
    membership is configured without a trust store as all certificates will be
    trusted in this configuration. (markt)
    + Fix: Ensure listeners are correctly added and removed when configuring the
    channel coordinator. (markt)
    + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)
    + Fix: Fix some concurrency issues in OrderInterceptor. (markt)
    + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)
    + Fix: Fix concurrency issues generating MD5 digests in the
    CloudMembershipProvider implementations. (markt)
    + Add: Add replay protection to the EncryptInterceptor. This is a breaking
    change for the EncryptInterceptor. (markt)
    * Coyote
    + Add: Log a suitable warning if an encrypted PEM file is detected using an
    insecure form for encryption. (markt)
    + Fix: If TLS groups have been configured, use the configured groups rather
    than using OpenSSL's default TLS groups when using Tomcat Native with
    OpenSSL based connectors. (markt)
    + Fix: For HTTP/2, ensure that any in progress request body reads are
    cancelled if the container resets the associated stream. This prevents
    delays waiting for reads to time out when it is known that no more data
    will be received. (markt)
    + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream
    reset do so, rather than triggered a connection close. (markt)
    + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)
    + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,
    following refactor clean-up of header buffer. (remm)
    + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)
    + Fix: Fix MessageByte.equals if called on a null MB. (remm)
    + Fix: Call the delegate key manager in JSSE to retrieve the server key.
    (remm)
    + Fix: Avoid overflow scenarios in Asn1Parser. (remm)
    + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that
    allows the consistency check for the scheme provided by the user agent to
    be bypassed. (markt)
    + Fix: isTrailerFieldsReady was always returning true. (remm)
    + Fix: Align OpenSSL/Panama TLS implementation with other implementations
    and throw an exception if there is an error loading the provided CRL(s).
    (markt)
    + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if
    @STRENGTH was encountered, ignoring any subsequent expressions. (markt)
    + Fix: Handle the case where the HTTP/2 payload length is insufficient for
    the mandatory data required by the flags set in the header. (markt)
    + Fix: 70102: Correct expected size of ticket keys when calling
    setSessionTicketKeys with an FFM connector. (markt)
    + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken
    by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)
    + Fix: When processing an OpenSSL cipher specification, fully align the
    order of the resulting ciphers with the order produced by OpenSSL. (markt)
    + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
    (schultz)
    + Update: Update both the minimum and recommended version for Tomcat Native
    2.x to 2.0.15. (markt)
    + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
    * Jasper
    + Fix: Fix possible EL argument mismatch when it was set to null. (remm)
    + Fix: Fix thread safety of TagPluginManager. (remm)
    + Fix: Correctly use flush on JSP include. (remm)
    * Web applications
    + Add: Manager: Add checks to ensure that any uploaded files are uploaded to
    the expected location. (markt)
    + Add: Manager: Add checks to ensure that the requested context path for a
    deployed WAR, directory or descriptor file is valid. (markt)
    + Add: Documentation: Expand the description of some of the attributes of
    the CrawlerSessionManagerValve. (markt)
    + Fix: Documentation: Clearer description and correct documented default for
    ocspSoftFail. (markt)
    + Fix: Fix double escaping in the context names for the JSON mode of the
    manager servlet. (remm)
    + Fix: Manager: Ensure automatic deployment does not trigger an undeployment
    during a Manager triggered web application reload. (markt)
    + Fix: Documentation: Provide better documentation for the scheme and secure
    attributes of a Connector. (markt)
    * Websocket
    + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)
    + Fix: Trigger standard WebSocket error handling if a call to
    Endpoint.onOpen() fails for a programmatic endpoint. (markt)
    + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a
    programmatic endpoint. Test case provided by uabdur. (markt)
    + Fix: If a client presents invalid parameters when negotiating a WebSocket
    extension, decline the negotiation offer that includes the invalid
    parameters rather than failing the connection. Pull request #1019 provided
    by sahvx655-wq. (markt)
    * Other
    + Fix: Use per connection authenticator when executing an Ant task.
    (remm/markt)
    + Update: Update Commons Daemon to 1.6.1. (markt)
    + Update: Improvements to French translations. (remm)
    + Update: Improvements to Japanese translations provided by tak7iji. (markt)
    + Update: Update the packaged version of the Tomcat Migration Tool for
    Jakarta EE to 1.0.12. (markt)
    + Update: Update Tomcat Native to 2.0.15. (markt)

++++ tomcat11:

  - Update to Tomcat 11.0.23
    * Fixed CVEs:
    + CVE-2026-55956: Security constraints for default servlet ignored method
    (bsc#1269907)
    + CVE-2026-55955: EncryptInterceptor not protected against replay attacks
    (bsc#1269908)
    + CVE-2026-55276: Logged effective web.xml is incomplete (bsc#1269909)
    + CVE-2026-53434: Invalid CRL configuration doesn't trigger failure for FFM
    Connector (bsc#1269824)
    + CVE-2026-53404: Bad ornext processing in RewriteValve (bsc#1269910)
    + CVE-2026-50229: XSS in number guess example (bsc#1269791)
    * Catalina
    + Add: Add support for literal '%' characters in access log output. Based on
    pull request #1002 by Fabian Hahn. (markt)
    + Fix: Lower the log level to debug when OpenSSL initialization fails in
    OpenSSLLifecycleListener to avoid stack traces when libssl.so is not
    present and to align the behavior of the isAvailable() check with the
    AprLifecycleListener and gracefully fail when natives are not present.
    (csutherl)
    + Fix: 70038: Cookie.clone() should also clone the internal attribute map.
    (markt)
    + Code: Remove unnecessary code from the SSI processing engine that was
    duplicating some of the normalisation checks. (markt)
    + Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    + Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
    (remm)
    + Fix: Incorrect session average life calculation. (remm)
    + Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
    (remm)
    + Fix: Avoid any init parameter updates when conflicts are found for
    filters, similar to what is done for servlets, as required by the servlet
    specification. (remm)
    + Fix: Fix container event cleanups in some edge cases. (remm)
    + Fix: Check for last-modified header in ExpiresFilter when a servlet uses
    addDateHeader to avoid wrongly considering it has been set. (remm)
    + Fix: Fix hour unit used by ExpiresFilter. (remm)
    + Fix: Remove exception swallowing in DataSourceStore to align it with
    FileStore and avoid session loss on errors. (remm)
    + Fix: Add support for single-quote escaped literal as well as quoted
    literals in DateFormatCache. (schultz)
    + Fix: On JAAS logout, clear out role principals on the subject that were
    added on commit, as recommended by the JAAS specification. (remm)
    + Fix: MemoryRealm should not add a dummy role when none is specified in the
    configuration. (remm)
    + Fix: DataSourceUserDatabase should return a null principal on a non
    existing user. (remm)
    + Fix: Fix shared lock expiration in WebDAV. (remm)
    + Fix: Inaccurate session exipration statistics when using the persistent
    manager. (remm)
    + Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    + Fix: Mixup of WrapperListener and WrapperLifecycle elements in
    storeconfig. (remm)
    + Fix: Incorrect processing of modified users in DataSourceUserDatabase.
    (remm)
    + Update: Clarify behavior in the UserDatabase for user, role and group
    creation that it does not immediately override existing elements. Removal
    (or update) needs to be used instead. (remm)
    + Fix: 70049: Align the web application class loader with parent class
    loaders and swallow any errors caused by invalid paths when looking up
    resources and behave as if the resources were not found in that case.
    (markt)
    + Fix: Improve validation of Range and Content-Range parsers so invalid
    ranges trigger a 4xx response rather than a 500 response. Pull request
    [#1012] provided by Sahana Surendra Bogar. (markt)
    + Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off
    rather than true or false to align with httpd. (markt)
    + Fix: Reset the encoding used for query string parameters between requests
    in case an application changed the encoding in a previous request. (markt)
    + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce
    to URLs that are known not to require it. (markt)
    + Fix: Fix SSO cookie partitioned configuration. (remm)
    + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least
    one sub realm is available. (remm)
    + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
    (markt)
    + Fix: Improve the detection of cross-context dispatches when using a
    RequestDispatcher. (markt)
    + Fix: Fix various instances of double decoding of URL patterns configured
    either programmatically or in web.xml. (remm/markt)
    + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,
    which follows a purely sequential evaluation strategy. (remm)
    + Fix: Update default web.xml version to match supported Servlet
    specification version. (markt)
    + Fix: Change the default for the useRedirect attribute of the
    ProxyErrorReportValve from true to false. (markt)
    + Add: Add support for the showReport attribute in JsonErrorReportValve and
    ProxyErrorReportValve. When set to false, detailed error information
    (message, description, stack trace) is suppressed from error responses.
    (dsoumis)
    + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is
    removed but catalina-ha.jar is present and the Cluster element is enabled
    in server.xml. Cluster digester rules are now fully conditional on both
    JARs being available. (dsoumis)
    + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)
    + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list
    of reserved prefixes for SSI variables and request attributes. (markt)
    + Fix: Missing URL decoding when processing addMapping on a Servlet
    registration. (remm)
    + Fix: The Timeout WebDAV header allows comma separated values (according to
    the examples in the RFC). Use the first acceptable value. (remm)
    + Fix: Fix various issues when logging the effective web.xml for a web
    application. Empty sections are no longer logged. Special roles and empty
    authorisation constraints are included. All session cookie attributes are
    included. (markt)
    + Fix: Expand the write lock for the save process in the MemoryUserDatabase
    to avoid concurrency issues with the file save operations. (markt)
    + Fix: Ensure atomic session persistence in FileStore. Based on pull request
    [#1016] by sahvx655-wq. (markt)
    + Fix: Do not ignore methods configured on security constraints that map to
    the default servlet. (markt)
    * Cluster
    + Fix: Expand wording and increase visibility of log message when cloud
    membership is configured without a trust store as all certificates will be
    trusted in this configuration. (markt)
    + Fix: Ensure listeners are correctly added and removed when configuring the
    channel coordinator. (markt)
    + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)
    + Fix: Fix some concurrency issues in OrderInterceptor. (markt)
    + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)
    + Fix: Fix concurrency issues generating MD5 digests in the
    CloudMembershipProvider implementations. (markt)
    + Add: Add replay protection to the EncryptInterceptor. This us a breaking
    change for the EncryptInterceptor.(markt)
    * Coyote
    + Add: Log a suitable warning if an encrypted PEM file is detected using an
    insecure form for encryption. (markt)
    + Fix: If TLS groups have been configured, use the configured groups rather
    than using OpenSSL's default TLS groups when using Tomcat Native with
    OpenSSL based connectors. (markt)
    + Fix: For HTTP/2, ensure that any in progress request body reads are
    cancelled if the container resets the associated stream. This prevents
    delays waiting for reads to time out when it is known that no more data
    will be received. (markt)
    + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream
    reset do so, rather than triggered a connection close. (markt)
    + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)
    + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,
    following refactor clean-up of header buffer. (remm)
    + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)
    + Fix: Fix MessageByte.equals if called on a null MB. (remm)
    + Fix: Call the delegate key manager in JSSE to retrieve the server key.
    (remm)
    + Fix: Avoid overflow scenarios in Asn1Parser. (remm)
    + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that
    allows the consistency check for the scheme provided by the user agent to
    be bypassed. (markt)
    + Fix: isTrailerFieldsReady was always returning true. (remm)
    + Fix: Align OpenSSL/Panama TLS implementation with other implementations
    and throw an exception if there is an error loading the provided CRL(s).
    (markt)
    + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if
    @STRENGTH was encountered, ignoring any subsequent expressions. (markt)
    + Fix: Handle the case where the HTTP/2 payload length is insufficient for
    the mandatory data required by the flags set in the header. (markt)
    + Fix: 70102: Correct expected size of ticket keys when calling
    setSessionTicketKeys with an FFM connector. (markt)
    + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken
    by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)
    + Fix: When processing an OpenSSL cipher specification, fully align the
    order of the resulting ciphers with the order produced by OpenSSL. (markt)
    + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
    (schultz)
    + Update: Update both the minimum and recommended version for Tomcat Native
    2.x to 2.0.15. (markt)
    + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
    * Jasper
    + Fix: Fix possible EL argument mismatch when it was set to null. (remm)
    + Fix: Fix thread safety of TagPluginManager. (remm)
    + Fix: Correctly use flush on JSP include. (remm)
    * Web applications
    + Add: Manager: Add checks to ensure that any uploaded files are uploaded to
    the expected location. (markt)
    + Add: Manager: Add checks to ensure that the requested context path for a
    deployed WAR, directory or descriptor file is valid. (markt)
    + Add: Documentation: Expand the description of some of the attributes of
    the CrawlerSessionManagerValve. (markt)
    + Fix: Documentation: Clearer description and correct documented default for
    ocspSoftFail. (markt)
    + Fix: Fix double escaping in the context names for the JSON mode of the
    manager servlet. (remm)
    + Fix: Manager: Ensure automatic deployment does not trigger an undeployment
    during a Manager triggered web application reload. (markt)
    + Fix: Documentation: Provide better documentation for the scheme and secure
    attributes of a Connector. (markt)
    * Websocket
    + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)
    + Fix: Trigger standard WebSocket error handling if a call to
    Endpoint.onOpen() fails for a programmatic endpoint. (markt)
    + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a
    programmatic endpoint. Test case provided by uabdur. (markt)
    + Fix: If a client presents invalid parameters when negotiating a WebSocket
    extension, decline the negotiation offer that includes the invalid
    parameters rather than failing the connection. Pull request #1019 provided
    by sahvx655-wq. (markt)
    * Other
    + Fix: Use per connection authenticator when executing an Ant task.
    (remm/markt)
    + Update: Update Commons Daemon to 1.6.1. (markt)
    + Fix: Prevent duplicate log messages when clustering JARs are not present
    on startup. (csutherl)
    + Update: Improvements to French translations. (remm)
    + Update: Improvements to Japanese translations provided by tak7iji. (markt)
    + Update: Update the packaged version of the Tomcat Migration Tool for
    Jakarta EE to 1.0.12. (markt)
    + Update: Update Tomcat Native to 2.0.15. (markt)

++++ trufflehog:

  - Update to version 3.95.7:
    * [INS-407] Fixed AWS detector producing non deterministic output (#4836)
    * [INS-197] Add redhatpyxis api key detector (#4995)
    * [INS-497] Add Pganalyze Read Key Detector (#4993)
    * Expose `SecretParts` in the JSON output (#5073)
    * Add scan_all_installations option for multi-org GitHub App scanning (#4775)
    * Bump shared renovate-config to v1.0.3 (#5044)
    * Skip reverification results during deduplication (#5069)
    * huggingface: add bucket scanning (#5017)
    * [INS-406] Braintrust detector (#4826)
    * fix: add git worktree support in PrepareRepo (#4690)
    * Fix GitHub App cross-org member enumeration using per-installation tokens (#4774)
    * fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. (#5029)
    * test(handlers): point APK test fixture at trufflehog-test-assets (#5053)
    * fix(sources/filesystem): order resume comparison by path component (#5041)

++++ valijson:

  - Update to version 1.1.1:
    This is the smaller release - primarily bug fixes and small
    improvements.
    * Issues fixed in this release:
  - Guard against int64_t overflow in multipleOf integer check by
    @aizu-m in #237
  - Use locale-independent from_chars for string-to-double
    parsing by @aizu-m in #238
  - Count embedded null bytes in u8_strlen for length validation
    by @aizu-m in #236
    * Other changes include:
  - Improve Qt5 and Qt6 cross-compatibility
  - Bump to latest yaml-cpp in vendored libraries
  - Improve handling of refs for draft 7 schemas
  - Add option to preserve empty tokens in JSON pointers
  - Improve RFC 3986 coverage in URI helpers

++++ virtualbox:

  - Update to release 7.2.12
    * Fixed a Linux host kernel panic when kvm.enable_virt_at_load=0.
    * Windows Guest: Added DX11 performance improvements and fixes.
  - Switch off Python bindings completely, as we are not providing
    Python 3.11 packages for Factory anymore (bsc#1268789).
  - Undo 0666 mode change to virtualbox-60-vboxguest.rules
    [boo#1270013]

++++ virtualbox-kmp:

  - Update to release 7.2.12
    * Fixed a Linux host kernel panic when kvm.enable_virt_at_load=0.
    * Windows Guest: Added DX11 performance improvements and fixes.
  - Switch off Python bindings completely, as we are not providing
    Python 3.11 packages for Factory anymore (bsc#1268789).
  - Undo 0666 mode change to virtualbox-60-vboxguest.rules
    [boo#1270013]

++++ wolfictl:

  - Update to version 0.39.20:
    * build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#2003)
    * build(deps): bump chainguard-dev/actions from 1.6.24 to 1.6.25
    (#2004)

------------------------------------------------------------------
------------------  2026-6-30  -  Jun 30 2026  -------------------
------------------------------------------------------------------

++++ 2ping:

  - Update to version 4.6.1
    * Remove license classifier (PEP 639)
    * pyproject.toml: Fix malformed license statement
    * SPDX headers cleanup
    * flake8 fixes
    * Packaging updates
  - Removed harden_2ping.service.patch -- applied to the (now local)
    2ping.service
  - add bash completion

++++ NetworkManager:

  - Modify nfs: Exit gracefully if /etc/fstab is missing
    (bsc#1185815).

++++ accessibility-inspector:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akonadi:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akonadi-calendar:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * cppcheck knownConditionTrueFalse fix
    * cppcheck uninitMemberVarNoCtor fix

++++ akonadi-calendar-tools:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akonadi-contacts:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akonadi-import-wizard:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akonadi-mime:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akonadi-search:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Partially revert 3bb094eb

++++ akonadiconsole:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ akregator:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ alligator:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ analitza:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ angelfish:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ arianna:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ark:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ arping2:

  - Update to release 2.29
    * Respect -q when using -P
    * Prevent using -P option with MAC dest
    * Prevent using -B option being used with positional arg

++++ artikulate:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ audex:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ audiotube:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ aurorae6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ baloo-widgets:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * tagsfileitemaction: fix crash on empty selection (kde#521325)

++++ blinken:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ blog:

  - Update to version 2.44
    Harden blog and use shims units to handle plymouth
    Disable coldstart requests via epoll
    Avoid handling fd twice in epoll loop

++++ bluedevil6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ bomber:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ bovo:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ breeze6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ calendarsupport:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ calindori:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ cantor:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ colord-kde:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Add missing qqml.h include

++++ openblas_openmp:

  - disable tests for i586 as sblat tests fail

++++ openblas_pthreads:

  - disable tests for i586 as sblat tests fail

++++ openblas_serial:

  - disable tests for i586 as sblat tests fail

++++ nodejs24:

  - Update to 24.18.0 (bsc#1269825)
    * doc: update blockList stability status to release candidate
    * fs: support caller-supplied readFile() buffers
    * http: close pre-request sockets in closeIdleConnections
    * loader: implement package maps
    * net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
    * tls: add certificateCompression option
    * vfs: dispatch node:fs/promises to mounted VFS instances
    * vfs: add minimal node:vfs subsystem
  - fix_ci_tests.patch: refreshed
  - ip-address-bsc1268097.patch: dropped upstreamed

++++ crmsh:

  - Update to version 5.1.0+20260630.0c615a08:
    * fix: update cluster blocking ssh test properly via crm.conf
    * Fix: crm.conf.in: keep the section headers uncommented (#2143)

++++ darktable:

  - Remove unused flickcurl dependency (gh#darktable-org/darktable#4574)

++++ discover6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ dolphin:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * search/chip: Draw chip with QStyle instead of hardcoding Breeze
    * viewproperties: ensure not to remove defaults view properties

++++ dolphin-plugins:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ dragonplayer:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ drkonqi6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ elisa:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Change output device when global output is changed (kde#512126)

++++ eventviews:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ falkon:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Drop QTEST_DISABLE_KEYPAD_NAVIGATION from tests

++++ faugus-launcher:

  - Bump to version 1.22.7
  - Upstream changes:
    * cleanup shortcut.py
    * remove redundand DnD setup loop
    * Saves interface settings
    * replace duplicate css provider
    * Sort games even if the menu is not shown
    * Workaround for Debian icons/banners
    * refactor: (proton) stream download directly into tar extraction
    * Temporarily removed Epic Games support
    * remove unused config variables
    * remove unused icon_extracted attribute
    * remove unused _dup_handler_id assignment
    * simplify format_title call by using game.title directly
    * remove updated_steam_id attribute, use direct detect_steam_id() call
    * remove dead Tab key handler
    * remove redundand self.flowbox_child initialization
    * remove duplicate set_hexpand() call
    * remove os.chdir, replace relative games.json with absolute games_json
    * remove unused file_path
    * remove redundand isinstance check
    * remove dead code and redundant variable assignments
    * remove dead conditional that is always true in  on_settings_dialog_response
    * remove unused import
    * Remove unused parameters and dead code in backup.py and launcher.py
    * Allow UMU_USE_STEAM to be unset
    * Update utils.py
    * Update launcher.py
    * Fixed Filepicker inconsistency
    * remove unused Gdk import from backup.py
    * remove double blank lines
    * extract choose_shortcut_icon to utils.py
    * extract create_mangohud_gamemode_checkboxes to utils.py
    * extract disable_mangohud_gamemode_if_missing to utils
    * extract css provider to utils.py
    * extract ko-fi/paypal button to utils.py
    * extract duplicate addon defaults to utils.py

++++ ffmpegthumbs:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ filelight:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ flatpak-kcm6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - No code changes since 6.7.1

++++ flint:

  - Update to release 3.6.0
    * Added ``gr_poly_compose_series_kinoshita_li`` for power series
    composition in `O(M(n) \log n)` over generic rings using the
    Kinoshita-Li algorithm.
    * Added the ``padic_radix`` module implementing `p`-adic numbers
    and fields for word-size `p` in the radix representation.
    * Added ``fmpz_poly_isolate_real_roots`` and related functions
    implementing real root counting and isolation for
    ``fmpz_poly``.
    * Added many generic trigonometric power series methods
    (including ``gr_poly_sin_cos_pi_series``,
    ``gr_poly_sin_pi_series``, etc.)
    * Added ``gr_bessel_j_jet`` and ``gr_poly_bessel_j_series`` for
    computing the Bessel J-function of a power series, with
    wrappers for ``arb``, ``acb`` and ``gr_series``.
    * Add extrapolation of ``nmod_poly`` at points in geometric
    progression.
    * Added ``arb_get_simplest_fmpq``, returning the rational with
    smallest positive denominator (and then smallest numerator)
    lying in the interval.
    * Added division with remainder for Ore polynomials
    (``gr_ore_poly_divrem``, ``gr_ore_poly_div``,
    ``gr_ore_poly_rem``)
    * Added ``gr_poly_resultant_subresultant`` and
    ``gr_poly_xgcd_subresultant``, used by default over non-field
    UFDs in ``gr_poly_resultant`` and ``gr_poly_xgcd``
    * Extended ``gr_poly_factor_squarefree`` and
    ``gr_poly_squarefree_part`` to work over non-field UFDs of
    characteristic zero and over finite fields, instead of only
    fields of characteristic zero
    * Added public helper functions for fast certification that a
    matrix is singular over the integers or rationals, used to
    speed up the multimodular and Dixon solvers for ``fmpz_mat``
    and ``fmpq_mat`` on singular input.

++++ kiten:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ francis:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ geeqie:

  - Update to version 2.9:
    + bugfix release

++++ ghostwriter:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ gjs:

  - Update to version 1.88.1:
    + Closed bugs and merge requests:
  - Breaking change introduced in 1.87.1
  - maint: Check for NULL before dereferencing error_out pointer

++++ python-Glances:

  - move to the right subpackage

++++ gnome-shell:

  - Update to version 50.3:
    + Prevent workspaces from being removed mid-animation
    + Announce search result description to screen readers
    + Improve animation when expanding app grid label
    + Fix spacing in lock screen media notifications
    + Plugged leak
    + Misc. bug fixes and cleanups
    + Updated translations.

++++ gnu_parallel:

  - Update to release 20260622
    * The testsuite was reorganized

++++ granatier:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ grantlee-editor:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ grantleetheme:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ grub2:

  - grub2.spec: Use unnumbered patch tag
    https://rpm.org/docs/4.20.x/manual/spec.html#patch

++++ breeze6-gtk:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ gwenview:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ incidenceeditor:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ipxe:

  - Fix QEMU live migration (bsc#1269260) issues by match the legacy
    qemu-ipxe ROM sizes and structure. More specifically:
  - Drop i386 and aarch64 from FAT EFI ROMs
  - Compress (-ec) x86_64 EFI and inject (-b) legacy ROM
  - Add PCI class code 0x02 to EfiRom arguments
  - Pad all EFI ROMs to exactly 256KB via truncate

++++ itinerary:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Add 26.04.3 release notes
    * Also disable KCalendarCoreExtras tests with KF 6.28
    * Forward compatibility with KCalendarCore 6.28
    * Increase drawer width
    * Use QChronoTimer for timeline updates

++++ jline3:

  - Update to upstream version 3.30.14
    * Security fixes
    + fix: clamp NAWS terminal dimensions to prevent CPU exhaustion
    (GHSA-2r2c-cx56-8933, bsc#1270083)
    + fix: cap NEW-ENVIRON variable count to prevent heap exhaustion
    (GHSA-47qp-hqvx-6r3f, bsc#1269021)
  - Removed patch:
    * jline3-GHSA-47qp-hqvx-6r3f.patch
    + integrated in this version

++++ juk:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ k3b:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kaccounts-integration:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kaccounts-providers:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kactivitymanagerd6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kaddressbook:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kajongg:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kalarm:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kalgebra:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kalk:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kalm:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Port away from deprecated KLocalizedContext

++++ kalzium:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kamoso:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kanagram:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kapman:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kapptemplate:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kasts:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kate:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ katomic:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kbackup:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Appstream: Add developer

++++ kblackbox:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kblocks:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kbounce:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kbreakout:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kbruch:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kcachegrind:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kcalc:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kcalutils:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kcharselect:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kclock:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kcolorchooser:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kcron:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kde-cli-tools6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * kstart: Unset desktop file name (kde#521679)
    * Update version for new release 6.7.2

++++ kde-gtk-config6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kde-inotify-survey:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ poxml:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdebugsettings:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdeconnect-kde:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * pause music plugin: skip our own mpris interface (kde#427028)
    * core/filetransferjob: Fix automatic file renaming
    * Build for macOS also on release branches
    * Do not show connection info for disconnected devices
    * test: add regression test for CompositeUploadJob timeout path
    * Fix: add connection timeout to CompositeUploadJob to prevent port leaks (kde#516765)
    * Call FromIdentityPacketAndCert from the class, not the object (kde#519057)
    * dbusproperty: scope signal connection (fixes crash closing settings) (kde#520352)
    * Filter the addresses we advertise via mdns (kde#520453)
    * Avoid echoing phone notifications back to the phone (kde#520838)

++++ kdecoration6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kdeedu-data:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkdegames:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdegraphics-mobipocket:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdegraphics-thumbnailers:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdenetwork-filesharing:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdenlive:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Fixc thumbnails not correctly adjusting after dar change (kde#522252)
    * FIx typo
    * Ensure we don't execute unwanted commands on MLT < 7.40
    * Fix typo
    * Fix possible crash in exit
    * Fix history not cleared if clearing and closing splash
    * Fix qml warning on qml shortcuts
    * Don't try to save audio thumbs to invalid empty path (happens in tests)
    * Fix possible crash when trying to record without audio device
    * Fix fake rect not correctly initialized on add effect
    * Fix Rectangular Alpha mask keyframes
    * Fix effect with multiple color picker broken, and effect not disabled when picking (kde#521396)
    * Fix enforcing video stream in multi stream video clips (kde#505314)
    * Fix clip with mix left on incorrect subplaylist after cut
    * Fix timeline playhead going out of view while playing (kde#517494)
    * Fix crash undoing create sequence from selection
    * Fix cannot move rotoscoping shape after playing monitor

++++ kdepim-addons:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdepim-runtime:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdeplasma6-addons:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * [Vietnamese Lunar Calendar] Fix midnight JDE rounding in getLocalDayIndex (kde#522099)
    * applets/colorpicker: Fix sizing
    * Update version for new release 6.7.2
  - Enable Kameleon QMK integration, got whitelisted

++++ kdesdk-scripts:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdesdk-thumbnailers:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdevelop:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdevelop-plugin-php:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdevelop-plugin-python3:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdf:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdialog:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdiamond:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdnssd:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ keditbookmarks:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ keysmith:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Fix OTP overlaying info and delete buttons

++++ kfind:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kfourinline:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kgamma6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kgeography:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kget:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kglobalacceld6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kgoldrunner:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kgpg:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kgraphviewer:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ khangman:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ khealthcertificate:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ khelpcenter:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kidentitymanagement:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kig:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kigo:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ killbots:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kimagemapeditor:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kimap:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kinfocenter6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * about: prevent loading more than 2 devices on nvidia (kde#521295)
    * Update version for new release 6.7.2

++++ kio-admin:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kio-extras:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kio-gdrive:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kio_audiocd:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kamera:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kdesdk-kioslaves:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kirigami-gallery:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kiriki:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kitinerary:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Fix extracting multi-column VR tickets
    * 12go: Add support for extracting receipt
    * Manually extract BDZ ticket prices
    * Add polferries extractor
    * Add missing poppler include
    * Extract checkin times and prices from Accor hotel bookings
    * Fix arrival stop extraction on French-operated Flixbus tickets
    * Don't choke on missing currency symbol on IRCTC tickets
    * Attempt to support both less and more than 1000 in `irctc` PDF
    * Add price extraction for SRT (thai-railway)
    * Add price extraction for IRCTC QR ticket

++++ kjournald:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kjumpingcube:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kldap:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kleopatra:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ klettres:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ klickety:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ klines:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmag:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmahjongg:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmail:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Drop QTEST_DISABLE_KEYPAD_NAVIGATION from tests

++++ kmail-account-wizard:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmailtransport:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmbox:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmenuedit6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kmime:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Don't create headers with an empty type
    * Stricter checks for yEnc metadata field separation
    * Bump version for 26.04.3

++++ kmines:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmix:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmousetool:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmouth:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kmplot:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ knavalbattle:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ knetwalk:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ knights:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * CI: Flatpak: libplasma needs plasma-activities from master

++++ knighttime6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ koko:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kolf:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kollision:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kolourpaint:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kompare:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kongress:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ konqueror:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ konquest:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ konsole:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Fix warnings from PreviewJob

++++ kontact:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kontactinterface:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kontrast:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ konversation:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Disconnect only the necessary signal

++++ kopeninghours:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ korganizer:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kosmindoormap:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Build stable branch Flatpak against dependencies from stable branches

++++ kde-dev-utils:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kpat:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kpimtextedit:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kpipewire6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kpkpass:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kpmcore:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kpublictransport:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Add Amtrak onboard SSID
    * Optimize computing GeoJSON bounding boxes

++++ kqtquickcharts:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ krdc:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ krdp6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * server: fix portal registration by setting the correct desktop file name (kde#521264)
    * Update version for new release 6.7.2

++++ krecorder:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kreversi:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ krfb:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kruler:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksanecore:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kscreen6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kscreenlocker6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kshisen:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksirk:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksmtp:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksnakeduel:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kspaceduel:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksquares:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksshaskpass6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ ksudoku:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * main: set surface format to support legacy OpenGL (kde#521401)

++++ libksysguard6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ ksystemlog:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ksystemstats6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kteatime:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ktimer:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ktnef:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ktorrent:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ktouch:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ktrip:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ ktuberling:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kturtle:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kubrick:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * main: set surface format to support legacy OpenGL

++++ kunifiedpush:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Add missing qqml.h include

++++ kwalletmanager:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kwave:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kwayland-integration6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kwayland6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kweather:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kweathercore:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ kwin6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * backends/drm: disable hardware rotation on older AMD GPUs (kde#521764)
    * backends/drm: fix SDR MHC2 profiles with a calibration matrix (kde#522301)
    * multigpuswapchain: force linear target buffers for AMD multi-gpu copies
    * Move "mouse to focus" and "mouse to center" shortcuts to kwin core (kde#522070)
    * backends/drm: correctly transform damage to buffer-local (kde#521878)
    * Optimize querying X window shape (kde#522005)
    * scene/workspacescene: don't ignore forced software cursor for direct scanout (kde#521953)
    * wayland/outputdevice: delay done event until the output has a UUID (kde#521826)
    * backends/drm: use the native colorimetry again (kde#521759)
    * kcm_*: fix BugReportUrl
    * plugins/eis: Do not send events from release warp to capture (kde#521486)
    * backends/drm: disable unused objects even when the last output is removed
    * scene: Properly crop opaque region of subsurfaces
    * backends/drm: pre-emptively filter out udev events for non-KMS nodes
    * scene/surfaceitem_wayland: immediately update the release point of the texture (kde#521687,kde#521960)
    * Update version for new release 6.7.2

++++ kwin6-x11:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ kwordquiz:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ lact:

  - For lact.config.yaml file:
    * Update version number to 6
  - For install-guide.txt file:
    * Add more useful lact wiki links to recover from a bad overclocking
  - For .spec file:
    * Added required build dependencies for 0.9.1
    * Fix build for Leap 16.0
  - For .rpmlintrc file:
    * Exclude "unstripped-binary-or-object" warning
  - Bump to version 0.9.1
  - Upstream changes:
    * Translations update from Fedora Weblate (#991)
    * Translations update from Fedora Weblate (#1009)
    * chore: prepare for new release
    * fix: nvidia displayport2 bandwidth calculation (#1090)
    * feat: de-couple nvidia target temp from amd pmfw target temp (#1086)
    * fix: raise main window on errors
    * fix: derive V/F curve bounds from offset limits (#1083)
    * feat: add option to flatten VF curve selection (#1084)
    * chore: supress clippy warning
    * feat: QOL for displays info (#1085)
    * feat: handle VF curve without vf_tuple_base (Turing) (#1066)
    * fix: automatically clamp power cap to the allowed range on AMD (#1080)
    * fix: raise main window for apply confirmation (#1078)
    * fix: libdisplay-info dependency on debian-based systems (#1077)
    * fix: make UI tolerate power cap being reported as 0 (#1072)
    * fix: use host PATH variable when enabling AMD OD from inside flatpak (#1070)
    * feat: add displays info (#1052)
    * fix: correct nvidia fan curve pwm to percent conversion (#1055)
    * refactor: improve gui folder structure (#1047)
    * chore: use tokio local runtime instead of LocalSet (#1050)
    * chore: add another GIGABYTE 9070 XT to device_ids.json (#1049)
    * feat: add range selection feature for VF curve editor (#1032)
    * fix: gracefully handle missing get_device_api_info in daemon
    * fix: gracefully handle missing get_device_api_info in daemon
    * perf: fetch Vulkan/OpenCL info asynchronously after startup (#1046)
    * chore: bump libdrm-amdgpu
    * feat: use banner instead of dialog to signal daemon reconnection (#1044)
    * refactor: use helper methods for component launch (#1041)
    * perf: avoid unnecessary ui config rewrite on startup (#1040)
    * fix: wrap flatpak service startup with bash (#1039)
    * chore: make clippy warnings fail CI, fix them (#1038)
    * chore: move gpu test data to a shared directory (#1037)
    * feat: support amd deep sleep state (#1035)
    * feat: add custom loader (#1031)
    * Revert "WIP UI snapshot tests"
    * WIP UI snapshot tests
    * fix: missing fan curve options on nvidia (#1034)
    * feat: use revealer for graphs window edit mode toolbar (#1029)
    * feat: rework app menu using actions; add keyboard shortcuts for preferences and quit (#1028)
    * fix: fix regression with dirty init state (#1027)
    * chore: add Gigabyte RTX 4070 Ti Super WindForce Max OC to device ids (#1026)
    * perf: optimize gui bootstrap (#1023)
    * feat: remember window size (#1022)
    * feat: add hold/release cookie mechanism for profile state management (#995)
    * chore: update vulkan schema to 1.4.351
    * fix: bump flatpak sources
    * fix: bump amdgpu-sysfs with deep sleep pstate handling (#1021)
    * chore: improve p-state reads logs (#1019)
    * fix: avoid leaking amdgpu device descriptors on reload (#1020)
    * fix: bump libdrm_amdgpu_sys to 0.8.14 (#1018)
    * doc: mention nvidia VF curve in README
    * chore: add Turkish translations (#1011)
    * fix: detect typed input in clock adjustment spinbuttons (#1008)
    * feat: consolidate MessageDialogs under generic InfoDialog (#997)
    * doc: fix API documentation links (#1014)
    * chore: add debug log for p-states initial load (#1016)
    * feat: improve profile process rule selector (#1003)
    * doc: add Solus in installation section of README (#990)
    * A more detailed changelog can be found at: https://github.com/ilya-zlobintsev/LACT/releases/tag/v0.9.1

++++ lact-headless:

  - For lact.config.yaml file:
    * Update version number to 6
  - For install-guide.txt file:
    * Add more useful lact wiki links to recover from a bad overclocking
  - For .spec file:
    * Added required build dependencies for 0.9.1
    * Fix build for Leap 16.0
  - For .rpmlintrc file:
    * Exclude "unstripped-binary-or-object" warning
  - Bump to version 0.9.1
  - Upstream changes:
    * Translations update from Fedora Weblate (#991)
    * Translations update from Fedora Weblate (#1009)
    * chore: prepare for new release
    * fix: nvidia displayport2 bandwidth calculation (#1090)
    * feat: de-couple nvidia target temp from amd pmfw target temp (#1086)
    * fix: raise main window on errors
    * fix: derive V/F curve bounds from offset limits (#1083)
    * feat: add option to flatten VF curve selection (#1084)
    * chore: supress clippy warning
    * feat: QOL for displays info (#1085)
    * feat: handle VF curve without vf_tuple_base (Turing) (#1066)
    * fix: automatically clamp power cap to the allowed range on AMD (#1080)
    * fix: raise main window for apply confirmation (#1078)
    * fix: libdisplay-info dependency on debian-based systems (#1077)
    * fix: make UI tolerate power cap being reported as 0 (#1072)
    * fix: use host PATH variable when enabling AMD OD from inside flatpak (#1070)
    * feat: add displays info (#1052)
    * fix: correct nvidia fan curve pwm to percent conversion (#1055)
    * refactor: improve gui folder structure (#1047)
    * chore: use tokio local runtime instead of LocalSet (#1050)
    * chore: add another GIGABYTE 9070 XT to device_ids.json (#1049)
    * feat: add range selection feature for VF curve editor (#1032)
    * fix: gracefully handle missing get_device_api_info in daemon
    * fix: gracefully handle missing get_device_api_info in daemon
    * perf: fetch Vulkan/OpenCL info asynchronously after startup (#1046)
    * chore: bump libdrm-amdgpu
    * feat: use banner instead of dialog to signal daemon reconnection (#1044)
    * refactor: use helper methods for component launch (#1041)
    * perf: avoid unnecessary ui config rewrite on startup (#1040)
    * fix: wrap flatpak service startup with bash (#1039)
    * chore: make clippy warnings fail CI, fix them (#1038)
    * chore: move gpu test data to a shared directory (#1037)
    * feat: support amd deep sleep state (#1035)
    * feat: add custom loader (#1031)
    * Revert "WIP UI snapshot tests"
    * WIP UI snapshot tests
    * fix: missing fan curve options on nvidia (#1034)
    * feat: use revealer for graphs window edit mode toolbar (#1029)
    * feat: rework app menu using actions; add keyboard shortcuts for preferences and quit (#1028)
    * fix: fix regression with dirty init state (#1027)
    * chore: add Gigabyte RTX 4070 Ti Super WindForce Max OC to device ids (#1026)
    * perf: optimize gui bootstrap (#1023)
    * feat: remember window size (#1022)
    * feat: add hold/release cookie mechanism for profile state management (#995)
    * chore: update vulkan schema to 1.4.351
    * fix: bump flatpak sources
    * fix: bump amdgpu-sysfs with deep sleep pstate handling (#1021)
    * chore: improve p-state reads logs (#1019)
    * fix: avoid leaking amdgpu device descriptors on reload (#1020)
    * fix: bump libdrm_amdgpu_sys to 0.8.14 (#1018)
    * doc: mention nvidia VF curve in README
    * chore: add Turkish translations (#1011)
    * fix: detect typed input in clock adjustment spinbuttons (#1008)
    * feat: consolidate MessageDialogs under generic InfoDialog (#997)
    * doc: fix API documentation links (#1014)
    * chore: add debug log for p-states initial load (#1016)
    * feat: improve profile process rule selector (#1003)
    * doc: add Solus in installation section of README (#990)
    * A more detailed changelog can be found at: https://github.com/ilya-zlobintsev/LACT/releases/tag/v0.9.1

++++ layer-shell-qt6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ libkcddb-qt6:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkdcraw:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkeduvocdocument:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkexiv2-qt6:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkcddb:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkdcraw-qt5:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkscreen6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ libkmahjongg:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkgapi6:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libgravatar:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkdepim:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ mailcommon:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ mailimporter:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ mimetreeparser:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ pimcommon:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libkleo:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libksane:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libktorrent:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ plasma5support6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ libplasma6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-activities:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-activities-stats:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ libadwaita:

  - Update to version 1.9.2:
    + Build:
  - Include prebuilt styles again
  - Resolve locale directory at runtime on Windows
    + AdwApplication: Speed up initial style loading
    + AdwStyleManager:
  - Speed up initial loading
  - Check GTK version in runtime instead of build time
    + AdwSwipeTracker: Ignore mostly orthogonal touchpad scrolls
    + AdwViewSwitcherSidebar: Fix a leak
    + Stylesheet: Fix a copypaste error
    + Updated translations.

++++ marble:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Fix build on CI

++++ libfprint:

  - Add upstream patch focal-tech-support.patch to add support for
    new focal tech fingerprint reader

++++ libkomparediff2:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ libksieve:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ onnxruntime:

  - Fix build on openSUSE Leap / SLE (suse_version < 1699): re-bundle eigen.
    * The 1.26.0 refactor unbundled eigen3 assuming the system package is 5.0,
    which holds on Tumbleweed / Factory but not on Leap/SLE 16.x, which ship
    the eigen 3.4.0 release. ONNX Runtime's element_wise_ops.cc (Min/Max ops)
    calls ArrayBase::min/max<Eigen::PropagateNaN>(...); those NaN-propagation
    overloads were added on eigen's 3.4 maintenance branch *after* the 3.4.0
    tag, so the build failed to compile against the system 3.4.0.
    * Bundle the eigen 3.4-branch snapshot ORT pins in cmake/deps.txt (the same
    commit upstream consumes) for suse_version < 1699 only: drop the
    system-eigen3 find via sed and point FETCHCONTENT_SOURCE_DIR_EIGEN3 at the
    bundled source, exactly as date/onnx/SafeInt are handled. Factory keeps
    using the system eigen 5.0 unchanged. Preserves NaN-propagation semantics.
    * Make BuildRequires: eigen3-devel Factory-only (suse_version >= 1699), since
    Leap/SLE now build the bundled eigen, and add Provides: bundled(eigen3) =
    3.4.90 there accordingly.
  - Fix build on openSUSE Leap / SLE (Leap 16.0, 16.1 and 15.7), guarded by
    suse_version < 1699 so Tumbleweed / Factory keep the upstream behaviour:
    * Protobuf: Leap/SLE pull protobuf21 from SUSE:SLFO:Main, which ships no
    CMake config -- unlike Factory's protobuf21-devel, which provides
    cmake(protobuf). ONNX Runtime declares Protobuf with "FIND_PACKAGE_ARGS
    NAMES Protobuf protobuf", and the NAMES keyword forces config-only mode,
    so detection failed and the disconnected FetchContent fallback aborted
    configure. Rewrite that declare to "FIND_PACKAGE_ARGS MODULE" so CMake's
    module-mode FindProtobuf locates the standard-path protobuf Leap does
    ship (headers, libprotobuf.so, protoc) and creates the protobuf:: targets.
    * Abseil: ONNX Runtime's hardcoded ABSEIL_LIBS list is generated for abseil
    20250814 and names targets (e.g. absl::tracing_internal) absent from the
    older system abseil on Leap (20240722), which failed the CMake generate
    step. Prune ABSEIL_LIBS to the targets that actually exist; a no-op on
    Factory, whose abseil (20260107) provides all of them.

++++ openbabel:

  - Drop test fixtures with incompatible licenses (boo#1269820):
    * remove test/fuzz/FuzzedDataProvider.h and
    test/files/fuzz_regress/methane-pointgroup.g09 -- test-only
    data carrying Apache-2.0-WITH-LLVM-exception and proprietary
    Gaussian-09 output; never compiled in or shipped, removed to
    keep the source tree free of incompatible-licensed material
    * add openbabel-3.2.0-drop-incompatible-fuzz-harnesses.patch to
    unwire the fuzz harnesses that include the removed header so
    the test suite keeps building (CVE coverage retained via the
    fuzz_obconversion_{sdf,smiles} harnesses)

++++ pari:

  - Update to release 2.17.4
    * This release fixes a number cases where PARI was returning an
    incorrect result.

++++ libpisp:

  - Update to version 1.6.0
    * backend: Allow offsets to be specified as pixels or bytes.
    * backend: Add output image offset parameters.

++++ python314-core:

  - add gcc and g++ dependencies to the -devel package (and BR for
    the whole package)

++++ python314-nogil-nogil-core:

  - add gcc and g++ dependencies to the -devel package (and BR for
    the whole package)

++++ quazip-qt5:

  - Update to 1.7.2
    * Fix a pkg-config issue

++++ quazip-qt6:

  - Update to 1.7.2
    * Fix a pkg-config issue

++++ rocs:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ rpm:

  - harden ndb code [bsc#1269584] [CVE-2026-44605]
    * new patch: ndbharden.diff
  - split all plugins into subpackages
    * this allows for an easy way to get rid of a plugin, it's also
    what other distributions do
  - make the imaevmsign plugin build in a multibuild flavor
    * updated patch: imaevmsignplugin.diff

++++ seafile:

  - Update to 9.0.20 (no changelog).

++++ libtorrent:

  - Update to release 0.16.15
    * Added socket category option strings
    * Fix use-after-free in UdpRouter::disconnect_failure_unsafe
    * Validate HTTP proxy url when it is set
    * Reset HttpGet objects to ensure there is no unexpected reuse

++++ lokalize:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Update mailing lists for Norwegian translation teams

++++ lskat:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ markdownpart:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ massif-visualizer:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ mbox-importer:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ merkuro:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ messagelib:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ milou6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ minuet:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ msr-safe:

  - add fix-build-warnings.patch to fix some warnings/errors

++++ warpinator:

  - update to 2.0.4:
    * Update generated protobuf files to match our bundled
    versions.
    * warpinator-launch.py: Get rid of pre-populated google
    namespace from sys.modules.
    * appdata: Populate with initial and recent releases.
    * appdata: Mark release notes non-translatable.
    * Do not actually link to fake website (#247)
    * Set prgname to application ID (#249)

++++ neochat:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Fix crash when receiving empty reply to space job
    * Don't use QCache to store LinkPreviewers

++++ obs-service-update_changelog:

  - simplify provides/obsoletes

++++ ocean-sound-theme6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ okular:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ openQA:

  - Update to version 5.1782822561.fa3defef:
    * docs: Add paragraph describing suse_notify AMQP service
    * feat: Link to autoinst-log from details view

++++ os-autoinst:

  - Update to version 5.1782828634.82ceeb1:
    * docs: document testing custom os-autoinst forks within openQA
    * fix: mmapi test failures and infinite loop hangs
    * feat: Also output module information for wait_serial result steps
    * feat: Add module name and step number to autoinst-log
    * feat: Log the CASEDIR git url/hash for easy frontend access
    * fix: exclude virt-firmware on older Leap ppc64
  - Update to version 5.1782809557.0ae98f8:
    * docs: document testing custom os-autoinst forks within openQA
    * feat: Also output module information for wait_serial result steps
    * feat: Add module name and step number to autoinst-log
    * feat: Log the CASEDIR git url/hash for easy frontend access
    * fix: exclude virt-firmware on older Leap ppc64
    * fix: stop deepening when repo is no longer shallow

++++ otpclient:

  - Update to 5.1.1:
    * FIX: databases containing a token with an issuer but no account
    name (for example some ProtonMail or Steam entries) refused to
    open on 5.1.0 with "Could not open database: Token has a missing
    label", locking you out of the entire database. A token is now
    valid as long as it has either an account name or an issuer; the
    same rule applies to imports and manual token entry (#458)

++++ oxygen6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ palapeli:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ pam_kwallet6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ parley:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ partitionmanager:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ perl-Time-Moment:

  - Remove fix2038.patch, fixed upstream
    https://github.com/chansen/p5-time-moment/pull/48

++++ pg_top:

  - Update to version 4.1.3:
    * v4.1.3 release
    * linux: fix handling of i/o stats
    * v4.1.2 release
    * Update man page template to use version supplied by CMake
    * Add CMake rules to check for rst2man
    * Fix column display alignment on remote connections
    * More libbsd usage cleanup
    * Print connections errors to stderr
    * Fixup Linux i/o display
    * Update cmake_minimum_required
    * linux: use included tree.h
    * add tree.h
    * linux: increase size of some i/o columns
    * build-appimage: podman run with --userns=keep-id

++++ picmi:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ pim-data-exporter:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ pim-sieve-editor:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ plasma-camera:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ plasma-phonebook:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * Add missing KI18n find_package call

++++ plasma-settings:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ plasma6-bigscreen:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * bigscreen: Add back handler attached property for consistent back handling
    * session: stop forcing EGL_PLATFORM=wayland
    * inputhandler: expose CEC send methods over D-Bus
    * Update version for new release 6.7.2

++++ plasma6-openSUSE:

  - Update to 6.7.2

++++ plasma6-browser-integration:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-desktop:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * KCMMouse: fix some layout issues (kde#521992)
    * Don't make warnings fatal in kcm_kded test
    * Don't import desktoptest in kcm_kded appium test
    * Drop bug482267 test
    * FolderView: More robust drop url generation (kde#521713)
    * WorkspaceOPtions: fix warnings
    * applets/kickoff: add selection highlight for SectionView (kde#522154)
    * applets/kickoff: correctly show highlight in the Places page
    * Update version for new release 6.7.2

++++ plasma6-disks:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-firewall:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-integration:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-keyboard:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * fix(overlay): allow clients to receive actual key events (kde#519339,kde#521128,kde#521718,kde#521772,kde#521789,kde#521872,kde#522024,kde#522152,kde#522167)
    * Update version for new release 6.7.2

++++ plasma6-mobile:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-nano:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-nm:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Fix overflow in network details (kde#522333)
    * Bump QtKeychain dependency
    * vpn/openconnect: Make Connect button more obvious
    * kded: Do not try to send DBus errors when handling a no reply request
    * Update version for new release 6.7.2

++++ plasma6-pa:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-print-manager:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * [print-queue] Elide job processing message
    * Update version for new release 6.7.2

++++ plasma6-sdk:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-workspace:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * plasma-windowed: Check for SNI being null
    * applets/devicenotifier: Check StorageAccess being null (kde#522051)
    * runners/bookmarks: Set minimum letter count to 2
    * runners/bookmarks: Recreate cache dir if it was removed before
    * runners/bookmarks: Load favicon only when match actually matches
    * Update version for new release 6.7.2

++++ plasma6-systemmonitor:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * processtable: Remove unnecessary separator
    * table: Hide the icon for processes in tree mode if it is empty (kde#442095)
    * Update version for new release 6.7.2

++++ plasma6-thunderbolt:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - No code changes since 6.7.1

++++ plasma6-vault:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasma6-welcome:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2
    * Fix i18n error (kde#522147)
    * Update version for new release 6.7.2

++++ plasma6-workspace-wallpapers:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ plasmatube:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ plymouth-theme-breeze6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ polkit-kde-agent-6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ postsrsd:

  - Update to release 2.2.3
    * Add per-process tracking of child processes.
    * The `srs-domain` configuration option is implicitly added to
    the list of local domains now.
    * Work around unsafe domains file updates which cause a race
    condition in the inotify-based file watch.
    * `reverse` no longer rejects (socketmap PERM / milter reject)
    SRS addresses whose domain is not local.
    * Stop rejecting invalid SRS addresses for socketmap queries.

++++ powerdevil6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ python-GitPython:

  - Update to version 3.1.50:
    * bump version to 3.1.50
    * Validate config key section names before writing
    * Bump git/ext/gitdb from `335c0f6` to `53c94d6`
    * Xfail Windows symlink-capable index mutation test
    * Bump https://github.com/astral-sh/ruff-pre-commit
    * fix: support Repo() autodiscovery from linked worktree GIT_DIR
  - Update to 3.1.50:
  - Fix Repo() autodiscovery in linked worktrees when GIT_DIR is set
  - Validate config key names before writing

++++ python-caio:

  - Update to 0.10.1:
    * Add a new io_uring backend (linux_uring /
    linux_uring_asyncio), selectable as the "uring" variant,
    giving a high-performance asynchronous file I/O
    implementation on modern Linux kernels in addition to the
    existing libaio, thread-pool and pure-python backends
    * Fix undefined-symbol build/link failures across different
    compilers and platforms by removing the inline qualifier
    from the io_cancel and io_submit_error helpers
    * Declare the package license as Apache-2.0 in the project
    metadata
  - Switch Source to the upstream GitHub release tarball as
    0.10.x is not (yet) published on PyPI
  - Add fix-version-info.patch to correct the stale version
    declaration (0.9.25) in caio/version.py shipped by the tag

++++ python-cyclopts:

  - Update to 4.20.0:
    * Add "cyclopts tree" command and App.command_tree() to print
    the command hierarchy
    * Add Parameter.short_alias to automatically generate short
    aliases for parameters
    * Add ArgumentCollection.filter_by(missing=...) for required or
    conditionally-required fields
    * Fix a leading-hyphen parsing regression
    * Propagate consume_multiple to nested structured-type fields

++++ python-jupyter-server:

  - Update to 2.20.0 (CVE-2026-44727, bsc#1269630):
    [#] Security fixes
  - CVE-2026-44727 GHSA-fcw5-x6j4-ccmp
    [#] Enhancements made
  - Fix confusing terminal output when using ServerApp.ip=0.0.0.0
    [#1643]
  - Add a toggle to enable curve encryption for all kernels that
    support it #1638
    [#] Bugs fixed
  - Grab the port from bind_sockets in case its different #1651
    [#] Maintenance and upkeep improvements
  - Fix test_authorizer having a spurious comma in params #1664
  - Add a reminder to merge GHSA before release #1659
  - Exclude problematic pywinpty 3.0.4 version #1658
  - ci: explicitly pass base-setup inputs to fix strict validation
    failures #1626
    [#] Documentation improvements
  - Align docs for curve encryption with latest JEP version #1660
  - Remove PGP key from docs #1653

++++ python-mcp:

  - Update to 1.28.1:
  - [v1.x] Buffer per-request StreamableHTTP streams; store
    priming event before dispatch by @maxisbey in #2948
  - [v1.x] Set Development Status classifier to Production/Stable
    by @maxisbey in #2976
  - [v1.x] Support TransportSecuritySettings in the WebSocket
    server transport by @maxisbey in #2992
  - Update to 1.28.0:
  - Deprecations
  - Two API surfaces now emit DeprecationWarning ahead of their
    removal in v2. Nothing is removed in 1.x, and the warnings
    fire only when the deprecated API is called - importing the
    modules stays silent.
  - WebSocket transport - mcp.client.websocket.websocket_client
    and mcp.server.websocket.websocket_server. WebSocket was
    never part of the MCP specification; use the streamable
    HTTP transport instead. The TypeScript SDK has likewise
    removed its WebSocket client for v2
    (modelcontextprotocol/typescript-sdk#1783).
  - Experimental tasks API - ClientSession.experimental,
    Server.experimental, ServerSession.experimental, and the
    experimental_task_handlers= kwarg on ClientSession. Tasks
    (SEP-1686) were removed from the MCP specification and are
    expected to return as a separate MCP extension.
  - If your test suite runs with filterwarnings = ["error"] and
    exercises these paths, add a scoped ignore such as ignore:The
    experimental tasks API is deprecated:DeprecationWarning or
    ignore:The WebSocket .* transport is
    deprecated:DeprecationWarning.
  - See #2828 for full details.
  - What's Changed
  - [v1.x] Support Python 3.14 by @maxisbey in #2769
  - fix: omit null optional fields from task result payloads by
    @liuzemei in #2809
  - [v1.x] Deprecate the WebSocket transport and the
    experimental tasks entry points by @maxisbey in #2828
  - [v1.x] Add a v2 status banner to the README by @maxisbey in
    [#2835]
  - [v1.x] Deflake the child process cleanup tests by @maxisbey
    in #2839
  - Drop python-uv as dependency from python-mcp, as the tests run
    through without it and we don't pull it into Ring 1 as dependency

++++ python-pydata-sphinx-theme:

  - CVE-2026-13676: fast-uri: failure to canonicalize Unicode/IDN hostnames
    for HTTP-family URLs allows for bypass (bsc#1269597)
    * revendor the vendored tarball with updated versions

++++ python-rich-rst:

  - Update to 2.0.2:
    * Fix incorrect rendering of bullet lists

++++ python-xmlschema:

  - Update to 4.3.2
    * Fix for issues #473, #474 and #475
    * Add Georgian language (PR #476)

++++ python314:

  - add gcc and g++ dependencies to the -devel package (and BR for
    the whole package)

++++ python314-documentation:

  - add gcc and g++ dependencies to the -devel package (and BR for
    the whole package)

++++ python314-nogil:

  - add gcc and g++ dependencies to the -devel package (and BR for
    the whole package)

++++ qmlkonsole:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ qqc2-breeze-style6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ qrca:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ redmine-mcp:

  - Initial package (version 2026.1.13.152335)

++++ rtorrent:

  - Update to release 0.16.15
    * Deprecated commands: network.open_sockets,
    network.max_open_sockets, network.max_open_sockets.set,
    network.http.max_total_connections.set,
    network.max_open_files.set
    * Global network socket commands (e.g.,
    network.max_open_sockets) are now deprecated. Socket
    allocation is managed granularly via Socket Categories:
    generic, http, internal, rpc, and files.
    (e.g. new commands: system.sockets.<category>.size, .max_size,
    .min_alloc/.max_alloc)

++++ sbcl:

  - Update to 2.6.6
    * minor incompatible change: FDEFINITION now returns the outermost wrapper
    (added e.g. by TRACE, PROFILE) like SYMBOL-FUNCTION.  (lp#799533)
    * minor incompatible change: in unsafe code, C strings with :EXTERNAL-FORMAT
    :ASCII are copied directly as byte-sized quantities without checking
    whether the top bit of the byte is set.
    * platform support:
    * * fix the build on big-endian 64-bit PowerPC with ELFv2.  (thanks to
    Piotr Kubaj)
    * * move the static space address for macOS 27 on ARM64.  (lp#2156072,
    reported by Gary Palter)
    * * optimizations to SB-THREAD:BARRIER for ARM64.  (thanks to Sahil Kang)
    * * fix a compiler crash in MULTIPLE-VALUE-LIST in argument forms on ARM64.
    (lp#2155788, reported by Gary Palter)
    * bug fix: TRACE no longer fails when trying to print a return value that
    cannot be printed readably and *PRINT-READABLY* is true.
    * optimization: the compiler is more precise in its type derivation of
    COERCE given constraints on its inputs.
    * optimization: the compiler is better able to derive the return types of
    AREF and ELT.
    * optimization: faster encoding and decoding of UTF-8 C strings.
    * optimization: (length (intersection a b)) doesn't cons an intermediate
    list.
    * documentation: the manual now includes a section for SB-INTROSPECT, which
    has also seen improvement in its documentation strings and comments.
    * documentation: fixed many typesetting problems and typos in the user
    manual.

++++ scx:

  - Update cargo vendor
  - Remove explicit BuildRequires: lld
  - Enable cargo_vendor filter
  - Restrict build to Rust tier1 arches: others are untested, beside
    failing in build

++++ sddm-kcm6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ seafile-client:

  - Update to 9.0.20 (no changelog)
  - Drop upstreamed issue1650.patch

++++ signon-kwallet-extension:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ skanlite:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ skanpage:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ skladnik:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ solaar:

  - Update to version 1.1.20:
    * Add Irish translation
    * Don't use old settings when reusing sboxes
    * Add POUND and ISO_BACKSLASH cells to MAIN_ISO key layout
    * Wrap argv in list for Gio.Application.run (PyGObject 3.56)
    * Mock libnotify to not perform notifications when doing tests
    * Isolate testing from real configuration file
    * Update handling of headset RGB controls
    * Update equalizer processing
    * Hide read-only paramaters from the UI
    * Better support for G522 Lightspeed headset
    * Use mostly full names for direct-USB codenames
    * Use correct icon for CENTURION devices
    * rgb_control: honor the off state — don't auto-claim, init, or shutdown LEDs
    * base: fix sw_id at 0x0B instead of rotating 0x2..0xF (#3218)
    * perkey/canvas: allow rect/gradient anchors in grid gaps
    * config_panel: don't show failed-write alert for unreadable settings
    * listener: share bluez-watch wiring across Centurion-direct and standard device paths
    * rgb_power.perkey_has_paint: gate on IGNORE only, not on != True
    * about: add Ken Sanislo to Additional Programming credits
    * Add RGB lighting persistence and software LED power management for G515
    * ui: Show offline status for receiver-paired device batteries (#3217)
    * LEDControl / RGBControl: render as Gtk.Switch instead of a 2-option combo (#3215)
    * device: Fix operator precedence bug and end-of-configuration timing in device.changed() (#3173)
    * PerKeyLighting: drop misleading live-read output in solaar show
    * perkey: label G502 X LEDs by zone id, not letter
    * PerKey gradient swatch: align gradient endpoints to visible corners
    * PerKey gradient swatch: Tabler "square" outline around the gradient
    * PerKey dialog: one window per device, keyed by firmware unit-id
    * PerKey dialog: size window from measured natural size
    * PerKey icons: read theme fg from style-updated, not Settings notify
    * PerKey canvas: symmetric hash stripes for unset cells
    * PerKey palette: replace hashed unset swatch with palette-off icon
    * PerKeyEditor: rebuild tool icons on GTK theme change
    * PerKeyEditor: replace tool button labels with icons
    * common: render RGB color values as 0xrrggbb in config and solaar show
    * Better display of LED effects for some devices in solaar show.
    * Fix bug affecting using solaar config to change range-based settings.
    * Add regional keyboard layouts
    * Use per-key RGB color painter
    * Fix bug in notification flag handling
    * Fix bug in HID parser
    * Update Swedish, German, Polish, Chinese, and French translations
    * Use battery-level-N icons when available
    * Document haptic capabilities
    * Support per-slot unpair on Lightspeed receivers
    * Fix bugs related to integer flags in older versions of Python
    * Add mention of Centurion protocol support
    * Treat empty hidraw read as device removal (EOF) (#3174)
    * fix interface for K845
    * support PRO X 2 LIGHTSPEED headphones Centurion features (#3150)
    * Fix crash in NotificationFlag.flag_names when flags is None (#3185)
    * Add PRO X 2 Superstrike mouse support with HITS tuning settings (#3132)
    * Add names for some HID++ 2.0 features and sort by ID (#3153)
    * Don't use Logitech for codename
    * Put lock around getting device name
    * Fix bug when showing device notification flags
    * Be defensive about no device features
    * Add feature x1b04 flag sent by M510 4004
    * Remove incorrect descriptor for WPID 4004
    * Better handling of missing devices
    * Improve RHEL installation guide and add automated install example (#3162)
    * Remove use of XTest and use uinput in all cases
    * Add installation guide for Solaar on RHEL 10 (#3158)
    * Use console_scripts entry point for pipx compatibility
    * Skip Logitech webcams to prevent them from locking up during HID++ checks on Macs
    * Downgrade ping no such device to informational log entry
    * Recover from guessing the wrong number for direct-connected HID++ 1.0 devices
    * Tolerate devices with no unitId
    * Correctly handle timeout in Bolt discovery
    * Update or add fr, pt_BR, sk, Ukrainian, Finnish, Bulgarian translations
    * Handle missing receiver_path more gracefully
    * Handle inaccessiable devices when determining protocol
    * Be defensive when showing features in solaar show

++++ spectacle:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ step:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ stgit:

  - Update to gix 0.85 and enable sha256 feature (bsc#1262997):
    0001-Update-to-gix-0.85-and-enable-sha256-feature.patch
  - Legal review: license correction to GPL-2.0-only
    See the project site for reference.

++++ svgpart:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ sweeper:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ transmission:

  - Update to version 4.1.3:
    + This is Transmission 4.1.3, a bugfix release. It fixes a
    potential CRSF security issue for users who enable remote
    access to Transmission. Users are encouraged to upgrade to this
    version.
    + All Platforms:
  - Fixed a CORS bug that leaked the anti-CSRF nonce.
  - Fixed a use-after-free bug in peer code.
  - Fixed build error when compiling with fmt 12.2.0.
    + Everything Else: Fixed a 4.1.2 build error in tests.

++++ systemsettings6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ telly-skout:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ tftp:

  - update to 5.3:
    * tftp: convert IPv6-mapped IPv4 addresses to IPv4
    * tftpd: Canonicalize all the addresses
    * tftpd: Canonicalize myaddr before address_is_local()
    * recvfrom: update config.h define for in_pktinfo.ipi_addr
    * Modernize: use sigaction() whenever possible. Remove uses of common.
    * tftpd.8: document IPv6 handling in remapping rules
    * tftp: drop "inline" from definition of usage()
    * tftpd: explicitly declare timer() static
  - drop tftp-c99.patch: obsolete
  - drop tftp-multi-addresses.patch: upstream (differently)

++++ tmux:

  - tmux 3.7:
    * Add floating panes.
    * Add -g to kill-session to kill all sessions in a session group
    * When mode-keys is set to vi, do not allow the cursor to go into the
    invisible extra cell to the right of the visible text; this is closer to
    what vi(1) does.
    * Add emacs-style recentre-top-bottom command to copy mode.
    * Add support for line numbers in copy mode.
    * Make C-[ have the same bindings as Escape for terminals with extended
    keys where they are different.
    * Add ability to forward progress bar to outside terminal.
    * Add detach to default session menu.
    * Add -C flag to command-prompt to match display-message -C (do not freeze
    panes).
    * Add remain-on-exit key to keep pane around until a key is pressed.
    * Add some new mouse ranges called "control0" to "control9" and use to add
    some mouse controls to the pane state line.
    * Add bracket_paste_flag format flag.
    * Copy hyperlinks when redrawing popup so they do not vanish.
    * Work around systemd killing panes early during system shutdown by creating
    dependencies from the panes to the service which started tmux.
    * Draw message as one format, allowing prompts and messages to occupy only a
    portion of the status bar, overlaying the normal status content rather than
    replacing the entire line. A new message-format option now controls the
    entire message (like status-format). The message-style option now need to
    include "fill" in order to cover the whole width (the default has
    "fill=yellow").
    * Add pane_pipe_pid with pipe file descriptor.
    * Make -c work with new-session -A.
    * Pass paste buffer through vis(3) when pasting to prevent buffers containing
    for example the bracket end sequence causing issues, a new -S flag
    disables.
    * Add sorting (-O flag) and a custom format (-F) to list-keys.
    * Add scroll-exit-on, scroll-exit-off, scroll-exit-toggle commands to copy
    mode.
    * Refresh copy mode when style changes.
    * Make sorting code common and add -O for sorting to the list commands.
    * Add -e flag to command-prompt to close if empty.
    * Add paste to the default pane menu.
    * If cannot find a terminator for palette responses, treat as a partial key
    not complete.
    * Do not send theme unless it has changed, and do not send immediately when
    updates are enabled.
    * Do not use ;;s in list-keys output as it is confusing and cannot be parsed
    on input.
    * Redraw pane borders when entering or leaving alternate screen.
    * Add focus-follows-mouse option.
    * Add selection_mode format variable for copy mode.
    * Add prompt-command-cursor-style.
    * With status-keys vi, move the cursor left by one when pressing Escape to
    enter command mode, like vi.
    * Add {current}/{active} for -t for current window or active pane.
    * Add support for applications to use synchronized output mode (DECSET 2026)
    to prevent screen tearing during rapid updates.
    * Do not set a default prompt cursor colour because some terminals (urxvt,
    st) do not support the reset sequence.
    * Add a scroll-to-mouse command for copy mode to scroll to the mouse position
    and bind to the scrollbar, brings the scrollbar keys into line with the
    other mouse keys.
    * Add a missing skin tone character.
    * Do not show scrollbar when entering copy mode from a pane in the alternate
    screen.
    * Add a get-clipboard option which when enabled (the default is off) and a
    clipboard is requested from a pane, requests it from the terminal and
    forwards to the requesting pane; also remove the now-redundant
    forward-to-pane ability from "refresh-client -l" (issue 4275).
    * Do not remove TERM for commands run from config file
    * Add seconds options for clock mode

++++ tokodon:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - Changes since 26.04.2:
    * appdata.xml: add desktop and mobile as supported platforms

++++ umbrello:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ union6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ vermouth:

  - Fix "unstripped-binary-or-object" warning for vermouth
  - Bump to version 1.9.5
  - Upstream changes:
    * Update translations, fix creating cache dirs
    * Updated sums and commits

++++ virt-firmware:

  - Clean up SPEC file.
  - Add python3-base BR.

++++ vkSumi:

  - Update to v0.0.7:
    * Flatpak Support: Added Flatpak manifest and CI/CD integration.
    * Layer Improvements: Implemented optional $LIB-relative library_path support.
    * Environment Configuration: Added _FILE suffix support to CONFIG_PATH.
    * Path Expansion: Added support for expanding paths using ~, $HOME, and $USER.
    * PKGBUILD: Updated reference PKGBUILD.
    * Fix RPMLINT warning "unstripped-binary-or-object" for libVkLayer_vksumi.so
    by ensuring build system flags/stripping are properly handled during
    %build/%install.

++++ vokoscreenNG:

  - update to 4.10.0:
    * Code: Fixed deprecation warnings
    * Wayland: Audio change from Pulse to PipeWire
    * Wayland: Camera added based on PipeWire
    * Qt: Minimum version is now 6.9.0
    * ShowClick: Images color-matched to the GUI
    * Halo: Images color-matched to the GUI
    * Wayland: Added Discover to log for all converted formats
    * Wayland: Tmp dir was not removed
    * Feature and Bugfix-Release 4.9.0 from Apr 01, 2026
    * Windows: The Start button was active when Cisco OpenH264 was inactive
    * Windows: When selecting gif, H.264 was also incorrectly offered
    * Wayland: Tool button area reset is not always enabled when necessary
    * Wayland: Added minimized when record starts
    * Wayland: Added buttons for snapshot
    * Wayland: Systray does not display correctly after countdown
    * Wayland: During a pause, the recording time continued to run
    * Wayland: Added log controller
    * Wayland: Separate ini for the settings
    * Wayland: The snapshot dialog was not displayed by default in systray
    * Wayland: The Systray was not displayed by default
    * Wayland: Most connects changed from runtime to compile time
    * Windows: GStreamer changed from 1.26.10 to version 1.28.1
    * Wayland: Settings and log
    * Snapshot: Messagebox info text
    * Snapshot: Save path settings
    * Snapshot: Changed write permisson
    * Snapshot: Changed QMessagebox->exec to show
    * Log: Added picture path
    * Translation: Updated

++++ wacomtablet-kcm6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * Update version for new release 6.7.2

++++ wlr-sunclock:

  - pedantic-fix.patch: fixes build against current gcc ...

++++ xclock:

  - Update to version 1.2.0
    * This release adds new command line options -proportional, -analog24,
  - help, --help, -version, and --version; and new X resources
    analog24, amColor, pmColor, fixed1Color, fixed2Color, fixed3Color,
    hourShape, minuteShape, secondShape, majorShape, minorShape,
    amShape, pmShape, fixed1Shape, fixed2Shape, fixed3Shape, rotateAmpm,
    zOrder, and proportional.  See the updated man page for details of each.
    * It also adds support for building with meson as well as autoconf.
  - switch to meson

++++ xdg-desktop-portal-kde6:

  - Update to 6.7.2:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.2
  - Changes since 6.7.1:
    * screencast: connect stream closed() on m_streams, not the moved-from vector
    * Update version for new release 6.7.2

++++ xedit:

  - re-integrated previous changes
  - Update to version 1.2.5
    * This release adds support for building with meson as well as autoconf.
  - switch to meson

++++ xfontsel:

  - Update to version 1.1.2
    * This release adds support for building with meson as well as
    autoconf.

++++ yakuake:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

++++ zanshin:

  - Update to 26.04.3
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.3/
  - No code change since 26.04.2

------------------------------------------------------------------
------------------  2026-6-29  -  Jun 29 2026  -------------------
------------------------------------------------------------------

++++ PrusaSlicer:

  - Update to version 2.9.6
    * ColorMix support
    * See https://github.com/prusa3d/PrusaSlicer/releases/tag/version_2.9.6

++++ ServiceReport:

  - Update to version 2.2.4+git12.bc007b2 (bsc#1270052 ltc#218889):
    * [kdump] Fix TypeError in kdump component check

++++ alloy:

  - CVE-2026-10722: Fix manipulated argument offset leading to
    integer overflow (bsc#1267811)
    * Add 0001-Fix-CVE-2026-10722.patch
  - Update to version 1.17.1:
    * Bug fix
    Back off usage reporting on persistent failure instead of
    retrying every minute

++++ amazon-cloudwatch-agent:

  - Update to version 1.300069.0
    * [ApplicationSignals] Add Application Signals logs pipeline translator
    and allow metric routing to otlp endpoint by @jj22ee in (#2111)
    * [EFA] Add support for configuring EFA receiver on EC2 via JSON
    by @mitali-salvi in (#2093)
    * [OTel Container Insights] Add OTEL CI logs agent components
    by @louisall in (#2113)
  - from version 1.300067.0
    * [OTel Container Insights] OTLP ksm node enrichment by @louisall in (#2072)
    * [ApplicationSignals] Add application-signals routing rules to
    awsproxy translator by @liustve in (#1979)
    * [Core] Wait for server shutdown on port 4311 by @pete911 in (#1957)
  - Drop update-apache-thrift.patch, fixed upstream

++++ amazon-ecs-init:

  - Update to version 1.105.0
    * Feature - feat(acs-model): Add LogDriverVolumeConfiguration to ACS
    Volume shape (#5005)
    * Enhancement - Removed cloudwatch from windows agent capabilities (#5002)
    * Enhancement - Update Go version to 1.25.11 (#5003)
    * Enhancement - Update golang.org/x/net to v0.56.0 (#5004)
    * Enhancement - Add IsolatedDebugPlatform with DNS field backfill (#4998)
    * Enhancement - enhancement: Migrate EBS CSI Driver image to AL2023 (#4979)
    * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.29.14
    to 1.32.23 in /agent #4997
    * Enhancement - Detect cloud-init failure at startup to prevent silent
    cluster misconfiguration (#4988)
    * Enhancement - Add isolated_linux platform for isolated container
    networking (#4991)
    * Enhancement - Emit failure metrics from IMDS credentials scanner (#4995)
    * Enhancement - Update SSM GPG key for ECS Anywhere installation (#4992)
    * Enhancement - Add Host type and BuildHosts to populate netNS.Hosts (#4985)
    * Bugfix - Fix TestClientProxy to obtain available port dynamically (#4999)
    * Bugfix - Fix flaky TestDPEAndACSConnFailureTrackerTracking nil
    pointer panic (#4993)
  - Bump Go version to 1.25.11

++++ apache-parent:

  - Update to 39:
    * New features and improvements
    + add push-to-atr profile
    * Maintenance
    + configure ATR project
    + Aligns the properties for Surefire
    * Dependency updates
    + Bump org.apache.maven.plugins:maven-dependency-plugin from
    3.10.0 to 3.11.0
    + Bump version.maven-surefire from 3.5.5 to 3.5.6
    + Bump org.apache.maven.plugins:maven-site-plugin from 3.21.0
    to 3.22.0
    + Bump org.apache.maven.plugins:maven-enforcer-plugin from
    3.6.2 to 3.6.3

++++ apptainer:

  - Enable building of SUID starter for SLES 15 (jsc#PED-16347).

++++ attr:

  - Update to 2.6.0:
    Major Issues Fixed:
  - The libacl library functions acl_get_file(), acl_set_file(),
    acl_extended_file(), and acl_delete_def_file() take a pathname argument
    and follow symbolic links.  When a privileged user calls one of those
    functions, an attacker that controls a pathname component can replace a
    file or directory with a symbolic link and redirect the operation to a
    different file.  This can lead to local privilege escalation.
    The library functions cannot be fixed without breaking compatibility; the
    described behaviour is by design.
    Instead, version 2.4.0 of the acl package introduces the additional
    functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
    acl_delete_def_file_at().  These functions each take a dirfd file
    descriptor argument and an at_flags argument and accept the
    AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags.  Use these functions to
    control when to follow symbolic links.
    In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
    acl_extended_fd() functions always operate on the access ACL; the library
    previously did not offer a way to operate on the default ACL of a directory
    file descriptor.  The new functions remove that restriction.
    It will be up to each individual program to start using these new library
    functions where appropriate.
  - When walking directory trees, the getfacl, setfacl, chacl, and getfattr
    utilities constructed the full pathname of each file in the tree
    and use that
    pathname to access the file.  When a privileged user used those utilities,
    an attacker that controlled a pathname component could replace a
    directory with
    a symbolic link and redirect the operation to a different file, leading to
    a local privilege escalation.
    This is fixed by using directory file descriptors and operating relative to
    those directory file descriptors.
  - When resolving the final pathname component, the getfacl, setfacl, chacl,
    getfattr, and setfattr utilities in some cases used functions that resolve
    symbolic links.  This includes the above mentioned libacl functions, but
    also stat(), chmod(), and chown().
    This is fixed by using symlink-safe functions throughout the code.
  - When restoring a backup, the setfacl and setfattr utilities read the full
    pathnames of files from the backup.  When those pathnames were resolved,
    pathname components that are symbolic links were traversed.  An attacker
    that controlled a pathname component could replace it with a symbolic link,
    causing a privileged user to operate on a file other than the one intended.
    This could lead to the same kind of local privilege escalation as discussed
    before.
    This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
    directory components of a pathname, but see Compatibility Notes below for
    the details.
    Minor Issues Fixed:
  - When a symbolic link was specified on the command line but symbolic link
    traversal was disabled using option -P (--physical), the getfacl and
    setfacl utilities previously silently ignored the symlink.  Now, an ELOOP
    ("Too many levels of symbolic links") error will result instead.
  - acl_delete_entry() now verifies that the specified entry belongs to the
    specified acl.
  - Numeric uids and gids that cannot be represented in types uid_t and gid_t
    are checked more carefully and invalid numbers are rejected.
  - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
    several times when the size of an ACL grows unexpectedly; previously, they
    only grew the allocated buffer once before giving up.
  - When passed a directory file descriptor, function perm_copy_fd() didn't
    copy the default ACL from one directory to the other.  It now does.
  - setfacl --restore accidentally ignored leading whitespace in filenames.  It
    no longer does.
  - setfacl --restore accidentally called chmod() when in --test mode.  It no
    longer does.
  - When the setfattr --restore option was used multiple times, a buffer was
    accessed after being freed. This no longer happens.
  - When the setfattr -h (--no-dereference) option was given after --restore,
    it was ignored.  Now, the options can be passed in any order.
  - The -h (--no-dereference) option of getfattr prevented getfattr from
    recursing into "symbolic link directories".  This is wrong.  When dirlink
    is a symbolic link that refers to a directory, "getfattr -Rh
    dirlink" will now
    visit that directory.  The -P (--physical) option can be used to prevent
    that.
  - Similarly, when a symbolic link referring to a directory was specified on
    the getfacl or setfacl command line, the -R option did not cause that
    directory to be visited.  This has been fixed so that those directories
    will now be visited.  The -P (--physical) option can be used to prevent
    that.

++++ blog:

  - Correct latest changes of 2.43

++++ bottom:

  - Update to version 0.14.2:
    * other: fix schema crate interfering with installs (#2109).

++++ bugzilla-mcp:

  - Rename python-bugzilla-mcp to bugzilla-mcp; build as a single-flavour
    application and add Provides/Obsoletes: python313-bugzilla-mcp for clean
    migration
    * build against %{primary_python} instead of a hardwired python313 flavor

++++ buildkit:

  - Update to version 0.31.1:
    * Dockerfile: allow cross-compilation without binfmt helper
    * user: limit size of parsed passwd/group files
    * security: validate exec security modes
    * feat: not fail on non-default ports
    * ci: pin js-yaml install
    * ci: tolerate empty test matrix includes
    * vendor: migrate to github.com/gohugoio/hashstructure
    * util/tracing: remove fallbacks for OTEL_TRACE_PARENT, OTEL_TRACE_STATE

++++ nextcloud-desktop:

  - Update to version 33.0.7:
    * Fix build error with OpenSSL 4.0
    (gh#nextcloud/desktop#10229)
    * Prevent app nap and silent termination
    (gh#nextcloud/desktop#10232)
    * Read OCC_UPDATE_URL only for development builds
    (gh#nextcloud/desktop#10241)
    * Remove gap after status messages
    (gh#nextcloud/desktop#10246)
    * Improve end‑to‑end encryption
    (gh#nextcloud/desktop#10248)
    * Manually port changes from PR #10252
    (gh#nextcloud/desktop#10256)
    * Confine enumeration logic
    (gh#nextcloud/desktop#10261)

++++ container-selinux:

  - Introduce container_can_execstack boolean for older Java applications
    and allow execmem (bsc#1268490)
  - Add patch: allow-spc_t-execstack-via-boolean-and-execmem-bsc-1268490.patch

++++ coreboot-utils:

  - Update to version 26.06:
    * https://coreboot.org/releases/coreboot-26.06-relnotes.txt

++++ gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cpupower:

  - Fix broken EnvironmentFile path in cpupower service config file
    bsc#1269478
  - Introduce cpupower-rpmlintrc to suppress devel dependency error
    A cpupower-rpmlintrc

++++ go-containerregistry:

  - update to 0.21.7:
    * tarball: return error instead of panicking on missing
    rootfs.diff_ids
    * gcrane: honor --platform flag in copy
    * mutate: verify layer digests in Extract and Time
    * tarball: close layer readers during Write
    * build(deps): bump the actions group across 1 directory with 2
    updates
    * build(deps): bump github.com/docker/cli from
    29.4.3+incompatible to 29.5.2+incompatible in the go-deps
    group across 1 directory
    * BUGFIX: Fail with error when read exceeds maximum
    * build(deps): bump the actions group across 1 directory with 2
    updates
    * fix(name): anchor loopback registry detection
    * Reject symlinks in OCI layout blobs
    * fix(crane): avoid creating export tar on pull failure
    * feat(kubernetes): allow ignoring pull secrets
    * fix(name): preserve localhost registry references
    * pkg/registry: export ErrNotFound
    * pkg/registry: export RedirectError
    * build(deps): bump the go-deps group across 1 directory with 2
    updates
    * build(deps): bump the actions group across 1 directory with 2
    updates
    * fix: prevent SSRF in google.List() pagination
    * internal/gzip: fix goroutine leak in ReadCloserLevel
    * fix(transport): apply refreshed bearer token after cross-host
    redirect
    * build(deps): bump the go-deps group across 3 directories with
    4 updates
    * fix(tarball): normalize paths when matching files
    * transport: do not re-attach bearer token after cross-host
    redirect
    * Bump CI go version to 1.26.4
  - update to 0.21.6:
    * fix: update dependencies to use new azure sdk components
    * transport: restore resp.Body in retryError so CheckError can
    parse it
    * pkg/registry: return 202 Accepted for PATCH chunk uploads
    * Follow OCI distribution spec for artifactType and annotations
    * actions: attach Codecov token to coverage tests on main
    * remote: use DeleteScope (with "delete" action) for manifest
    deletion
    * remote: limit concurrent layer pulls
    * pkg/registry: reject corrupt disk blobs
    * mutate: close layer readers during export
    * crane/flatten: preserve image media type when flattening
    * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to
    7.2.1 in the actions group across 1 directory
    * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to
    1.41.0
    * build(deps): bump the go-deps group across 3 directories with
    6 updates
    * Replace go-homedir with os.UserHomeDir
    * pkg/name: only treat .localhost as non-HTTPS, not .local
    * transport: block unspecified IPs (0.0.0.0, ::) in
    validateRealmURL
    * test(mutate): add Extract round-trip test for filesystem
    object preservation
    * experiments: remove deprecated support for estargz
    * build(deps): bump aws-actions/configure-aws-credentials from
    6.1.0 to 6.1.1 in the actions group
    * fix: limit HTTP response body reads to prevent OOM
    * build(deps): bump the go-deps group across 3 directories with
    6 updates
    * transport: block redirects from token server to private/link-
    local addresses (SSRF fix)
    * pkg/v1/mutate: preserve relative symlinks that stay within
    rootfs in Extract
    * validate: skip non-layer layers
    * remote: validate foreign layer URLs to prevent SSRF (fixes
    [#2259])
    * remote: block SSRF via private-IP Location headers in blob
    uploads
    * fix(mutate): preserve config blob and layers for non-Docker
    OCI artifacts
    * fix: preserve per-occurrence layer identity in
    mutate.Image.Layers()
    * transport: retry HTTP 429 (Too Many Requests)
    * transport: allow bearer realm at same host:port as registry
    * Update go version to 1.26.3
  - update to 0.21.5:
    * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0
    * update to Go 1.26.2
    * Bump aws-actions/configure-aws-credentials from 6.0.0 to
    6.1.0 in the actions group across 1 directory
    * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in
    the go-deps group across 1 directory
    * **Full Changelog**: https://github.com/google/go-
    containerregistry/compare/v0.21.4...v0.21.5
  - update to 0.21.4:
    * go.mod: do not make a viral minimum go version
    * Avoid pruning absolute links from extracted and flattened
    images
    * Bump the go-deps group across 3 directories with 5 updates
    * fix: update to go1.25.8, and use separate .go-version file
    * Bump CI go version to 1.26.1
    * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the
    actions group
    * fork distribution client v3 auth-challenge as an internal
    package (squashed)
    * transport: validate Bearer realm URL to prevent SSRF
    * revert path traversal and symlink escape from #2227
    * Fix pkg/v1/google/auth tests for arm64
    * goreleaser: Update goreleaser config and GH action

++++ crmsh:

  - Update to version 5.1.0+20260629.0b862e06:
    * Chore: Changelog: Update ChangeLog for release 5.1.0 rc2

++++ cross-aarch64-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-aarch64-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-amdgcn-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-arm-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-arm-none-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-arm-none-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-avr-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-avr-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-bpf-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-hppa-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-hppa-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-loongarch64-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-loongarch64-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-nvptx-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-ppc64-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-ppc64le-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-ppc64le-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-pru-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-riscv64-elf-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-riscv64-elf-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-riscv64-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-riscv64-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-rx-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-rx-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-s390x-gcc14:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ cross-s390x-gcc14-bootstrap:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ easyeffects:

  - Update to version 8.2.6
    * The StartupWMClass key was removed from our desktop file. It
    seems to do more harm than good.

++++ fwupd:

  - Migrate to manual service run

++++ gcc14-testresults:

  - Update to GCC 14.4, 2c31f611cef5a871194630d0393f55e50ab, git12698

++++ gdal:

  - Drop the redundant %add_python python311 (it is already in the
    default flavour set); build the default python interpreters
  - Enable SFCGAL support for 3D geometry operations
    (-DGDAL_USE_SFCGAL=ON)
  - Split heavy-dependency GDAL drivers into standalone loadable
    plugin subpackages (gdal-hdf5, gdal-kea, gdal-pdf,
    gdal-postgresql, gdal-mysql, gdal-fits, gdal-netcdf), to slim the
    core libgdal dependency footprint; each plugin is independently
    toggleable via its own bcond (default on) and no longer pulled in
    through a meta-package. This aligns the packaging with other
    distributions (Fedora, Debian), which ship these heavy-dependency
    drivers as separate plugin packages

++++ gimp-plugin-resynthesizer:

  - Update to version 3.0.1+git21.a05427e:
    * Add build status badges to README
    * CI: Ubuntu: use 25.05 in 24.04
    * i18n: rework to avoid duplicated lines
    * i18n: check in script if msgfmt is available
    * Patch appstream metadata
    * Fix meson.build project version and min meson version
    * Comments in meson.build about location of GIMP plugins
    * Revise i18n installation to be portable across platforms.
    * Enable translation installation in Windows build
    * Revise i18n installation to be portable across platforms.
    * Modify Windows build workflow and add WIP comments
    * Add localization support details for version 3.0.1
    * Workflow windows build create installer artifact
    * Workflow Windows build
    * The current macOS GIMP.app bundles glib < 2.80. Make sure to use only the symbols that are available in that version.
    * Make the 'gimp_dep' on macOS a proper dependency. Rename the option 'mac-gimp-souce' to 'gimp-source-dir'.
    * Support building on macOS.
  - Drop upstreamed fix-po-meson.patch

++++ python-Glances:

  - Add missing requires to be able to start the server

++++ google-osconfig-agent:

  - Update to version 20260625.00
    * Add tests & bugfix for packages/trace.go (#939)

++++ gotosocial:

  - Update to version 0.22.0:
    * Relay support: GoToSocial now supports subscribing to relays
    (as an admin action), and pushing posts to relays (configured
    per-user, with filters available).
    * Automated cleanup of old remote posts: you can now configure your
    instance to clean up threads of remote statuses that haven't been
    interacted with by anyone on your instance. This should save a lot
    of space in folks' databases!
    * Delivery error tracking for remote instances: there's now a page
    in the settings panel where admin can view errors encountered
    while attempting delivery of posts to instances that may be
    experiencing technical difficulties or may have gone offline.
    You can use this to get a quick view on possible "dead" instances
    that you can then remove from your database with a domain block.
    * Accounts directory: there's a new setting to allow admins to
    expose (or not) a directory of accounts on the instance! Your
    account will only be shown in the directory if you opt in via
    your privacy settings.
    * Better tracking of deleted statuses/status tombstones: GtS now
    stores tombstones for deleted statuses, allowing threads to
    remain intact even when a status in the middle of the thread has
    been deleted.
    * Better status codes + info pages on deleted or hidden statuses:
    the old 404 page when you try to open a hidden status in the
    browser has been replaced with a more informative error page.
    * Way more configurable http server + client options: we've exposed
    a whole shitload of settings that you can tweak on the
    HTTP client + HTTP server that GoToSocial uses. We don't
    recommend changing these, but if you really want to, now you can.
    * Show your Träwelling status on your profile by setting your
    Träwelling page as a field value, similar to how our ListenBrainz
    integration already works.
    * Allow setting a name for your tokens, and sorting tokens by
    last used time in the token view of the settings page.
    Should make it a lot easier to track which tokens you've created,
    and when they were used by which apps!
    * Better layout for web view of profiles that hide all posts from
    the web: it just uses a single-column view now.
    * Full changelog:
    https://codeberg.org/superseriousbusiness/gotosocial/releases/tag/v0.22.0#user-content-changelog

++++ gpgme:

  - Update to 2.1.1:
    * gpgme_op_export now also returns operational errors

++++ heroic-games-launcher:

  - Fix CVEs due to vulnerable embedded dependencies:
    * CVE-2026-13311 (bsc#1269348): shell-quote inefficient input parsing (DoS).
    * CVE-2026-48779 (bsc#1268918): ws memory exhaustion DoS.
    * Update embedded dependencies via pnpm overrides:
    * Force shell-quote to 1.9.0.
    * Force ws to 7.5.11 and 8.21.0.
    * Refactor get-sources.sh and spec file to use root-level overrides
    for compatibility with pnpm v11, ensuring a consistent and
    reproducible offline build process.

++++ icinga2:

  - Update to version 2.16.2:
    * Also execute JsonDecode stack size test in pthread if available
    * Use protected stack for new-style Boost.Asio coroutines
    * Add tests for JsonDecode depth limit in combination with coroutine stacks
    * tests: move SpawnSynchronizedCoroutine() to utils.cpp
    * Prevent HTTP requests from creating deeply nested data structures
    * Don't shut down JSON-RPC connection if a message fails to parse
    * JsonDecode: include path in JSON depth error
    * JsonDecode: add depth limit
    * Add filter-expression permission
    * Release v2.16.2
    * Bump OpenSSL shipped for Windows to v3.5.7
    * Check if client is a valid endpoint before updating CA-certificate
    * ConfigWriter::EmitScope: Escape import
    * GHA: Windows: run on Windows Server 2022
    * Guard against assert() failures in SendJsonError()
    * Fix handling `std::ifstream` exceptions in `ConfigFilesHandler`
    * Fix handling the `std::ifstream::failbit` in `OutgoingHttpMessage`
    * Add test-case for `SendFile()` with non-existant paths
    * This release fixes some critical security vulnerabilities_
  - Verify that certificate update requests come from an authorized endpoint
    (GHSA-vj39-ww8j-vvx5)
  - Fix stack overflow due to deeply nested data structures
    (GHSA-wh38-wg57-5w7g)
  - Prevent arbitrary config injection on object creation via the API
    (GHSA-jgqj-x5j9-vgcm)

++++ json-c:

  - Update to 0.19:
    New features
  - -----------
    * Add support for Commodore Amiga and MorphOS
    * Allow builds with CMake 4 - sync minimum version across all
    CMakeLists.txt files
    * Update openssl command to work for newer versions of openssl.
    * Add support for building json-c with meson
    * Support MSVC in packages that use GNU Autoconf.
    * Add VERSIONINFO to libjson-c.dll
    * Make json_tokener_free(NULL) a no-op, to simplify cleanup paths.
    * Explicitly handle NaN values when converting to int
    * Set errno=RANGE in json_object_get_int/int64/uint64() when the
    source value can't be represented in the target type.
    * Make json_parse a bit more useful by adding -u (validate UTF8)
    and -P (specify arbitrary tokener parse flags), and read from
    stdin if no filename is provided.
    * Fix the apps/json_parse "-s" (strict) option so it actually does
    something, and default to non-strict.
    Significant changes and bug fixes
  - --------------------------------
    * Issue #867 - also disallow control characters in keys in
    JSON_TOKENER_STRICT mode
    * Issue #875: cast to unsigned char so bytes above 0x7f aren't
    interpreted as negative, which was causing the strict-mode
    control characters check to incorrectly trigger.
    * Issue #881: don't allow json_tokener_new_ex() with a depth < 1
    * Fix linkhash breaking -std=c89
    * Fixing Cmake build when using clang-cl, avoids errors about
    redefining existing symbols
    * Fix AIX build failure - Add CMake detection for getopt.h
    * Fix bug involving supplemental code points that look like high
    surrogates
    * Fix runtime issue with test_util_file.c in Windows (add O_BINARY)
    * Fix macro WIN32_LEAN_AND_MEAN redefined
    * Issue #914: Fix Memory usage regression due to newlocale() on
    macOS
    * Issue #916: Fix OOM via large array index in json_pointer_set
    * Issue #923: Avoid stack recursion in json_object_put()
    * Issue #927: CVE-2026-9146 - update json_object_iterator
    documentation
    * Issue #929: CVE-2026-11322 - fix information disclosure bug in
    apps/json_parse (not installed by default)
    * Issue #930: fix locale-dependent strtod in json_object_get_double
    * Issue #931: deep copy values in json_patch copy op to avoid
    aliasing and cycles

++++ juniversalchardet:

  - Be closer to the upstream way of building by ant
  - Added patches:
    * source-target.patch
    + build with source/target 8 instead of 5
    * automatic-module-name.patch
    + set automatic module name for java 9+ to what some heuristics
    used to deduce

++++ keybase-client:

  - CVE-2026-46604: TIFF decoder can panic when decoding an invalid
    image with an out-of-bounds strip offset (bsc#1269600)
    * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.

++++ kitty:

  - Addressing bsc#1269601 -> CVE-2026-46604
    * https://github.com/kovidgoyal/kitty/commit/351ee9fcbd692abd3bfbf2cf4296f69522e3571a
    * Adjusted kitty-0.47.4.tar.gz to point to:
    golang.org/x/image v0.43.0 and refreshed vendor.tar.gz

++++ klib:

  - Update to 1.0~git.20251221 (no changelog).

++++ krb5:

  - Prevent read overrun in kdb-ldap:
    * CVE-2026-11850, bsc#1268131
  - Add patch 0013-Prevent-read-overrun-in-libkdb_ldap.patch

++++ krb5-mini:

  - Prevent read overrun in kdb-ldap:
    * CVE-2026-11850, bsc#1268131
  - Add patch 0013-Prevent-read-overrun-in-libkdb_ldap.patch

++++ libcdada:

  - update to 0.6.4:
    * [B] utils: fix `cdada_strerr()` bounds handling for invalid
    and negative error codes
    * [B] utils: add missing human-readable message for
    `CDADA_E_FULL`
    * [B] list/map/queue/set/stack: return `NULL` when constructor
    `malloc()` fails (avoid null dereference)
    * [B] str: fix `cdada_str_replace*()` to reject empty match and
    self-replacement issues
    * [B] str: return `NULL` in `cdada_str_create()` when input C
    string is `NULL`
    * [B] str: align `cdada_str()` invalid-handle behavior with API
    docs (return `NULL`, not empty string)
    * [B] bbitmap: make `cdada_bbitmap_dump()` set `size_used` in
    buffered paths too
    * [B] bbitmap: fix corrupted BSD license header in `bbitmap.h`
    * [B] str: fix underflow in `cdada_str_rtraverse()` on empty
    strings
    * [B] list: fix `cdada_list_first()`/`cdada_list_last()`
    returning `CDADA_SUCCESS` on invalid input
    * [B] set: fix `cdada_set_find()` returning `true` on internal
    error
    * [B] str: fix uint32_t overflow in `cdada_str_erase()` bounds
    check
    * [B] str: fix `cdada_str_find_count()`/`cdada_str_find_all()`
    not returning `CDADA_E_NOT_FOUND`
    * [B] str: reject empty `substr` in
    `cdada_str_find_count()`/`cdada_str_find_all()`
    * [B] list/map/queue/set/stack: report `size_used` as bytes
    written on incomplete `dump()`

++++ liberasurecode:

  - update to 1.8.0:
    * Added a new ISA-L backend implementing locally-recoverable
    codes. These allow reconstruction with less than k fragments.
    * Added locks to ensure thread-safety.
    * The maximum total number of fragments (k + m) is increased
    from 32 to 256.
    * Properly fail reconstruction when there are too many
    failures for flat_xor_hd to handle.
    * Other minor fixes and updates.

++++ tbb:

  - update to 2023.0.0:
    * [Preview] Introduced ability to wait for a single task in a
    ``task_group`` instead of waiting for all tasks to finish.
    This increases reactivity and decreases latency in key user
    workloads.
    * [Preview] Introduced ``flow::resource_limited_node`` and
    ``flow::resource_limiter`` classes. These nodes only execute
    when they can successfully acquire the necessary resources
    from the resource limiters associated with the node. This
    feature is used to guard access to shared resources, while
    maximizing available parallelism in the graph.
    * [Preview] Introduced ``task_arena`` core type selector to
    better support hybrid architectures with several core types.
    Users use this new flexible API to more tightly constrain
    execution to set preferences for the specific core types that
    match their workload.
    * [Preview] Added global control parameter to set default block
    time behavior on server HW. This allows developers to revert
    to older blocking behavior if their applications are not able
    to fully utilize all cores, thereby reducing idle spinning.
    * Added new API to create a set of NUMA bound task arenas,
    simplifying common patterns used to optimize for NUMA
    architectures.
    * Extended Flow Graph functional node deduction guides to
    support non-static member function and member object pointers
    as a node bodies.
    * The Flow Graph join_node and indexer_node now support 10 or
    more input ports.
    * Explicit deduction guides for ``blocked_nd_range`` are now a
    fully supported feature.
    * Added native WASM exception handling support.
  - tbb-python-setuptools.patch (upstream)

++++ libisofs:

  - update to 1.5.8.pl01:
    * Bug fix: iso_image_set_ignore_aclea() inverted the setting
    for reading the XFS-style project id from disk files
    * Silenced error messages about ioctl(FS_IOC_FSGETXATTR)
    * Bug fix: File path of imported BIOS boot image was forgotten
    when it gets overwritten by a file of the same name.
    * Bug fix: Reproducibility of ISO images depended on
    "undefined" qsort(3) behavior with comparer function result 0
    * Bug fix: Empty AAIP value spoiled decoding of all AAIP
    attributes
    * Bug fix: Symbolic links with xattr could cause unusable ISO
    filesystems.
    * Bug fix: When reading multiple slashes in symbolic link
    targets they were
    * condensed to a single one if not marked by the SL ROOT-flag
    * Bug fix: Empty symolic link target components which represent
    add-on slashes were written with ROOT flag set
    * Bug fix: The last trailing slash in a symbolic link target
    was not written
    * Bug fix: The .. directory record exposed Rock Ridge
    properties of its
    * grand grand parent. Caused by commit 4d0063f7 in 2009 which
    fixed the block address pointer of the .. record.
    * Bug fix: The characters '.' and ';' were wrongly disallowed
    with PVD file names
    * Improved size estimation and property assessment of El Torito
    hidden boot images
    * Enabled up to 8 appended GPT partitions and improved their
    number mapping
    * New API calls iso_local_get_lfa_flags(),
    iso_local_set_lfa_flags(),
    * iso_node_get_lfa_flags(), iso_node_set_lfa_flags(),
    * iso_util_decode_lfa_flags(), iso_util_encode_lfa_flags(),
    * iso_util_get_lfa_masks(), iso_util_get_effective_lfa_mask()
    * New API calls iso_node_get_projid(), iso_node_set_projid(),
    * iso_local_get_projid(), iso_local_set_projid()
    * New API call iso_write_opts_set_gpt_with_gaps
    * New API call iso_local_create_dev()
    * New API call iso_write_opts_set_rrip_tf_long() and date check
    for year 2150
    * limit to produce 17-byte timestamps
    * New API call iso_write_opts_set_rrip_tf_y1900()
    * New API calls iso_image_set_volume_id_v2(),
    iso_image_get_volume_id_v2(),
    * iso_image_fs_get_volume_id_v2()
    * New API call iso_write_opts_set_relaxed_nonvol_atts()

++++ libkeccak:

  - update to 1.4.3:
    * Source code documentation updates; no user-visible changes

++++ lilv:

  - update to 0.28.0:
    * Add early assertions for non-null parameters in public API
    * Add lilv_state_get_bundle_path()
    * Always create state files with O_CLOEXEC on glibc >= 2.7
    * Clarify relative symbolic link creation when saving state
    * Fix build with dynmanifest support
    * Fix crash when loading plugin classes on Windows
    * Fix potential file loss when saving state with no link
    directory
    * Fix potential iterator leaks and resulting log message flood
    * Fix replacing links when saving over state
    * Fix test build when no C++ compiler is available
    * Improve error handling when writing and deleting state

++++ mimalloc:

  - update to 3.3.2:
    * Emscripten: add missing include for getentropy()
    * use acquire for loading the heap arena pages pointer
    * clarify thread local expansion
    * always set the threadlocal theap back to NULL on failing to
    initialize
    * increased version bits in thread local allocation to 48 bits
    * fix comparison in mi_os_alloc_aligned_at_offset to allow
    decommitting
    * use _mi_is_aligned instead of modulo
    * change out_default to be atomic
    * add assertions that the bottom 2 bits of the threadid are zero'd
    * return early when tld allocation fails

++++ libmpdclient:

  - Added libmpdclient-ncmpc.patch (boo#1269509).

++++ nghttp2:

  - stricter validation for HTTP CONNECT and Upgrade requests across HTTP/1,
    HTTP/2, and HTTP/3 upstreams, specifically rejecting requests that
    incorrectly include Content-Length or Transfer-Encoding headers
    * Add 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch
    CVE-2026-58055, bsc#1269489

++++ nng:

  - Update to version 1.12
    * Stable fix task abort in #2225
    * fix(stable) http server: add modern MIME types to static
    content map.

++++ openapv:

  - Update to version 0.3.0.0:
    + Support APV RAW encoding and decoding
    + Companding (compressing + expanding) algorithm for coding 16bit
    4 channel linear pixel value
    + New profiles are introduced to distinguish between the
    conventional APV and APV RAW

++++ python311-core:

  - Add test_UDPLITE_support.patch which improves testing for the
    support of IPPROTO_UDPLITE, which could be not present although
    header files are (bsc#1268375).

++++ python312-core:

  - Add test_UDPLITE_support.patch which improves testing for the
    support of IPPROTO_UDPLITE, which could be not present although
    header files are (bsc#1268375).

++++ python314-core:

  - drop test_UDPLITE_support.patch, upstream already added
    (similar) _have_udp_lite()

++++ python314-nogil-nogil-core:

  - drop test_UDPLITE_support.patch, upstream already added
    (similar) _have_udp_lite()

++++ librdkafka:

  - update to 2.14.2:
    * Fix duplicate groups in `ListConsumerGroups` when multiple
    brokers return the same group (#5417).
    * Fix data race in timers (#5089).
    * Update bundled OpenSSL, libcurl, zstd, zlib and cJSON
    * dependencies (#5346).
    * Fix data race in timers. The callback and its argument could
    have been modified after the lock is released.
    * Fix crash (SIGSEGV) in `rd_kafka_cgrp_handle_LeaveGroup()`
    when coordinator is unavailable during consumer close. The
    error logging path dereferenced a potentially NULL broker
    pointer. Happening since 1.x.
    * Issues: #5417.
    * Fix duplicate groups in `ListConsumerGroups` when multiple
    brokers return the same group.

++++ libredwg:

  - update to 0.14:
    * Write support for r2004 (AC1018) DWG files.  The encoder now
    produces compressed, encrypted section headers and the
    LZ77-compressed object data layout required since r2004.
    * Split large object files (encode, decode) into 2 objects,
    significantly reducing peak memory usage during compilation
    and enabling parallel builds to scale better.
    * dwgadd: handle fields (e.g. layer, ltype, style) can now be
    set by table-record name in addition to raw handle references.
    A string value like `line.layer = "FOO"` is resolved via
    dwg_find_tablehandle() at parse time.
    * Added DXB (binary DXF) support: dwgwrite/dwgread/dwg2dxf
    accept DXB input/output, and dxfwrite accepts DXB.
    * R2007+ split string stream encoding for Header, Classes, and
    objects.
    * Added cycle checks in entity link chains.  GH #1226.
    * Added regression tests for decompress_r2007 OOB reads and
    R2004 section decompression.  Added dwgfilter.test.
    * Added release helpers and improved CI (ODAFileConverter QT6,
    xvfb-run).
    * dwgfuzz: show mode with --version.
    * API/ABI changes (source-incompatible):
    * Renamed HEADER/2NDHEADER.is_maint to maint_rel_version.
    * Renamed PROXY_OBJECT.dwg_versions.
    * Bumped SO_VERSION to 0:14:0.

++++ rpm:

  - rpm2archive: use size 0 for hardlinked files as bnew versions of
    gnu tar reject non-zero sizes [bsc#1269150]
    * updated patch: rpm2archive.diff
  - backport fix for add_sysuser macro [bsc#1269571]
    * updated patch: macrosin.diff
  - backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
    * new patch: rpmuncompress.diff

++++ stellarsolver:

  - Update to 2.8:
    * This release includes numerous small updates and fixes to make
    StellarSolver more robust and flexible. There are no massive
    changes to functionality, but a number of improvements under
    the hood.

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1084
  - make more use of new SystemCmd interface
  - 4.5.336

++++ systemd:

  - Import commit a6ea105861b47842aed56242325ac1f33603c9c6 (merge of v260.3)
    This update includes the following fix:
    91873ca3d7 nss-systemd: avoid ELF TLS for recursion guard (bsc#1254924)
  - Drop 1001-units-drop-Before-sockets.target-from-networkd-resol.patch and
    1002-nss-systemd-avoid-ELF-TLS-for-recursion-guard.patch, both are part of
    v260.3.

++++ systemd-mini:

  - Import commit a6ea105861b47842aed56242325ac1f33603c9c6 (merge of v260.3)
    This update includes the following fix:
    91873ca3d7 nss-systemd: avoid ELF TLS for recursion guard (bsc#1254924)
  - Drop 1001-units-drop-Before-sockets.target-from-networkd-resol.patch and
    1002-nss-systemd-avoid-ELF-TLS-for-recursion-guard.patch, both are part of
    v260.3.

++++ libvpl:

  - update to 2.17.0:
    * Intel® VPL API 2.17 support, including new APIs for reporting
    decoder capabilities, accessing bitstream buffers in video
    memory, configuring encoder pre-processing, and documentation
    updates

++++ libwacom:

  - update to 2.19.0:
    * libwacom_list_styli_from_database() provides a WacomStylus
    list of all known styli
    * libwacom_database_ref() and libwacom_database_unref() to
    simplify callers having
    * libwacom_get_width_mm() and libwacom_get_height_mm() for
    the tablet dimensions in mm. The .tablet files switched to
    mm too.
    * New generic 3 button + eraser tool, assigned to some Huion
    devices by default
    * New devices:
  - Gaomon M5 V2
  - HP Envy x360 15-fh0xxx
  - Huion Inspiroy Frego S (L310), Kamvas Pro 27 (GT2701), H610
    Pro V2
  - Lenovo ThinkBook 14s Yoga ITL
  - Wacom HID 53FD
  - Xencelabs Pen Display 16

++++ libwmf:

  - update to 0.2.15:
    * BMP image parsing fixes in embedded DIBs
    * record size validation for polyline, polygon, polypolygon and
    text records
    * fix RLE decoder row-stride mismatch
    * limit DC stack depth to prevent resource exhaustion
    * add basic test suite
    * MSVC build fixes
    * new release with accumulated fixes

++++ lite-xl-plugin-manager:

  - Adjustments for mbedtls-devel pointing to v4
    * mbedtls-3-devel is available in TW, but Leap would still use mbedtls-devel

++++ livi:

  - update to 0.5.0:
    * Allow to exclude display notches in landscape using xx-
    cutouts-v1
    * Wayland protocol
    * Show processing state when process URLs
    * https://gitlab.gnome.org/guidog/livi/-/issues/28

++++ manpages-l10n:

  - update to 4.31.0:
    * License collection almost completed (99.98%)
    * Updated and added many translations
    * Improve formatting of last changelog entries

++++ maven-parent:

  - Upgrade to Apache Maven parent POM version 49
    * New features and improvements
    + Upgrade parent to 39 to benefit from push-to-atr profile
    * Maintenance
    + Configure ATR project
    + Change banner right to SVG logo
    + Add Gerd Aschemann to committer list
    + Add Matthias Bünger to PMC
    * Dependency updates
    + Bump version.sisu-maven-plugin from 1.0.0 to 1.0.1
    + Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2
    + Bump com.diffplug.spotless:spotless-maven-plugin from 3.4.0
    to 3.7.0
    + Bump com.palantir.javaformat:palantir-java-format from 2.90.0
    to 2.93.0

++++ mbuffer:

  - update to 20260511:
    * fix data corruption occuring at the end of a tape, when the
    * transfer block size is not a multiple of the native block
    * size of the tape device (fix by Daniel Collins)
    * restore terminal attributes on exit

++++ mercurial:

  - Mercurial 7.2.3
    * Fix issue where files would appear modified even if clean (71e06e01d26b + 4d6df1ba8506)
    * Add documentation for narrow, shapes and shards (f6b4469fe4eb)
    * Fix a bug in the narrow patterns generation (baa13eff9ddc)
    * Fix empty paths case in narrowspec generation (ac9cfd305ccd)
    * Fix hgweb initialization issue (9ddd9c311109)
    * Upgrades to the test harness's resistance to slow CI runners

++++ mpop:

  - update to 1.4.22:
    * No significant changes.

++++ msr-safe:

  - add kernel-7.2.patch to fix kernel 7.2.

++++ nbping:

  - Update to version 0.7.1:
    * chore(release): bump version to 0.7.1
    * feat(config): add YAML config support (#115)

++++ nodejs26:

  - Update to 26.4.0:
  - doc: update blockList stability status to release candidate
  - fs: support caller-supplied readFile() buffers
  - http: close pre-request sockets in closeIdleConnections
  - loader: implement package maps
  - net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
  - tls: add certificateCompression option
  - vfs: dispatch node:fs/promises to mounted VFS instances
  - vfs: add minimal node:vfs subsystem
  - Run obs-git-init (and add *-build directory to .gitignore)

++++ noson-app:

  - update to 5.6.25:
    * Fix ws read chunked content with trailers
    * Fix 1 byte (0) issue in http chunked transfer
    * Improve the client/server service to be more compliant with
    the http protocol standard 1.1
    * README.md: Fix transifex link / paragraph about whitelisting
    an IP
    * It includes minor fixes:
    * fix window border & shadow issue for Ubuntu 24.04
    * disable icon ripple on platform android
    * upgrade openssl to 1.1.1w
    * add FreeBSD instructions
    * Improve ws client
    * Improve builtin ws client
    * Handle custom search for services (tested with Amazon Music)
    * Fix search in service
    * Fix build with gcc 13
  - Switch to Qt6

++++ openQA:

  - Update to version 5.1782729563.8f5a14b2:
    * chore(deps): bump js-yaml from 4.1.1 to 4.3.0
    * fix(details view): Align video link the same as the bugref actions
    * test: bail out when worker fails to become active
    * refactor(test): use shared wait_for in wait_for_worker
    * test: fix flaky race in t/05-scheduler-full.t

++++ perl-CSS-Minifier-XS:

  - updated to 0.140.0 (0.14)
    see /usr/share/doc/packages/perl-CSS-Minifier-XS/Changes
    0.14      2026-06-28 16:30:59-07:00 America/Vancouver
  - Fixes a memory leak in minify(), when the entire document is minified
    away. CVE-2026-13593 bsc#1269662

++++ perl-Crypt-PasswdMD5:

  - updated to 1.440.0 (1.44)
    see /usr/share/doc/packages/perl-Crypt-PasswdMD5/Changelog.ini
    [V 1.44]
    Date=2026-06-29T00:00:00
    Comments= <<EOT
  - Replace the file LICENSE-GPL-3 with the file LICENSE
    containing what is recommended at
    https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html
  - Patch the source code reference to refer to this LICENSE file.
    EOT

++++ perl-JavaScript-Minifier-XS:

  - updated to 0.160.0 (0.16)
    see /usr/share/doc/packages/perl-JavaScript-Minifier-XS/Changes
    0.16      2026-06-28 14:10:28-07:00 America/Vancouver
  - Fixes CVE-2026-56017, which caused Perl to SEGFAULT when calling
    minify().  Thanks to CPANSec for raising the issue, and providing a
    prototype fix. bsc#1269671
  - Fixes CVE-2026-56018, caused by a memory leak in minify() where each
    tokenized Node's "contents" buffer were not properly freed, resulting in a
    memory leak on every call. bsc#1269715
  - Updated author tests for "does the JS still compile?", to use "node"
    instead of "jsl".

++++ perl-MCP:

  - Downgrade to 0.12 again to avoid the new (failing) dependency for now

++++ perl-Tree-DAG_Node:

  - updated to 1.370.0 (1.37)
    see /usr/share/doc/packages/perl-Tree-DAG_Node/Changelog.ini
    [V 1.37]
    Date=2025-06-29T08:00:00
    Comments= <<EOT
  - Replace the body of the LICENSE file with what is recommended at
    https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html
  - Patch the source code reference to refer to this LICENSE file.
  - Remove the excess & confusing files LICENSE-Artistic-2.0 & LICENSE-GPL-3.
  - Reset the required version of Data::Dumper back to 0.
  - Thanx to Paul Howarth & David B. Evans for the reports.
    EOT
    [V 1.36]
    Date=2025-06-28T11:53:00
    Comments= <<EOT
  - Fix typo in the 2nd FAQ: "How to process every node in tree?". The POD contained
    "my(@node, $options) = @_;" whereas it should read "my($node, $options) = @_;".
    Thanx to Torsten Seemann for the report.
  - Add new version of LICENSE to the distro.
  - Add new files LICENSE-Artistic-2.0 & LICENSE-GPL-3 to the distro.
  - Add Data::Dumper, Getopt::Long, perl to Makefile.PL.
  - Remove open from Makefile.PL.
  - Modernize MANIFEST.SKIP.
    EOT

++++ pgvector:

  - update to 0.8.3:
    * Fixed possible index corruption with HNSW vacuuming
    * Fixed performance regression with Hamming distance and
    Jaccard distance with Postgres 18

++++ plasma6-nm:

  - Explicitly require QtKeychain >= 0.16.0

++++ postgresql14-pgvector:

  - update to 0.8.3:
    * Fixed possible index corruption with HNSW vacuuming
    * Fixed performance regression with Hamming distance and
    Jaccard distance with Postgres 18

++++ postgresql15-pgvector:

  - update to 0.8.3:
    * Fixed possible index corruption with HNSW vacuuming
    * Fixed performance regression with Hamming distance and
    Jaccard distance with Postgres 18

++++ postgresql16-pgvector:

  - update to 0.8.3:
    * Fixed possible index corruption with HNSW vacuuming
    * Fixed performance regression with Hamming distance and
    Jaccard distance with Postgres 18

++++ postgresql17-pgvector:

  - update to 0.8.3:
    * Fixed possible index corruption with HNSW vacuuming
    * Fixed performance regression with Hamming distance and
    Jaccard distance with Postgres 18

++++ postgresql18-pgvector:

  - update to 0.8.3:
    * Fixed possible index corruption with HNSW vacuuming
    * Fixed performance regression with Hamming distance and
    Jaccard distance with Postgres 18

++++ pyenv:

  - update to 2.7.3:
    * CI: add_version enhancements
    * Add CPython 3.15.0b3
    * fix(rehash): prevent terminal hang caused by stale or
    sandbox-blocked lock file
    * 3.6.x: Fix verify_* calls
    * Add CPython 3.14.6
    * Add CPython 3.13.14
    * Support 3.9 EOL Pip URL, consolidate tests
    * Update URLs for PyPy nightly; Remove pypy3.5 and pypy3.7
    nightly
    * Add CPython 3.15.0b2
    * init: add --install for shell setup
    * realpath.c: fix obsolete syntax warning
    * Add miniconda3 26.3.2-2, miniforge3 26.3.2-0, 26.3.2-1
    * miniforge3 26.1, 26.3, add_miniforge: exclude .pkg installers
    * miniforge 26, CI: switch check to 3.13
    * 2.7, 3.4: force C99 standard; 2.7.14-18: force OpenSSL 1
    formula
    * rehash: detect and remove a stale lockfile
    * Add GraalPy 25.0.3
    * 3.11.0+: Use the `--with-openssl-rpath' Configure option when
    possible
    * python_build: Make `verify_python` verify `pythonX.Y' suffix
    * Add micropython 1.22.0 to 1.28.0; add downstream patches to
    fix compilation errors
    * Fix linking against a keg_only Homebrew OpenSSL when a a non-
    keg_only one is also installed
    * Add missing CPython 3.14.2t
    * 3.14.0-5: Support building against OpenSSL 4
    * CI: add_cpython: Support prereleases for non-initial CPython
    releases
    * Add CPython 3.16-dev, switch 3.15-dev to maintenance branch
    * Add PyPy v7.3.22
    * CI: Add timeouts to CPython release metadata fetches
    * Add CPython 3.15.0b1
    * Add CPython 3.14.5rc1
    * pyenv-latest: fast path for when there is an exact match

++++ python-beautifulsoup4:

  - update to 4.15.0:
    * This is the last Beautiful Soup release to officially support
    Python 3.7.
    * This is also the last release to support the obsolete
    methods, attributes and classes that were deprecated in 4.13.0.
    In a subsequent point release, the DeprecationWarning issued when
    you use these obsolete features will be replaced by
    NotImplementedError, giving you a final chance to change your
    code before the implementations are removed entirely. Once the
    features are removed, code that tries to use them will start
    behaving strangely, since Beautiful Soup will generally interpret
    the method and attribute names as tag names.
    * It is now possible to call new_tag() or new_string() directly
    on an existing Tag or NavigableString object, rather than the
    associated BeautifulSoup object. Note that this only works if
    the object is currently inside a parse tree. This means you
    can't call new_tag() or new_string() on an object that
    * The type hints for the overloaded find* methods have been
    redone to eliminate type checker overrides. [bug=2122019]
    * Explicitly specify the type hint for the PageElement.text
    property
    * Change the html.parser tree builder's code for handling
    numeric character references, to avoid a crash when using Python
    versions that include the fix to Python issue
    * Skip the lxml tree builder's
    test_surrogate_in_character_reference test
    * if the libxml2 version is less than 2.13.0. Prior versions of
    libxml2
    * don't issue the REPLACEMENT CHARACTER we're expecting.
  - drop htmlparser.patch (upstream)

++++ python311:

  - Add test_UDPLITE_support.patch which improves testing for the
    support of IPPROTO_UDPLITE, which could be not present although
    header files are (bsc#1268375).

++++ python311-documentation:

  - Add test_UDPLITE_support.patch which improves testing for the
    support of IPPROTO_UDPLITE, which could be not present although
    header files are (bsc#1268375).

++++ python-pipx:

  - update to 1.15.0:
    * Add a `--dry-run` flag to `pipx ensurepath` that reports
    which directories would be added to `PATH` without modifying
    `PATH` or any shell configuration file.
    * Restore the original package if `pipx reinstall-all` is
    interrupted during reinstall.
    * Allow importing `pipx.util` before `pipx.paths`.
    * Ensure `pipx inject --force` reinstalls injected packages
    without persisting the force-reinstall option in package
    * metadata.
    * Preserve installer errors when package-name detection fails
    during local package installs.
    * Expose manual pages for editable local package installs.
    * Fixed `pipx pin <app> --injected-only` so it can pin injected
    packages when the main app is already pinned.
    * Add `--no-path-check` to `pipx run` to skip the warning when
    the app is already on `PATH`. Useful for shim scripts that
    wrap `pipx run <app>` under the same name as the app.
    * Add `PIPX_DISABLE_SHARED_LIBS_AUTO_UPGRADE` to skip automatic
    shared library upgrades.
    * Install app scripts with shebangs that ignore `PYTHONPATH`.
    * Refresh cached standalone Python indexes written by older
    pipx versions before using `--fetch-missing-python`.

++++ python312:

  - Add test_UDPLITE_support.patch which improves testing for the
    support of IPPROTO_UDPLITE, which could be not present although
    header files are (bsc#1268375).

++++ python312-documentation:

  - Add test_UDPLITE_support.patch which improves testing for the
    support of IPPROTO_UDPLITE, which could be not present although
    header files are (bsc#1268375).

++++ python-QtPy:

  - Drop Qt5 Webengine tests: Must be removed from Tumbleweed
    https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message/IFZ4HRNKQUXZHXD7S3FWM3QIONDNMOMY/

++++ python-alembic:

  - update to 1.18.5:
    * **[usecase] [commands]** Added `--splice` support to the
    `merge()` command. Previously, the merge command would suggest
    using `--splice` when attempting to merge non-head revisions,
    but the flag was not actually accepted by
    the command.
    * The `splice` parameter is now available in both the command-
    line interface and the `command.merge()` function, matching the
    existing support in `command.revision()`.
    * **[usecase] [environment]** Added
    `ScriptDirectory.get_heads.consider_depends_on`
    parameter to `ScriptDirectory.get_heads()`. When set to
    `True`, head revisions that are also a dependency of another
    revision via `depends_on` are excluded from the result,
    matching the effective heads that would be present in the
    `alembic_version` table after running all upgrades.
    * producing invalid Python in the generated migration scripts.
    Column objects within list or tuple values are now correctly
    rendered as their string column names.
    * **[bug] [mysql]** Implemented type comparison for `ENUM`
    datatypes on MySQL, which checks that the individual enum
    values are equivalent.  If additional entries are on either
    side, this generates a diff.  Changes of order do not
    generate a diff.  Pull request courtesy Furkan Köykıran.
    * **[bug] [operations]** Fixed bug where the
    `inline_references` parameter of `Operations.add_column()` did
    not include foreign key referential actions such as `ON DELETE`,
    `ON UPDATE`, `DEFERRABLE`, `INITIALLY`, and `MATCH` when
    rendering the inline `REFERENCES` clause.

++++ python-altcha:

  - update to 2.0.2:
    * fix: support bytes as hmac keys
    * feat: payload.from_base64 and from_dict

++++ python-astropy:

  - update to 8.0.0:
    * Added astropy.config.temporary_cache_dir_path and
    astropy.config.temporary_config_dir_path context managers,
    which are safer alternatives to astropy.config.set_temp_cache
    and astropy.config.set_temp_config respectively, and should
    be preferred in new code, but are not drop-in replacements.
    Added support for ASTROPY_CACHE_DIR and ASTROPY_CONFIG_DIR
    environment variables, offering a more tightly scoped
    alternative to XDG_CACHE_HOME and XDG_CONFIG_HOME
    respectively. When both are defined, ASTROPY_ -prefixed
    variables take precedence over XDG_ -prefixed ones. [#19575]
    * Added a ensure_exists boolean option to cache and config path
    getters, allowing callers to disable directory creation on
    discovery with ensure_exists=False. When False, callers
    should handle missing directory on their own. [#19616]
    * The angular_diameter_distance method now accepts two redshift
    arguments to compute the angular diameter distance between
    objects at different redshifts. The previous separate method
    angular_diameter_distance_z1z2 is deprecated and will be
    removed in a future version.
    * The trait astropy.cosmology.traits.NeutrinoComponent has been
    added to work with objects that have attributes and methods
    related to neutrinos.
    * Removed deprecated module-level shim files
    (astropy.cosmology.connect, astropy.cosmology.core,
    astropy.cosmology.flrw, astropy.cosmology.funcs, and
    astropy.cosmology.parameter), which were deprecated in v7.1.
    All cosmology classes and functions should be imported
    directly from astropy.cosmology.
    * Registered the read_mrt() and write_mrt() methods with the
    Cosmology class, enabling the import and export of
    cosmological data to and from MRT files.
    * Read CDS table where the data is split into multiple files
    * Add a new io.ascii format mesa to read history and profile
    output files from MESA, a well-known code for stellar
    evolution calculations.
    * Added a logical_as_bytes parameter to fits.open() that, when
    set to True, causes FITS logical columns to be read as bytes
    (S1) instead of bool, preserving NULL (undefined) values that
    would otherwise be silently converted to False. Columns read
    this way round-trip correctly when written back to a FITS
    file, preserving b'T', b'F', and b'x00' (NULL) values. A
    warning is now emitted when NULL values are present and
    logical_as_bytes is not set.
    * Extended the logical_as_bytes option of fits.open() to apply
    to variable-length array (PL/QL) logical columns. When True,
    VLA logical columns are returned as S1 byte arrays (one byte
    per entry) so that b'x00' (NULL) is distinguishable from b'F'
    (False); S1 row arrays also round-trip through writing. A
    warning is emitted when NULL bytes are present in a VLA
    logical column read with logical_as_bytes=False, except for
    the ambiguous case of a column whose heap is entirely x00
    (which may instead be an all-False column written by astropy
    <= 7.2.0).

++++ python-astropy-iers-data:

  - update to 0.2026.6.22.1.23.34:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.6.15.15.33.16...v0.2026.6.22.1.23.34
  - update to 0.2026.6.15.15.33.16:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.6.8.17.49.5...v0.2026.6.15.15.33.16
  - update to 0.2026.6.8.17.49.5:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.6.1.17.39.59...v0.2026.6.8.17.49.5
  - update to 0.2026.6.1.17.39.59:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.6.1.1.20.30...v0.2026.6.1.17.39.59
  - update to 0.2026.6.1.1.20.30:
    * TST: add `test_eopc04_1962-now.py`
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.5.25.1.14.13...v0.2026.6.1.1.20.30
  - update to 0.2026.5.25.1.14.13:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.5.18.1.11.28...v0.2026.5.25.1.14.13
  - update to 0.2026.5.18.1.11.28:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.5.11.1.8.52...v0.2026.5.18.1.11.28
  - update to 0.2026.5.11.1.8.52:
    * **Full Changelog**: https://github.com/astropy/astropy-iers-
    data/compare/v0.2026.5.4.1.4.54...v0.2026.5.11.1.8.52
  - update to 0.2026.5.4.1.4.54:
    * Bump the actions group in /.github/workflows with 2 updates

++++ python-azure-mgmt-communication:

  - New upstream release
    + Version 3.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-managementgroups:

  - New upstream release
    + Version 2.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-cinemagoer:

  - update to 2026.06.27:
    * ## What's new in release 2026.06.27 (The Lost Boys)
    * the **support for parsing IMDb web pages was removed**,
    leaving the non-commercial databases as the only available
    data source
    * drop support for python 2
    * drop support for python versions prior to 3.10
    * switch to pyproject.toml configuration
    * switch to using uv for management
  - drop support-python314.patch (upstream)

++++ python-datashader:

  - update top 0.19.1:
    * Improve overlapping edges for polygons to not cancel out

++++ python-django-oauth-toolkit:

  - update to 3.3.0:
    * #1637 Support for Django 6.0
    * #1642 Provide App Name and Scope in Device Confirmation View
    * #1636 Remove support for Python 3.8 and 3.9
    * #1628 Fix inaccurate help_text on client_secret field of
    Application model
    * #1674 Add `list_select_related` to `RefreshTokenAdmin` to
    avoid unbounded `JOIN` queries on the changelist
    * #1621 Fix device code tokens getting the wrong scope.
    * #1683 Fix swapped `DeviceGrant` model usage across the device
    authorization flow
    * #1689 Fix invalid `Cache-Control` header value on the OIDC
    JWKS endpoint
    * #1692 Fix consent violation and scope escalation.

++++ python-django-parler:

  - update to 2.4:
    * Added Django 6.0 support.
    * Added Python 3.13 support.
    * Dropped Django 4.2 LTS support (end of extended support,
    April 2026).
    * Dropped Django 5.0 support. The admin's delete_translation
    view calls ModelAdmin.log_deletions, which was introduced in
    Django 5.1 — so translation deletion raised AttributeError on
    5.0. The install requirement is now Django>=5.1.
    * Replaced removed csrf_protect_m decorator with
    @method_decorator(csrf_protect) in the admin.
    * Replaced deprecated unique_together with
    models.UniqueConstraint in the translated fields model.
    * Added a validate_constraints() call alongside
    validate_unique() in form validation so UniqueConstraint
    violations surface through the form.
    * Updated log_deletion() call to the renamed log_deletions()
    with its new signature (Django 6).
    * Fixed a thread-safety bug in SortedSelectMixin.sort_choices()
    where the deep-copy guard was skipped for the second and
    later optgroups, causing .sort() to mutate the caller's
    choices list.
    * Expanded the test suite with new modules covering admin
    views, cache, forms, managers, model construction, template
    tags, views, and widgets.

++++ python-elastic-transport:

  - update to 9.4.2:
    * Escape percent characters in logging output (#284)
    * Optional backoff delays between retries
    * Add support for an httpx synchronous node

++++ python-elementpath:

  - update to 5.1.3:
    * Fix protection against type cast errors during the static
    analysis phase
    * Include PR #101 (invalid sequence type error code for
    external functions)
    * Fix issues #100 and #102

++++ python-esptool:

  - update to 5.3.1:
    * **espefuse**: Remove non-existent HMAC key purposes for
    ESP32-C61
    * **pyinstaller**: Bundle pyserial URL handlers
    * Preserve VID/PID lookup for symlinked ports
    * Fix operations over USB-Serial/JTAG transport in Secure
    Download Mode
    * Raise FatalError instead of leaking StopIteration

++++ python-linux-procfs:

  - update to 0.7.4:
    * Fix spelling mistakes in comments
    * Modernize packaging and update authorship
    * Remove import of range from six.moves

++++ python-magic-wormhole-mailbox-server:

  - update to 0.8.0:
    * Server header properly reports version
    * introduce a ``"your-address"`` key to the ``"welcome"``
    message (to reflect the IP address and port back, #63)
    * non-numeric nameplates rejected with error (@meejah)
    * more-complete sequence and state diagrams (@meejah)
    * update Munin plugin shebang (@warner)
    * Munin plugins open db read-only (@warner)

++++ python-mitmproxy:

  - update to 12.2.3:
    * Reduce generated leaf certificate validity from 199 to 197
    days so the 2-day
    * `notBefore` backdate remains below Chromium's 200-day limit.
    * Fixed a bug where mitmweb would not pick up its XSRF cookie.
    * Fix `authority and subject key identifier mismatch` errors
    when mitmproxy
    * is configured with a custom CA whose SubjectKeyIdentifier was
    not derived as SHA-1 of the public key.
    * Fix `IndexError` in `is_mostly_bin` when exporting flows to
    HAR with payloads that have a UTF-8 continuation byte at the
    100-byte cutoff.

++++ python-pydata-sphinx-theme:

  - Update to 0.19.0 (bsc#1268818, CVE-2026-53550, bsc#1268957, CVE-2026-48779):
  - Docs update Font Awesome links by @hntk03 in #2399
  - Fix code coverage workflow by @Yann-P in #2393
  - Fix vertical scrollbar in math container by @hntk03 in #2404
  - [css] De-jumble header items at intermediate widths :) by
    @sneakers-the-rat in #1784
  - Fix gettext builder by @Yann-P in #2403
  - fix: configure defaults for Google Analytics before loading script
    by @tswast in #2369
  - v0.18.0
    [#] Breaking
  - Drop support for sphinx 7, minimal requirement now 8 by @Yann-P in #2366
    [#] Improvements
  - feat(theme): add sticky_version_warning_banner option by @tmchow
    in #2372 (revised in #2385, now sticky_banners)
  - feat: replace theme switcher with dropdown by @hntk03 in #2340
  - Consistent linting and formatting across CI and local environment
    by @Yann-P in #2368
  - Add distinctive style for menuselection, based on guilabel by
    @stevepiercy in #2367
  - Update to FontAwesome v7 by @agriyakhetarpal in #2370
  - Add documentation on how users can override the FontAwesome
    version by @agriyakhetarpal in #2373
    [#] Bugs
  - Fix sidebar top being cut off on mobile browsers by @hntk03 in
    [#2363]
  - Docs update PyTorch logo URL by @hntk03 in #2374
  - Fix theme dropdown menu going offscreen by @hntk03 in #2387
  - Fix the stickiness of the version warning banner, and rename the
    config option to sticky_banners by @agriyakhetarpal in #2385

++++ python-pytest-html:

  - Revendor updating shell-quote and js-yaml deps:
  - Add patch update-js-deps.patch
  - CVE-2026-13311: shell-quote: inefficient input parsing can lead to a
    denial of service (bsc#1269361)
  - CVE-2026-53550: js-yaml: quadratic complexity when processing a
    crafted YAML document can lead to CPU exhaustion (bsc#1268818)

++++ python-python-engineio:

  - update to 4.13.3
    * Make sure client disconnects when write loop exits
    * Address flaky unit test
    * Stop using codecov service, since it has been failing for a long time

++++ python-python-socketio:

  - Update to 5.16.3
    * Catch all exceptions in redis and rabbitmq client managers #1581
  - Update to 5.16.2 (fixes CVE-2026-48804, bsc#1269491)
    * Prevent unnecessary resource allocations #1574
    * Add zizmor to CI builds #1570

++++ python-rebulk:

  - Update to version 6.0.0
    Bug Fixes:
    * key: Skip private matches in declared-key value_type check
    Documentation:
    * Show declaring functional properties for check_keys
    Features:
    * key: Accept key= as Key | Sequence[Key], fold in keys=
    * key: Add Rebulk.check_keys() to flag declared keys no
    pattern produces
    * key: Leverage declared keys for typed output projection in
    to()
    * key: Opt-in debug check that match values match declared
    Key.value_type
    * key: Support children patterns via keys= and declare_keys
  - Update to version 5.0.0
    Refactoring:
    * chain: Decouple Chain from Builder
    Breaking Changes:
    * chain: Chain is no longer a Builder subclass and
    Builder.chain() returns a ChainBuilder instead of a Chain.
    Code building chains via the documented fluent API is
    unaffected; only code relying on isinstance(chain, Builder)
    or annotating the .chain() result as Chain needs updating.
  - Update to version 4.3.0
    Documentation:
    * V5 refactoring design analysis + decisions
    * claude: Note to close issues with Closes #N
    Features:
    * typing: Formatter-based Key for non-scalar values
    * typing: Typable predictable shape for
    to_dict(enforce_list=True)
    Refactoring:
    * chain: Type ChainPart fluent methods instead of Any

++++ setools:

  - Fix setools test package

++++ python-uv:

  - Disable debuginfo generation on 32-bit arches
  - Fix quoting of RUSTFLAGS and passing of link-arg

++++ python314:

  - drop test_UDPLITE_support.patch, upstream already added
    (similar) _have_udp_lite()

++++ python314-documentation:

  - drop test_UDPLITE_support.patch, upstream already added
    (similar) _have_udp_lite()

++++ python314-nogil:

  - drop test_UDPLITE_support.patch, upstream already added
    (similar) _have_udp_lite()

++++ rpmlint:

  - Update to version 2.9.0+git20260629.bd947d09:
    * sysctl-whitelist: adjusted 50-coredump.conf digest for systemd - temporary revert (bsc#1267504)
    * dbus-services: add txnupd-maintenance-tools service (bsc#1268577)
    * test: add test coverage for new varlink related whitelisting features
    * configs/openSUSE: add Varlink whitelisting restriction
    * FileDigestCheck: add SocketUnitDigester
    * FileDigestCheck: move digester types into utility module
    * FileDigestCheck: support 'ContentCheck' configuration setting
    * dbus-services: added kdeplasma6-addons kameleon.qmk whitelisting (bsc#1267818)

++++ rpmlint-strict:

  - Update to version 2.9.0+git20260629.bd947d09:
    * sysctl-whitelist: adjusted 50-coredump.conf digest for systemd - temporary revert (bsc#1267504)
    * dbus-services: add txnupd-maintenance-tools service (bsc#1268577)
    * test: add test coverage for new varlink related whitelisting features
    * configs/openSUSE: add Varlink whitelisting restriction
    * FileDigestCheck: add SocketUnitDigester
    * FileDigestCheck: move digester types into utility module
    * FileDigestCheck: support 'ContentCheck' configuration setting
    * dbus-services: added kdeplasma6-addons kameleon.qmk whitelisting (bsc#1267818)

++++ rpmlint-test:

  - Update to version 2.9.0+git20260629.bd947d09:
    * sysctl-whitelist: adjusted 50-coredump.conf digest for systemd - temporary revert (bsc#1267504)
    * dbus-services: add txnupd-maintenance-tools service (bsc#1268577)
    * test: add test coverage for new varlink related whitelisting features
    * configs/openSUSE: add Varlink whitelisting restriction
    * FileDigestCheck: add SocketUnitDigester
    * FileDigestCheck: move digester types into utility module
    * FileDigestCheck: support 'ContentCheck' configuration setting
    * dbus-services: added kdeplasma6-addons kameleon.qmk whitelisting (bsc#1267818)

++++ rubygem-yast-rake:

  - Added support for "alts" as an alternative to the
    "update-alternatives" script

++++ s390-tools:

  - Upgrade s390-tool to version 2.43.0
    For Linux kernel version: 7.1
    s390-tools: Set Rust MSRV to 1.85.0
  - Changes of existing tools:
    * dbginfo.sh: Add IBM appliance specific files
    * lshwc: Show explicitly selected unnamed counters with --hide
    * pvattest: Add firmware check version 2
    * zipl: Introduce verbosity levels of zipl session (--debug)
    * zkey: Remove the use of AF_ALG for calculating key verification patterns
  - Bug Fixes:
    * ebc: implement --version option for pvics
    * pvebc: Log services to journal+console
    * pvics: Fix virt-resize permission error
  - Removed obsolete patch
    * s390-tools-pvebc-Log-services-to-journal-plus-console.patch
  - Re-vendor-ed vendor.tar.zst

++++ skillspector:

  - Use %{primary_python} instead of a hardwired python flavor

++++ starship:

  - Update to version 1.26.0:
    * Features:
  - git_state: show git am progress.
  - git: enable sha256 support.
  - nix-shell: Add level variable to show nix shell depth.
  - pixi: expose PIXI_PROJECT_NAME as format placeholder.
  - time: improve timezone handling by switching to jiff.
    * Bug Fixes:
  - gcloud: honor CLOUDSDK_COMPUTE_REGION env variable.
  - improve reliability of config-file writing.
  - maven: avoid detecting user .mvn config as project.
  - nodejs: avoid deno project files.
  - preset: make OS symbol dynamic in Tokyo Night theme.
  - statusline: handle null context_window fields at session start.

++++ tenmon:

  - update to 20260626:
    * Load correct HDU for compressed FITS
    * Update icons
    * Defered sql load for DatabaseTreeView
    * Use std::filesystem::path for XISF files

++++ tik:

  - Update to version 1.5.1:
    * Remove setup_env function from 10-welcome
    * Add btrfs resize command in GNOME setup script
  - Fix packaging issues for tik 1.5

++++ uwsm:

  - Update to version 0.26.6:
    * fix(app): support compat /execarg_default: directives in xdg-terminals.list

++++ vermouth:

  - Bump to version 1.9.4
  - Upstream changes:
    * fix: Cover and hero views improvements in text rendering
  - For version 1.9.3:
    * Update sums and commits
    * fix: Fixed winetricks for flatpak
    * Update SHA sums

++++ zstd-jni:

  - Added patch:
    * max-page-size.patch
    + Build with max-page-size of 64K on ppc64le (bsc#1269480)

------------------------------------------------------------------
------------------  2026-6-28  -  Jun 28 2026  -------------------
------------------------------------------------------------------

++++ MistServer:

  - Fix packaging:
    * require only compatible mbedtls-3-devel

++++ aardvark-dns:

  - Update to version 2.0.0:
    * This is major release to keep the version aligned with netavark,
    however it brings no breaking changes
    * The MSRV has been bumped to v1.88
    * Dependency updates

++++ at-spi2-core:

  - Update to version 2.60.5:
    + Fix a possible crash in atk_bridge_adaptor_cleanup.
    + Attempt to fix event listeners still being wrongly deregistered
    in some cases.

++++ blktests:

  - Update to version 0+20260628.dbff8ef:
    * src/miniublk: fall back to legacy opcodes on older kernels
    * src/miniublk: switch to ioctl-encoded ublk commands
    * nvme/060: suppress "nvme connect" failure for rdma transport
    * nvme/060: suppress state file write error

++++ boinc-client:

  - Update to release 8.2.13
    * Fix Manager crash on Wayland (8.2.13)
    * Support Wayland-only operating systems (8.2.12)
    * Add <prioritize_gpu> config option
    * Improve battery level validation logic
    * Various client and Docker-related fixes
  - Drop no longer existing 'xcompile' directory from the platform
    cleanup in %%build (removed upstream).
  - Update boinc-client-rpmlintrc: drop the now-unused
    no-manual-page-for-binary filter and silence two false positives
    (logrotate /var/log, hicolor-icon-theme branding).
  - Drop unused 'update-desktop-files' BuildRequires; the deprecated
    %%suse_update_desktop_file macro is not used and desktop database
    updates are handled by file triggers.

++++ cadvisor:

  - update to 0.60.3:
    * Move OOM watching out of the lib module into the binary
    * lib/model: make ContainerStats sub-stats pointers to convey
    collection presence
  - update to 0.60.1:
    * cpuload/netlink: report the real error and skip the reader on
    cgroup v2
    * deploy: add lib/go.mod to the image build's dependency cache
  - update to 0.60.0:
    * Exposing additional cgroup v2 memory.stat metrics
    * lib: introduce github.com/google/cadvisor/lib — a lean,
    kubelet-focused library module
  - bump x/net to 0.55 (bsc#1266645, CVE-2026-39821)
  - update to 0.57.0 (bsc#1260305, CVE-2026-33186):
    * integration: add more Docker container handler tests
    * integration: add containerd container handler tests
    * integration: add Prometheus metrics endpoint tests
    * fix: support podman `volatile-containers.json` and/or
    `containers.json`
    * proposed roadmap for cAdvisor
    * remove log message when you can't read productName
    * Refactor Github Action per b/485167538
    * fix crio deadlock in getting crio sandbox containers
    * Add container_creation_time_seconds (previously:
    container_start_time_seconds); use runtime start time for
    container_start_time_seconds (podman & docker)
    * deps: github.com/moby/moby/client v0.4.0, moby/api v1.54.1,
    containerd/ttrpc v1.2.8
    * fix(build): update k8s-staging-test-infra image in integ
    tests
    * feat(manager/container): add configurable initial splay and
    max jitter factors
    * feat(manager): add constraint data in OOM events
    * fix: add v-prefixed GHCR image tags for release consistency
    * build(deps): bump the go_modules group across 2 directories
    with 1 update
    * Expose cgroup v2 memory.events as Prometheus metrics
    * deploy: bump base images to Alpine 3.23
  - Update to version 0.56.2:
    * docker: fix nil pointer dereference when GraphDriver is nil
    * Update healthcheck.sh
    * Update entrypoint.sh
    * docker: migrate to github.com/moby/moby modules
    * Update containerd, docker, moby, and opencontainers dependencies
    * update README
    * Update copyright year in healthcheck.sh
    * Update copyright year in entrypoint.sh
    * Added cadvisor boilerplate header to deploy/entrypoint.sh
    * Added cadvisor boilerplate header to deploy/healthcheck.sh
    * Add EXPOSE 8080 to document default port
    * Fix healthcheck to respect custom port flag
    * Add entrypoint wrapper to preserve -logtostderr flag
    * add std in summary
    * fix formatting
    * Update container/docker/factory.go
    * Update factory.go
    * Update factory.go
    * Update factory.go
    * Fix for issue #3772
    * docs: replace references to docker registry `gcr.io` with `ghcr.io`
    * Expose s390x CPU Topology to Prometheus
  - update to 0.55.1:
    * manager: fix race condition in Stop() using sync.Once
    * manager: fix race condition in Stop() using sync.Once
  - update to 0.55.0:
    * Reduce lock contention in manager package
    * container/podman: fix `zfsFilesystem` and `zfsParent` being
    swapped.
    * devicemapper: use atomic.Value for lock-free cache reads
    * Reduce lock contention in cache/memory package
    * zfs: use atomic.Value for lock-free cache reads
    * fix: docker health check status not updating
    * align docker and podman implementations
    * disable CGO for fully static binaries
    * close stale PRs and Issues
    * refactor(container): Migrate to std lib context package
    * add workflow_dispatch to stale github action
    * plugin factory: remove useless RegisterPlugin log output
    * feat(summary): add count in percentiles
    * machine: fixes for unix.Uname use
    * feat: add LoadTaskProcess api in containerd client
    * feat: add exit code in container deletion events
    * feat: add CRI-O integration tests
    * test: reorganize integration tests and add CRI-O test
    coverage
    * refactor: remove duplicate tests from api package and add
    missing CRI-O tests
    * fix: update golang.org/x/crypto to v0.45.0 to fix security
    vulnerabilities
    * container/(docker|podman): rewrite obtaining IP-address
    * Upgrade GitHub Actions to latest versions
    * Upgrade GitHub Actions for Node 24 compatibility
    * feat: add fs io cost metrics
    * go.mod: github.com/docker/go-connections v0.6.0
    * fs: introduce pluggable filesystem architecture
    * Apply build tags liberally for supported environments (linux)
    * Replace godirwalk with os.ReadDir from standard library
    * feat: add cpu burst metrics
  - update to 0.54.1:
    * chore: update cAdvisor image registry and version in
    DaemonSet
    * ci: update Ubuntu version to 24.04 in GitHub Actions
    workflows
    * chore: re-enable golangci-lint checks and fix violations
    * container/docker: GetStats: prevent nil-pointer
  - update to 0.54.0:
    * Let us try to use ghcr.io for container images
    * Add a GH action to create release binaries
    * use qemu/docker to build arch specific binaries
    * add -buildvcs=false to GH action
    * fix(3643) add containerd-snapshotter support
    * Update README.md with latest Docker image version and
    registry
    * Rebase to alpine 3.22, install thin-provisioning-tools from
    main repo
    * feat: add metric for container health check status  (DOCKER-
    Specific!)
    * Update golang and deps
  - update to version 0.54.1:
    * container/docker: GetStats: prevent nil-pointer
    * chore: re-enable golangci-lint checks and fix violations
    * fix: use Docker-embedded containerd socket in integration tests
    * refactor: remove Mesos container support
    * ci: add diagnostic logging for docker/containerd debugging
    * fix: persist containerd client error to prevent nil pointer dereference
    * ci: update Ubuntu version to 24.04 in GitHub Actions workflows
    * chore: update cAdvisor image registry and version in DaemonSet
    * fix: handle nil Health state in docker container handler
    * ci: update Go version to 1.25 in GitHub Actions workflows
    * fix: update dependencies to address security vulnerabilities
    * add health status tests
    * feat: Update docker container handler to include health status in stats
    * Rebase to alpine 3.22, install thin-provisioning-tools from main repo
    * Update README.md Docker image reference
    * fix(3643) add containerd-snapshotter support
    * add -buildvcs=false to GH action
    * use qemu/docker to build arch specific binaries
    * Add a GH action to create release binaries
    * Let us try to use ghcr.io for container images (#3699)
  - update to 0.53.0 (bsc#1257429, CVE-2024-45310,
    bsc#1267788, CVE-2026-10722):
    * fix potential hang on containerd client.LoadContainer
    * Bump dependencies to latest (June 2, 2025)
    * fix: fix call Errorf with wrong err
    * Fixed possible data race
    * Use built-in error wrapping instead of pkg/errors
  - drop CVE-2025-22868.patch (upstream)

++++ calc:

  - update to 2.17.0.0:
    * Sync calc version 3.0.0.4 changes with calc version 2.16.1.3
    to form a new 2.17.0.0, except that the calc version will be
    2.17.0.0 of course.  :-)
    * Added `make asan` rule to make it easier to compile with ASAN
    * NOTE: Use `make clobber` first before using the new rule to
    remove any previous compilation.
    * Added `make gcc` rule to force a compile with `gcc(1)`, (or
    `gcc-15` for macOS), full warnings, no optimizer, no ASAN.
    * Added `make clang` rule to force a compile with `c1ang(1)`,
    full warnings, no optimizer, no ASAN.
    * Added `calc-static-asan` rule to to compile cASAN (Address
    Sanitizer).
    * NOTE: Use `make clobber` first before using the new rule to
    remove any previous compilation.
    * Added `make asan-run` to compile and run calc in the local
    directory, and run with ASAN.
    * Added `make check_lcc` to test if the local C compiler
    (`${LCC}`) can compile a trivial C program.
    * Fixed three memcpy calls in `matsort()` in `matfunc.c`.
    * Fixed and improved `chk_tree`.
    * Added `chk_tree -m` for use with commands such as `make
    full_debug`, and `make debug`.
    * Fixed places where the code still used `BIG_ENDIAN` when it
    needs `CALC_BIG_ENDIAN`.
    * Fixed places where the code still used `LITTLE_ENDIAN` when
    it needs `CALC_LITTLE_ENDIAN`.
    * Added `${EXPAND}` to the list of utilities in
    `Makefile.config`.
    * Echo `${EXPAND}` in the `make env` rule of `Makefile`.

++++ cilium-cli:

  - Update to version 0.19.5:
    * Minor Changes:
  - bgp: Bump GoBGP from v3 to v4.5.0 (cilium/cilium#45952,
    @rastislavs)
  - cilium-cli: don't enable nodeinit on AKS
    (cilium/cilium#46105, @vipul-21)
  - Replace boringcrypto with upstream Go crypto libraries
    (cilium/cilium#46092, @HadrienPatte)
    * CI Changes:
  - cilium-cli connectivity tests now test for policy-based Envoy
    listener redirects on the wildcard port.
    (cilium/cilium#46251, @jrajahalme)
  - cilium-cli: exclude non-Cilium nodes from perf node selection
    (cilium/cilium#46651, @aanm)
  - cilium-cli: Ignore additional known GoBGPv4 warnings in
    no-errors-in-logs (cilium/cilium#46200, @ysksuzuki)
  - cilium-cli: Remove partial JUnit file on error
    (cilium/cilium#46101, @rastislavs)
  - cilium-cli: support versioned scenarios (cilium/cilium#45570,
    @rgo3)
  - cilium-cli: tolerate config init-container restart and GC'd
    previous … (cilium/cilium#46648, @aanm)
  - cli: add exception for "local key already allocated" warning
    (cilium/cilium#46216, @giorio94)
    * Misc Changes:
  - chore(deps): update base-images (main) (cilium/cilium#46054,
    @cilium-renovate[bot])
  - chore(deps): update docker.io/library/golang:1.26.3 docker
    digest to 2d6c802 (main) (cilium/cilium#46163,
    @cilium-renovate[bot])
  - cli/sysdump: capture more operator and clustermesh-apiserver
    troubleshooting information (cilium/cilium#46503, @giorio94)
  - clustermesh: endpoint slices watch and kvstoremesh wiring
    (cilium/cilium#46506, @MrFreezeex)
  - ipam: Migrate IPAMSpec.PodCIDRs to ip.Prefix
    (cilium/cilium#46599, @HadrienPatte)
  - ipam: Migrate VirtualNetwork and IPAMCIDR to netip
    (cilium/cilium#46309, @HadrienPatte)
  - sysdump: add CRD CiliumGatewayClassConfig to sysdump
    (cilium/cilium#46247, @mhofstetter)
  - sysdump: add Gateway API BackendTLSPolicy to sysdump
    (cilium/cilium#46246, @mhofstetter)
  - chore(deps): update actions/stale action to v10.3.0 by
    @renovate[bot] in #3244
  - chore(deps): update docker.io/library/golang:1.26.3 docker
    digest to 6df14f4 by @renovate[bot] in #3243
  - chore(deps): update all github action dependencies by
    @renovate[bot] in #3245
  - Update stable release to v0.19.4 by @tklauser in #3242
  - chore(deps): update docker.io/library/golang:1.26.3 docker
    digest to 2d6c802 by @renovate[bot] in #3246
  - go.mod, vendor: update replace directives to match cilium's
    go.mod by @tklauser in #3247
  - chore(deps): update all github action dependencies by
    @renovate[bot] in #3250
  - ci: fix unquoted expression in images-dev shell condition by
    @immanuwell in #3249
  - chore(deps): update go to v1.26.4 by @renovate[bot] in #3251
  - fix: select released CLI asset by runner platform by
    @immanuwell in #3252
  - chore(deps): update cilium to v1.19.5 by @renovate[bot] in
    [#3257]
  - chore(deps): update all github action dependencies to 718ea10
    by @renovate[bot] in #3256
  - Prepare for v0.19.5 release by @michi-covalent in #3260

++++ cmake-extras:

  - update to 1.10:
    * src/DoxygenBuilder/Doxyfile.in: Create Doxygen documentations
    with FULL_PATH_NAMES set to NO (f9c4fad)

++++ conan:

  - update to 2.29.1:
    * Bugfix: Handle special case where only one possible option is
    defined for shared. (https://github.com/conan-
    io/conan/pull/20082)

++++ corrosion:

  - update to 0.6.1:
    * Fix building shared libraries for iOS.
    * Fix host linker detection for iOS and add the
    CORROSION_HOST_TARGET_LINKER cache variable, to allow users
    to override the linker used for the host build (required for
    build-scripts and proc-macros).

++++ cramfsswap:

  - update to 1.4.5:
    * QA upload.
    * Fixed typo in Vcs links.
    * Adjusted Makefile to work better with parallel build (Closes:
    [#996964]).
    * Updated vcs in d/control to Salsa.

++++ crossplane-cli:

  - Update to version 2.4.0:
    The v2.4.0 release is the first Crossplane CLI release that does
    not correspond to a Crossplane core release. It is compatible
    with the currently supported minor versions of Crossplane core:
    v2.3, v2.2, v2.1, and v1.20. It includes a number of incremental
    features and improvements along with many bug fixes.
    * Highlights
  - New Commands
  - crossplane xr generate converts a claim to a composite
    resource, as Crossplane would do internally when a claim is
    applied to a cluster. #13
  - crossplane xr patch applies defaults from an XRD to an
    input XR, as the apiserver would do when an XR is applied
    to a cluster. #61
  - crossplane xpkg get-crds downloads package dependencies
    based on a crossplane.yaml file or package resource and
    writes their CRDs to files. #26
  - Command Updates
  - crossplane project init now allows a repository to be
    specified. #105
  - crossplane resource validate now has YAML and JSON output
    formats. #66
  - crossplane xpkg push now allows OCI manifest annotations to
    be specified with the --oci-annotation flag. #11
  - crossplane composition render now supports repeating the
  - -required-resources and --extra-resources flags. #107
  - Commands that interact with a cluster (e.g., crossplane
    resource trace and crossplane xpkg install) now support
    impersonation with the --as, --as-group, and --as-uid
    flags. #114
    * Developer Experience Updates
  - Projects can now include pre-built functions specified in the
    crossplane-project.yaml file, allowing functions to be built
    using any language, tool, or framework. #24
  - Projects can now specify a subset of languages for which
    schemas should be generated in the crossplane-project.yaml
    file. #24
    * What's Changed
  - Update dependencies and renovate for v2.3.0 release (main) by
    @adamwg in #19
  - ci: Remove image promotion steps by @adamwg in #22
  - build: Use the shared crossplane cachix cache in nix.sh by
    @adamwg in #17
  - Add the LICENSE file by @adamwg in #27
  - chore(deps): update module github.com/containerd/containerd
    to v1.7.32 [security] (main) by @crossplane-renovate[bot] in
    [#34]
  - chore(deps): update module github.com/sigstore/cosign/v2 to
    v2.6.2 [security] (main) by @crossplane-renovate[bot] in #35
  - chore(deps): update module golang.org/x/crypto to v0.52.0
    [security] (main) by @crossplane-renovate[bot] in #36
  - Improve generation of reference docs by @adamwg in #30
  - chore(deps): update module golang.org/x/net to v0.55.0
    [security] (main) by @crossplane-renovate[bot] in #37
  - chore(deps): update actions/create-github-app-token digest to
    fee1f7d (main) by @crossplane-renovate[bot] in #52
  - Update CONTRIBUTING.md and add install instructions to
    README.md by @adamwg in #49
  - Add the install.sh script and upload it to S3 by @adamwg in
    [#54]
  - docs: Enclose the CLI version number in backticks by @adamwg
    in #55
  - fix(docs): compile the bqRE once at package level by
    @tampakrap in #57
  - chore(deps): update actions/stale digest to eb5cf3a (main) by
    @crossplane-renovate[bot] in #58
  - feat(xr): Convert a Claim to XR via crossplane xr generate by
    @tampakrap in #13
  - chore(deps): pin dependencies (main) by
    @crossplane-renovate[bot] in #51
  - chore(deps): update cachix/install-nix-action digest to
    8aa0397 (main) by @crossplane-renovate[bot] in #60
  - fix(deps): update module github.com/go-git/go-git/v5 to
    v5.19.1 [security] (main) by @crossplane-renovate[bot] in #40
  - render: Sync render.proto with c/c and wire XRD through by
    @jcogilvie in #74
  - Fix Python schema generation for fields named int or bool by
    @negz in #64
  - chore(deps): update actions/checkout digest to df4cb1c (main)
    by @crossplane-renovate[bot] in #76
  - chore(deps): update codecov/codecov-action digest to 75cd116
    (main) by @crossplane-renovate[bot] in #77
  - chore(deps): update github/codeql-action digest to 8aad20d
    (main) by @crossplane-renovate[bot] in #80
  - chore(deps): update mheap/require-checklist-action digest to
    9c8100a (main) by @crossplane-renovate[bot] in #81
  - Support pre-built function runtimes and per-language schema
    generation by @negz in #24
  - render: Clean up unused code and duplicate consts by @adamwg
    in #83
  - render: Replace condition timestamps and sort resources to
    stabilize output by @adamwg in #82
  - feat(render): capture stderr and handle pipeline-fatal exit
    code in both engines by @jcogilvie in #91
  - chore(deps): update actions/checkout action to v6.0.3 (main)
    by @crossplane-renovate[bot] in #84
  - chore(deps): update vale-cli/vale-action action to v2.1.2
    (main) by @crossplane-renovate[bot] in #85
  - feat(xr): Introduce xr patch --xrd by @tampakrap in #61
  - Update the CLI docs path by @adamwg in #99
  - fix(xr): add missing import, caused by merge of outdated base
    tree by @tampakrap in #103
  - ci: Update the CLI reference documentation on every merge by
    @adamwg in #106
  - feat(validate): structured results and --output json|yaml
    flag by @jcogilvie in #66
  - function: Add missing dependencies to the Go function
    template by @adamwg in #109
  - xrd: Opportunistically infer integer types when generating
    from an XR by @adamwg in #108
  - feat: add xpkg get-crds subcommand by @fernandezcuesta in #26
  - Drop the scale subresource before building OpenAPI for schema
    generation by @negz in #119
  - ci: Re-use exising docs PRs and sign off on commits by
    @adamwg in #120
  - ci: Make cli-docs-bot the author of docs update commits by
    @adamwg in #121
  - xrd: Handle v2 XRDs in crossplane xrd convert by @adamwg in
    [#122]
  - fix(render): do not overwrite function docker network if set,
    start crossplane-container in same network by @nkzk in #65
  - chore(deps): update codecov/codecov-action digest to 0fb7174
    (main) by @crossplane-renovate[bot] in #101
  - chore(deps): update korthout/backport-action action to v4.5.2
    (main) by @crossplane-renovate[bot] in #102
  - Expose host-native CLI binary as the default flake package by
    @negz in #126
  - chore(deps): pin dependencies (main) by
    @crossplane-renovate[bot] in #128
  - chore(deps): update renovatebot/github-action action to
    v46.1.15 (main) by @crossplane-renovate[bot] in #129
  - Decompress function runtime tarballs once when loading by
    @negz in #127
  - fix: loaded XRD must honor the composite schema by
    @fernandezcuesta in #123
  - schemas: Prime oapi-codegen's global state to make
    capitalization consistent by @adamwg in #130
  - Add repository option to crossplane project init by @bobh66
    in #105
  - feat(xpkg): add --annotation flag to xpkg build and xpkg push
    by @chaitanyapantheor in #11
  - fix(render): support repeating --required-resources and
  - -extra-resources by @chaitanyapantheor in #107
  - fix(deps): update module github.com/alecthomas/kong to
    v1.15.0 (main) by @crossplane-renovate[bot] in #133
  - chore(deps): update module github.com/containerd/containerd
    to v1.7.33 [security] (main) by @crossplane-renovate[bot] in
    [#132]
  - fix(deps): update module
    github.com/oapi-codegen/oapi-codegen/v2 to v2.7.1 (main) by
    @crossplane-renovate[bot] in #88
  - fix(deps): update module github.com/kubernetes-sigs/kro to
    v0.9.2 (main) by @crossplane-renovate[bot] in #87
  - fix(deps): update module
    github.com/google/go-containerregistry to v0.21.7 (main) by
    @crossplane-renovate[bot] in #86
  - feat: add --as/--as-group/--as-uid impersonation flags by
    @mikeshootzz in #114
  - chore(deps): update renovatebot/github-action action to
    v46.1.16 (main) by @crossplane-renovate[bot] in #139
  - fix(deps): update module
    github.com/crossplane/function-sdk-go to v0.7.1 (main) by
    @crossplane-renovate[bot] in #140
  - deps: Update crossplane dependencies to v2.3.3 by @adamwg in
    [#138]

++++ dash:

  - update to 0.15.3.4 (bsc#1269494, CVE-2026-31323):
    * parser: Fix multi-byte output in here-doc with quoted delimiter
    * input: Replace stdin_state.canon with bufferable
    * input: Fix tee(2) error handling
    * Drop multi-byte character in argstr when discard is on
    * input: Fix EINTR handling when reading from a pipe
    * arith: Fix CVE-2026-31323 INTMAX_MIN / -1 overflow
    * parser: Only reject non-word tokens in case pattern
    * jobs: Make stoppedjobs trivial if JOBS == 0
  - drop shell-Fix-unsigned-char-promotion-and-truncation.patch
    (upstream)

++++ dbus-1-glib:

  - update to 0.114:
    * Fix bug reporting URL (Simon McVittie)
    * Move license documents to a REUSE-style LICENSES/ directory
    * Fix numerous deprecation warnings (Simon McVittie)
    * Avoid naming a variable 'bool', which is a reserved word in
    C23 and caused compilation to fail with gcc-15
    * dbus-glib version control is now hosted on freedesktop.org's
    Gitlab installation, and bug reports and feature requests have
    switched from Bugzilla bugs (indicated by "fd.o #nnn") to

++++ deno:

  - Update to version 2.9.0:
    * 2.9.0 (#35502)
    * feat(npm): publishing-trust ranking and no-downgrade trust policy (#34927)
    * feat: enable default minimum dependency age (#35458)
    * fix(deploy): use JSR latest for deploy CLI (#35493)
    * fix(ext/node): avoid panic when vm.SourceTextModule uses import.meta (#35375)
    * fix(lsp): report TS2307 for unresolved imports in .d.ts entrypoints (#35469)
    * fix(ext/node): support AbortSignal.timeout in node:test mock.timers (#35474)
    * fix(ext/crypto): pad JWK to multiple of 8 bytes for AES-KW wrap (#35475)
    * fix(ext/node): implement process.resourceUsage() (#35468)
    * feat(desktop): autodetect Vite framework (#35470)
    * fix(ext/node): implement t.assert.fileSnapshot for node:test (#35478)
    * fix(desktop): add macOS desktop Info.plist keys (#35484)
    * fix(desktop): use native Wayland instead of XWayland on Wayland systems (#35485)
    * fix: Headers inspect for duplicate Set-Cookie values (#35461)
    * fix(node): expose lazy console stdio streams (`console._stdout`/`_stderr`) (#35488)
    * feat(http): disable Deno.serve automatic compression by default (#35486)
    * fix(ext/http): apply automatic compression for zero-arg serve handlers (#35490)
    * fix(desktop): add Bluetooth usage descriptions to macOS Info.plist (#35472)
    * feat(fmt): add sortNamedImports and sortNamedExports options (#33313)
    * feat(npm): install jsr deps into node_modules via npm-compat registry (#35029)
    * chore: bump libsui to 0.16.0 (#35467)
    * feat(ext/web): web locks api (#31166)
    * fix(core): don't cache WebIDL sequence keys in thread-local v8::Eternal (#35462)
    * perf(workers): incremental message-passing cleanups (#35108)
    * fix(ext/http): close active WebSockets on Deno.serve shutdown (#35105)
    * fix(publish): continue publishing workspace after a package fails (#35133)
    * feat(task): input-based caching with files/output/env (#34509)
    * fix(ext/kv): validate remote KV URL when opening the connection (#35106)
    * fix(test): ignorelist leaks from sanitizer-ignoring tests (#35005)
    * feat(lsp): add inferred type request (#35099)
    * fix(lsp): honor --env-file from deno.json `test` task in test runner (#34905)
    * fix(runtime): capture blob worker roots before revocation (#35128)
    * fix(desktop): hide bundled libc++ symbols so the desktop runtime can be dlopen'd on Linux (#35424)
    * feat(cli): add `deno watch` subcommand (#35301)
    * feat(http): allow disabling serve compression (#35253)
    * feat(compile): persist Web Storage/KV in a per-app data directory (#34618)
    * fix(ext/node): forward permissions when spawning deno with subcommand args (#35443)
    * feat(cli): auto-migrate pnpm-workspace.yaml on resolution failure (#34993)
    * feat: add "preferPackageJson" deno.json setting (#35392)
    * feat(fmt): infer config from .editorconfig (#34071)
    * feat(desktop): default UI backend to webview (#35442)
    * fix(core): always register isolate to prevent silent foreground task drop (#35408)
    * fix(ext/node): initialize named stdio exports lazily (#35428)
    * fix(ext/crypto): allow deriving AES-OCB keys (#35426)
    * chore: add tests for JSDoc @event, @fires, @emits, @listens (#34688)
    * feat(cli): add deno list subcommand to list declared dependencies (#34972)
    * fix(desktop): Wayland support for CEF and webview backends (#35425)
    * fix(ext/node): import attributes and custom module types in registerHooks ESM hooks (#35028)
    * fix(core): unwrap global exports in Wasm ESM integration (#34912)
    * fix(pack): include assets matched by publish.include in the tarball (#35331)
    * feat(test): add --changed and --related flags to deno test (#35199)
    * fix(node/test): route nested top-level test() to a subtest (#35406)
    * feat(desktop): --compress for self-extracting app bundles (#35420)
    * feat(desktop): add Windows .msi installer output format (#35378)
    * build: add support for loong64 and ppc64 (#35410)
    * perf(macos): enable chained fixups to cut pre-main startup (~0.8ms) (#35409)
    * feat(install): seed deno.lock from bun.lock (#35394)
    * feat(test): built-in snapshot testing via t.assertSnapshot (#35139)
    * feat(ext/node): implement node:test mock.module (#35329)
    * fix(coverage): merge coverage for modules loaded with different hash/search params (#35354)
    * fix(ext/node): fix `node:test` hook ordering and error handling (#35393)
    * fix(pack): surface slow type diagnostics (#35379)
    * fix(test): skip invalid doctest import bindings (#35382)
    * fix(ext/node): avoid panic deserializing empty buffers over child_process IPC (#35340)
    * feat(install): seed deno.lock from yarn.lock (#35350)
    * test: bound npm/playwright_compat so a wedged step fails fast (#35396)
    * chore(tests): bump npm/playwright test fixture to 1.60.0 (#35405)
    * fix(test/node): mark test-worker-fshandles-open-close-on-termination as flaky (#35387)
    * fix(npm): symlink workspace npm members into root node_modules by name (#35383)
    * fix(node): propagate source thread id to `process` `workerMessage` event (#35374)
    * fix(install): seed pnpm workspace members and catalog deps (#35376)
    * perf(runtime): lazy-load node:buffer and node:timers globals (#35373)
    * perf: lazy-load OSX frameworks with `lzld` (#35341)
    * fix(update): refetch npm metadata so stale cache doesn't hide newer versions (#35380)
    * feat(desktop): add Linux .deb and .rpm installer output formats (#35296)
    * perf: V8 code cache for residual lazy-loaded ESM modules (#35338)
    * feat(task): add --jobs/--concurrency flag to deno task (#35318)
    * docs: consolidate Deno.bundle reference category (#35342)
    * feat: `deno remove --global` as alias for `deno uninstall --global` (#35327)
    * feat(install): seed deno.lock from pnpm-lock.yaml (#35346)
    * fix(tests): skip npm/playwright_compat on windows-aarch64 (#35358)
    * fix(runtime): make Deno.test.* sub-methods no-op under `deno run` (#35344)
    * feat(install): seed deno.lock from package-lock.json (#35330)
    * refactor: add the zero-cost CLI argument parser engine (#35334)
    * perf(snapshot): guard against lazy modules leaking into eager snapshot (#35332)
    * refactor(core): route residual lazy_loaded_js code cache through ModuleLoader (#35335)
    * perf: gate eager node bootstrap to node workers (#35337)
    * refactor: extract CLI flag types into deno_cli_parser crate (#35333)
    * fix(jupyter): report cell errors instead of failing silently (#35328)
    * docs: improve JSDoc for Deno namespace types from docs feedback (#35326)
    * perf: startup time (22ms -> 15ms) (#34450)
    * chore: bump node_compat test suite to Node.js 26.3.0 (#34746)
    * feat(task): add --if-present flag to deno task (#35315)
    * docs(cli): clarify install --node-modules-dir, --dev, --reload, --check help (#35325)
    * feat(task): set npm_execpath, npm_node_execpath and npm_command for package.json scripts (#35317)
    * fix(resolver): better hint when importing a linked package by the wrong name (#35319)
    * docs(ext/net): clarify Deno.TcpConn.setNoDelay Nagle's algorithm wording (#35324)
    * fix(ext/node): fail node:test on unhandled rejection and enforce timeout (#35297)
    * docs: fix dead MDN link to Body interface (#35266)
    * fix(ext/signals): build windows-sys only on Windows (#35283)
    * fix(ext/net): cancel in-flight reads when closing TCP/Unix/Vsock streams (#35294)
    * refactor(runtime): allow disabling the OffscreenCanvas global via env var (#35287)
    * refactor(resolver): allow disabling verbatimModuleSyntax via env var (#35288)
    * feat(ext/node): implement node:test mock.timers (#33946)
    * perf(core): reduce snapshotted cppgc op member templates (#35298)
    * fix(ext/node): don't apply requestTimeout to active streaming responses (#35291)
    * fix(ext/node): support HTTP/2 on the DENO_SERVE_ADDRESS override listener (#35089)
    * fix(serve): exit cleanly on SIGTERM/SIGINT in deno serve (#32862)
    * refactor(ext/fetch): check net deny list against connected peer addr (#34418)
    * fix(npm): don't apply import map to npm bin main module (#35097)
    * fix(test): use `#` instead of `$` as the doc test virtual file sigil (#35095)
    * fix(ext/node): stop coloring non-TTY streams in `util.styleText` (#35236)
    * feat(install): warn on package.json engines mismatch (#34225)
    * feat(coverage): add configurable coverage thresholds (#35056)
    * fix(install): resolve package.json dependencies in global install (#35135)
    * fix(core): preserve custom .stack getters in error/test formatter (#35246)
    * fix(upgrade): stream zstd delta patch to avoid 2GiB OOM (#35284)
    * fix(ext/net): set transport on address for TlsListener (#35258)
    * fix(ext/node): single source of truth for emulated Node version (#35273)
    * fix(lsp): include tsconfig roots in script names (#34136)
    * docs: update Chocolatey install link to community.chocolatey.org (#35282)
    * feat(cli): provide a `node` on PATH when Node.js is not installed (#34969)
    * chore: deprecate no-op --unstable-node-globals flag (#35278)
    * fix(ext/node): check --allow-net for proxied request target in node:http(s) (#35241)
    * fix(npm): slim cached full packument when minimumDependencyAge is set (#35285)
    * fix(permissions): don't require --allow-run for process.kill on self (#34382)
    * refactor(cli): restrict DENO_UNSTABLE_CONTROL_SOCK to local transports (#35276)
    * feat(napi): implement Node-API version 10 (#35270)
    * feat(ext/net): implement Happy Eyeballs for `Deno.connect` and `Deno.connectTls` (#31726)
    * feat(node): bump reported process.version to v26.3.0 (#34747)
    * fix(desktop): correct libdenort unpack path with non-executable extension (#35267)
    * feat(test): add retry and repeats options to Deno.test (#35053)
    * perf: startup profiling instrumentation + clap fast-path (#35263)
    * feat: `deno desktop` subcommand (#33441)
    * feat(runtime): add request_builder_hook for fetch token and cdn-loop headers (#35088)
    * feat(cli): add `deno link` and `deno unlink` subcommands (#34359)
    * feat(test): add --shard flag to split a test run across machines (#35057)
    * fix(task): set npm lifecycle env vars when running package.json scripts (#35252)
    * chore(tools): make lint.js work in jj checkouts (#35255)
    * perf(snapshot): minify snapshot sources (#35183)
    * fix(ext/node): preserve AsyncLocalStorage context across node:net callbacks (#35237)
    * fix(ext/node): keep dns.lookup permission token internal (#35224)
    * fix(ext/fs): truncate should not follow a terminal symlink (#35239)
    * feat: add stable --unsafe-proto flag (#34738)
    * fix(runtime): suggest --unstable-unsafe-proto after __proto__ access (#35192)
    * fix(npm): make peer dependency warning actionable and show importers (#35242)
    * fix(ext/node): restore Node binding signature for zlib write/writeSync (#35238)
    * fix(ext/fetch): require --allow-net for Unix proxy in createHttpClient (#35231)
    * feat: support `ignore` option in `Deno.watchFs` (#31582)
    * fix(ext/node): allow registerHooks with no resolve or load hook (#35235)
    * fix(ext/node): implement worker_threads.isInternalThread (#35234)
    * fix(npm): avoid spurious npm re-resolution that fails under --cached-only (#35051)
    * feat(ext/crypto): support remaining modern WebCrypto algorithms (#35223)
    * fix(resolver): resolve linked packages by bare specifier (#35228)
    * fix(ext/napi): restore Explicit microtask policy in napi_resolve_deferred (#35212)
    * feat(bundle): add --declaration flag to generate rolled-up .d.ts files (#33838)
    * feat(lockfile): auto-resolve git merge conflicts in deno.lock (#34726)
    * perf(ext/web): port console/inspect to Rust (cppgc object wrap) (#35087)
    * feat(fmt): use lax-markup for HTML, XML, SVG, and components (#35174)
    * fix(coverage): don't panic in summary reporter without a common root (#35211)
    * fix(repl): highlight regex literals correctly (#35103)
    * feat(test): show sub-millisecond test durations (#35200)
    * feat(install): create node_modules for workspace members (#34970)
    * fix: cache 404 responses for remote modules (#35138)
    * feat(fmt): use lax-css for CSS, SCSS, and Less (#35160)
    * feat(unstable): CSS module imports (with { type: "css" }) (#35093)
    * feat(test): add Deno.test.each for parameterized tests (#34938)
    * fix(core): handle async op promise id wraparound (#35126)
    * perf(ext/crypto): port WebCrypto from JS to Rust (#34966)
    * feat(fmt): use lax-sql for SQL formatting (#35161)
    * feat: stabilize bare node built-in resolution (#33316)
    * feat: stabilize "links" field in deno.json (#34996)
    * perf(core): skip source ASCII checks in release runtime setup (#35186)
    * fix(serve): update request_signal_streaming spec for legacy abort warning (#35193)
    * feat: support navigator.userAgentData (#34743)
    * fix(install): remove stale root node_modules symlink on deno remove (#35137)
    * fix(serve): shut down old workers on watcher restart (#35136)
    * fix(core): make uv_compat ready queues thread-safe (#35175)
    * fix(ext/fetch): keep content-encoding and content-length on decompressed responses (#35124)
    * fix(lsp): make requests work for files opened from node_modules (#35176)
    * feat(ext/http): deprecation warning for legacy request abort (#34397)
    * fix(runtime): don't silently lose Deno.watchFs events (#35122)
    * fix(permissions): require --allow-net for Unix domain socket ops (#34395)
    * fix(ext/node): make registerHooks resolve hook work for nested imports (#35169)
    * fix(npm): support `catalog:` protocol in deno.json imports (#35168)
    * chore(wpt): upgrade deno_dom to fix silent empty test bundles (#35184)
    * fix: accept U+30FB KATAKANA MIDDLE DOT in identifiers (#35147)
    * fix(check): treat npm .d.ts as CJS based on package.json (#35166)
    * chore: publish benchmark JSONL files (#35146)
    * chore: cover first node:http proxy request under test (#35001)
    * fix(permissions): treat Windows `\\?\` verbatim paths as equivalent (#35096)
    * fix(ext/crypto): clamp X448 scalar per RFC 7748 (#35157)
    * fix(ext/node): implement test.TestContext.runOnly (#35158)
    * ci: guard release snapshot flags (#35164)
    * docs(runtime): clarify worker Deno.exit behavior (#34167)
    * ci: fix pnpm exec version check in npm publish workflow (#35156)
    * fix(publish): skip already-published versions before type checking (#35134)
    * fix(ext/node): trace v8 serializer delegate (#35132)
  - Update to version 2.8.3:
    * 2.8.3 (#35144)
    * fix(ext/fs): stream Deno.readDir entries (#35130)
    * perf(core): reduce native callback snapshot overhead (#35121)
    * fix(ext/http): surface errors thrown while streaming a Deno.serve body (#35104)
    * fix(repl): treat trailing `.` as incomplete input (#35101)
    * fix(ext/web): friendlier URLPattern construction errors (#35102)
    * fix(test): wait for worker termination before pending promise failures (#35127)
    * fix(test): handle escaped markdown code fences (#35125)
    * fix(jupyter): handle completion cursor_pos as Unicode codepoints (#35098)
    * fix(runtime): cancel prompt on esc (#35004)
    * fix(compile): run forked child's module instead of entrypoint (#34687)
    * fix(ext/web): don't trip debugger on handled stream writer-release rejection (#35100)
    * fix(ext/node): keep v8.serialize output readable by Node.js (#35118)
    * fix(permissions): allow non-recursive reads/writes on ancestors of deny (#34504)
    * fix(ext/node): keep node:vm ContextifyContext wrapper alive with its context (#35090)
    * feat(test): forward shebang permissions into `deno test --doc` (#35052)
    * fix(outdated): send npm Accept header when fetching package metadata (#35012)
    * test: reenable flaky fetch tests on Windows (#35058)
    * fix(ext/node): export runMain from node:module (#35065)
    * fix(test): do not report "only" notice when a test fails on its own (#35063)
    * fix(lint): name the offending plugin in lint plugin load errors (#35067)
    * fix(ext/fetch): preserve empty multipart filenames (#35009)
    * fix(info): normalize trailing spaces in file path args on Windows (#35008)
    * fix(ext/http): prefer brotli for equal compression q-values (#35011)
    * test(ext/http): cover h2 serve request behavior (#35082)
    * fix(ext/http): join split request headers consistently (#35081)
    * fix(ext/node): count forked child process sockets (#34096)
    * fix(ext/node): propagate nextLoad(newUrl) redirect to default loader (#35027)
    * fix(publish): preserve default export of `export *` re-exported module (#34709)
    * fix(lsp): start rename after extract refactors (#34832)
    * build(flake): update rusty-v8 and rust-overlay (#34839)
    * fix(coverage): improve HTML report PageSpeed score (#34980)
    * fix(ext/node_crypto): support PBES2/AES-CBC bags in tls.createSecureContext pfx (#34438)
    * fix(permissions): correct -A wording in raw-mode prompt message (#35070)
    * test: assert deno fmt --check does not modify files (#34811)
    * fix: resolve global install import maps from original cwd (#34165)
    * fix(ops): build fast-call errors without re-entering JS (#35042)
    * fix(permissions): don't hang prompt when stdin is in raw mode (#34457)
    * fix(ext/node): accept non-canonical RSA SPKI keys (#34134)
    * fix(ext/node): replay direct writes on stale http retry (#34992)
    * fix: ignore 0 value for OTEL_METRIC_EXPORT_INTERVAL (#35054)
    * fix(ext/node): guard TCPWrap.open against adopting tracked fds (#35045)
    * fix(check): honor ts suppressions for unresolved imports (#34163)
    * fix(ext/node): don't cache a pointer to the zlib result buffer (#35043)
    * fix(ext/webgpu): bounds-check + view-aware setBindGroup Uint32Array fast path (#33980)
    * fix(ext/node): fix asciiSlice & ucs2Slice & hexSlice being too slow (#34525)
    * fix(ext/node): transfer TCP handle ownership in http2 consumeStream (#35047)
    * fix(ext/ffi): accept Uint8Array<ArrayBufferLike> in FFI buffer types (#34999)
    * fix(runtime): keep lazy Deno namespace APIs writable (#35050)
    * fix(http): handle raw h1 serve regressions (#35049)
    * chore: update webgpu (#34319)
    * perf(config): match glob paths relative to base (#35039)
    * fix(ext/web): repair text_decoder_stream bench after BlobStoreTrait change (#35044)
    * refactor(ext/web): extract BlobStoreTrait to allow custom blob store implementations (#34000)
    * docs: add jsdocs for URLSearchParams, Storage, FormData, EventSource (#34278)
    * fix(watch): keep watcher alive when script calls Deno.exit() (#35021)
    * fix(repl): show tab completions for navigator.gpu (#35006)
    * perf(ext/web): ASCII fast path for streaming TextDecoder.decode (#34299)
    * fix(fmt): align singleBodyPosition schema values (#34304)
    * fix(ext/node): enforce maxBuffer in child_process.spawnSync (#34053)
    * fix(runtime): source map maybe cjs modules (#35013)
    * fix(cli): generate type-only doc-test imports under verbatimModuleSyntax (#33508)
    * fix(lint): helpful error for Deno.lint.runPlugin outside deno test (#35018)
    * fix(inspector): attribute idle event-loop wait to (idle) in CPU profiles (#35034)
    * fix(resolver): prefer deno jsx options over tsconfig (#34141)
    * fix(ext/webgpu): update published crate repository url (#33916)
    * feat(ext/telemetry): honor OTEL_SPAN_EVENT_COUNT_LIMIT (#34795)
    * fix(core): use isolate_unchecked accessors for fast `&v8::Isolate` args (#33474)
    * fix(core): silence too_many_arguments on Callable trait method (#33475)
    * fix(bundle): respect `--check` and run the type checker (#33514)
    * refactor(lsp): use ToV8 for the getSignatureHelpItems request (#34783)
    * chore: upgrade deno_graph to 0.108.4 (#35035)
    * perf(lsp): cache shared workspace data across members (#32476)
    * Revert "test(node_compat): enable parallel/test-child-process-send-utf8.js" (#35036)
    * fix(ext/node): unblock static module loads when registerHooks is active (#35026)
    * fix(cli): don't let --env-file set Deno's own runtime control vars (#35032)
    * feat(ext/telemetry): honor OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT (#34787)
    * refactor(core): derive FromV8/ToV8 for JsError and BenchResult (#34749)
    * fix(ext/net): handle missing port and path in listen and listenDatagram (#31681)
    * fix(lsp): update cache after workspace folder changes (#32823)
    * fix(ext/node): implement url.fileURLToPathBuffer (#34883)
    * docs(cli): document environment variables advertised by flag help (#34774)
    * fix(ext/node): throw ERR_UNKNOWN_BUILTIN_MODULE for unknown node: builtins (#34766)
    * test(node_compat): enable parallel/test-child-process-send-utf8.js (#34778)
    * fix(ext/web): fire FileReader progress events as tasks (#34763)
    * feat(ext/telemetry): support OTEL_TRACES_SAMPLER (#34764)
    * chore: upgrade v8 to 149.3.0 (#35030)
    * fix(test): skip markdown roots when building watcher graph (#35003)
    * fix(repl): report descriptive syntax error instead of "Unexpected token '<'" (#35016)
    * fix(publish): ignore unused type parameter diagnostics from fast check (#35017)
    * fix(ext/web): writableStreamForRid accepts any ArrayBufferView/ArrayBuffer (#35020)
    * feat(fmt): add JSON trailing comma config (#33383)
    * fix(cli): accept allow-import for deno add (#35019)
    * fix(fmt): pass newlineKind option to JSON and Markdown formatters (#32579)
    * fix(serde_v8): add recursion depth limit to deserializer (#34984)
    * fix(publish): catch banned triple slash directives anywhere in file during dry-run (#35010)
    * test(cli): cover shebang doc test extraction (#35007)
    * fix(repl): print uncaught exceptions from timers at the prompt (#35002)
    * perf(ext/web): convert geometry.js from lazy_loaded_esm to lazy_loaded_js (#34997)
    * docs: update usage examples for ext crates (#34978)
    * fix(install): preserve workspace member resolution in global install (#34989)
    * fix(ext/fs): clarify that Deno.symlink() needs unscoped permissions (#34991)
    * chore: test coverage for decorator access has method (#34998)
    * fix(ext/node): keep sqlite iterator callbacks alive (#34982)
    * fix(ext/io): cancel pending readable stream reads (#34986)
    * fix(npm): support workspace: dependencies with an alias in package.json (#34990)
    * fix(npm): resolve workspace members with prerelease versions (#34928)
    * feat(workspace): auto-discover external deno.json import maps (#34803)
    * fix(ext/node): guard sqlite authorizer reentrant replacement (#34983)
    * fix(ext/node): trace v8 deserializer delegate (#34981)
    * fix(outdated): include catalog dependencies in deno outdated/update (#34977)
    * feat(outdated): warn about packages skipped due to registry errors (#34974)
    * fix(publish): detect circular workspace dependencies before authorization (#34823)
    * fix: throw ERR_DIR_CLOSED on use-after-close in Dir (#34910)
    * feat(ext/node): auto-instrument node:http2 with OpenTelemetry (#34510)
    * fix(ext/node): handle EMFILE in child_process.spawn and compound shell commands (#33544)
    * fix(update): show version requirement in interactive picker (#34671)
    * fix(ext/os): don't expose invalid env var keys from Deno.env.toObject() (#34711)
    * fix(serve): apply import map to main module in `deno serve --watch` (#34893)
    * fix(ext/node): wire ConnectionsList hooks so headersTimeout doesn't spuriously fire (#34356)
    * fix(clean): keep cleaning when cache files are locked and report holders (#34946)
    * fix(resolver): collapse redundant slashes in file specifiers (#34713)
    * fix(ext/node): clear nonblocking fd stdio for child pipes (#34962)
    * feat(ext/fetch): support `priority` in `RequestInit` (#34716)
    * fix(compile): resolve bare npm imports in --bundle worker sources (#34967)
    * fix(lockfile): write through deno.lock symlink instead of replacing it (#34826)
    * fix: support --inspect family in NODE_OPTIONS (#34717)
    * fix(check): surface unresolved imports in .d.ts entrypoints (#34168)
    * fix(cli): strip trailing CR from args so CRLF shebangs work (#34968)
    * fix(publish): improve error reporting for JSR manifest verification (#34690)
    * fix(ext/web): clearer error when a resource-backed stream is consumed after close (#34964)
    * fix(cli): collect re-exported names for `deno test --doc` injection (#33511)
    * fix(ext/node): fix broken encoding validation in indexOfBuffer (#33393)
    * fix(install): handle ETXTBSY when setting up node_modules (#33311)
    * fix(add): accept npm version ranges on the command line (#34799)
    * perf(ext/fs): use file identity instead of canonicalize in copyFile same-path guard (#34750)
    * fix(install): suppress peer dependency warnings for overridden packages (#34935)
    * fix(runtime): show import location for unsupported import attributes (#34824)
    * fix(bundle): apply node-style CJS interop on all platforms (#34939)
    * refactor(tls): deduplicate rustls-webpki (#34965)
    * refactor(wasm): remove wasm-encoder dependency (#34954)
    * fix(ext/web): support SharedArrayBuffer over BroadcastChannel (#34961)
    * feat: `bump-version -c` to handle deno.json + package.json in same dir (#34770)
    * fix(ext/crypto): align WebCrypto modern algorithms with the spec (#34941)
    * fix(ext/node): implement mock.property() in node:test (#34959)
    * chore: test coverage for format() preserves WHATWG URL credentials (#34951)
    * fix(ext/process): run shebang-less scripts via /bin/sh on ENOEXEC (#34945)
    * fix(ext/node): match Node's UTF-8 replacement for invalid bytes in Buffer decode (#34947)
    * fix(ext/node): support ChildProcess.send with net.Server handles (#34948)
    * feat(x): add deno x --ignore-scripts (#34952)
    * refactor(cron): remove saffron dependency (#34879)
    * refactor(fetch): remove tower-http decompression (#34867)
    * fix(core): externalize lazy loaded sources (#34936)
    * feat(ext/node): notify control socket when node:http server starts serving (#34949)
    * fix(bundle): instantiate .wasm imports instead of emitting raw bytes (#34923)
    * feat(ext/crypto): implement SubtleCrypto.supports() static method (#34903)
    * fix(ext/crypto): ML-KEM raw-seed, seed-form PKCS#8, and JWK (#34924)
    * perf(ext/http): add Deno-owned HTTP/1.1 serve path (#34446)
    * fix(ext/http): don't crash server on dead streaming-body resource (#34933)
    * fix(ext/fetch): block requests to bad ports per Fetch Standard (#34863)
    * fix(ext/crypto): support raw-public format for existing asymmetric keys (#34920)
    * fix(runtime): don't panic on missing SnapshotOptions when no snapshot (#34929)
    * fix(ext/web): show state and supportsBYOB in ReadableStream inspect (#34932)
    * refactor: reduce env_logger feature set (#34898)
    * fix(ext/crypto): move getPublicKey to SubtleCrypto and validate usages (#34913)
    * fix(lsp): ignore relative import map remaps (#34856)
    * fix(permissions): run special-file guard for no-follow ops (#34393)
    * fix(dotenv): include underscore in unbraced variable names (#34797)
    * feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate (#34756)
    * feat(info): support --minimum-dependency-age flag (#34762)
    * fix(console): %c colors with same red component as previous color (#34784)
    * feat(config): support globs in links (#34849)
    * fix(resolver): don't treat a linked deno.json package as an npm link (#34841)
    * fix(cli): check worker's own permissions for dynamic asset imports (#34707)
    * fix(ext/websocket): send URL userinfo as Basic auth header (#34708)
    * fix(compile): prune managed npm snapshot to graph-reachable packages (#34741)
    * feat(lsp): show no-slow-types diagnostics for JSR packages (#34740)
    * fix(publish): allow stable text imports (#34692)
    * fix(run): error instead of panicking when watch flags are used with stdin (#34785)
    * test(node_compat): enable three passing vm tests (#34796)
    * fix(lsp): prefer exact import map remaps (#34855)
    * fix(watch): detect newly created files in fmt/lint/test/bench --watch (#34828)
    * fix(core): don't set ERR_MODULE_NOT_FOUND code on module linking errors (#34800)
    * feat(lsp): provide hover info for import map resolutions (#34854)
    * fix(ext/fs): report broken symlink read as NotFound, not FilesystemLoop (#34833)
    * fix(coverage): exclude linked/patched packages from coverage report (#34834)
    * fix(ext/crypto): ChaCha20-Poly1305 uses raw-secret format and iv param (#34915)
    * fix(bundle): don't panic when esbuild binary is busy or unavailable (#34845)
    * feat(ext/crypto): support ML-DSA JWK import/export (#34914)
    * fix(ext/crypto): use outputLength for SHAKE/cSHAKE/TurboSHAKE digests (#34911)
    * fix(lsp): suggest import map aliases for remaps (#34857)
    * fix(ext/kv): update access_token error message to new deno deploy console (#34918)
    * fix(ext/fetch): only match multipart delimiter lines (#34587)
    * fix(ext/web): URL.createObjectURL throws ERR_INVALID_ARG_TYPE for non-Blob args (#34878)
    * feat(lsp): diagnose import map files (#34864)
    * fix(ext/kv): validate batchSize and expireIn inputs (#34782)
    * feat(cli): support --env-file in dependency and registry subcommands (#34843)
    * fix(cli): include the typed name in unrecognized subcommand error (#34882)
    * tests(eval): add spec tests for eval error reporting and exit codes (#34884)
    * fix(ext/node): don't expose Module.register stub (#34894)
    * fix(watch): respect --watch-exclude in deno serve (#34847)
    * fix(ext/node): accept scoped IPv6 interface in dgram addMembership (#34899)
    * fix(bundle): rename sourcemap for HTML entrypoints (#34901)
    * fix(lsp): cache JSR type roots (#34886)
    * chore: test cover PE32 node.exe addon imports (#34848)
    * refactor(ext/crypto): move webcrypto key store to Rust (#34881)
    * docs(contributing): fix Windows build prerequisites (#34842)
    * fix(clean): support `deno clean --dry-run` without --except (#34846)
    * refactor(ffi): remove serde-value dependency (#34851)
    * fix(compile): support fs.fstatSync on vfs (#34892)
    * perf(lsp): cache lint and doc diagnostics per document module (#34875)
    * fix(check): ignore doc comment dynamic imports (#34888)
    * feat(compile): support watch mode (#34860)
    * fix(ext/node): match Node.js when dns.lookup hostname is falsy (#34887)
    * fix(net): preserve unix abstract socket paths (#34874)
    * fix(ext/process): treat Windows kill on exited process as NotFound (#34889)
    * chore: regression test for clearImmediate semantics across TCP socket close (#34852)
    * chore: test cover CJS bare builtin requires (#34853)
    * fix(ext/fetch): don't decompress empty body advertised as gzip/br (#34880)
    * fix(ext/http): include buffered request bytes in size hint (#34831)
    * feat(lsp): add Deno.test ignore and only code actions (#34861)
    * fix(ext/node): keep worker alive while holding a refed MessagePort (#34877)
    * fix(cache): retry locked cache database instead of deleting it (#34873)
    * fix(test): support blockquoted markdown doc tests (#34871)
    * fix(lsp): evict on-disk documents from cache when deleted or changed (#34858)
    * fix(runtime): serialize terminal permission prompts (#34821)
    * fix(ext/node): implement setKeepAlive on native TCPWrap (#34865)
    * fix(cli): don't suggest non-existent subcommand-flag combinations (#34810)
    * feat(lsp): report `deno doc --lint` diagnostics (#34733)
    * fix(check): treat .d.ts in ESM-supporting npm packages as ESM (#34613)
    * feat(info): add localPath to npm packages in `deno info --json` (#34806)
    * fix(ext/node): read proxy env vars without --allow-env (#34807)
    * fix(jupyter): verify HMAC signatures on incoming kernel messages (#34825)
    * fix(ext/node): bump emulated Node version to v24.15.0 (#34804)
    * feat(lsp): add "Debug" code lens for test steps (#34742)
    * test(ext/web): differential tests for geometry matrix math (#34817)
    * refactor: replace weak-table in lsp document cache (#34776)
    * refactor(lsp): remove fancy-regex from route matching (#34813)
    * refactor: replace nalgebra in web geometry (#34771)
    * fix(npm): run workspace package lifecycle scripts (#34615)
    * refactor(ext/node): use primordials across the node:* polyfill layer (#34721)
  - Update to version 2.8.2:
    * 2.8.2 (#34791)
    * tests(run): add spec tests for non-executable entrypoints (#34779)
    * fix(ext/web): honor PerformanceObserver buffered flag (#34748)
    * fix(ext/web): make MessageEvent.ports a frozen array (#34773)
    * chore: test node_modules symlinks in npm workspace with cyclic deps (#34759)
    * fix(npm): apply scoped registry auth to same-origin tarballs (#34698)
    * fix(jupyter): make kernel ZMTP handshake compatible with libzmq (#34755)
    * refactor(lsp): serialize positional TSC requests with ToV8 (#34775)
    * fix: resolve local file when folder name matches import-mapped package (#32854)
    * Revert "fix(runtime): throw a descriptive error for disabled __proto__ accessor (#34730)" (#34772)
    * chore: regression tests for rename preserving import map alias (#34761)
    * fix(lsp): spurious diagnostics in Jupyter notebook cells (#34734)
    * fix(lsp): skip parent process check when PID isn't visible (#34744)
    * fix(install): handle pre-existing node_modules symlink on Windows (#34659)
    * fix(add): handle version tags like `@latest` in `deno add` for JSR packages (#32859)
    * fix: remove node_shim exec dependency (#34739)
    * fix(runtime): throw a descriptive error for disabled __proto__ accessor (#34730)
    * fix(compile): enable ANSI colors on Windows in compiled binaries (#34701)
    * fix(ext/fs): error when copyFile source and destination are the same file (#34718)
    * chore: upgrade WPT submodule and refresh all expectations (#34573)
    * chore: regression test for legacy subpath main under .deno layout (#34737)
    * refactor: replace winapi usages with windows-sys (#34732)
    * fix: opt-in mitigation for React RCE/DoS CVEs (#34676)
    * fix(lsp): release idle memory back to the OS (#34727)
    * refactor(lsp): bundle import-completion services into CompletionContext (#34731)
    * perf(node): skip require permission checks when read is fully granted (#34722)
    * fix(lsp): limit node_modules auto-import aliasing (#34674)
    * feat(lsp): autocomplete jsr:/npm:/node: in deno.json(c) imports (#34724)
    * fix(lsp): use cached registry config when offline (#34723)
    * chore: add no-unused-vars regression test for JSX factory (#34725)
    * fix(node): avoid spurious ERR_MULTIPLE_CALLBACK on process.stdout/stderr (#34728)
    * feat(compile): improve --bundle dependency resolution and add --minify (#34536)
    * fix(check): make node:stream/web types alias the globals (#34606)
    * docs(cli): document undocumented runtime API declarations (#34715)
    * fix(tsc): resolve Web globals to Deno's versions in npm packages (#34634)
    * fix(task): restore terminal mode after task exits on Windows (#34685)
    * feat(ext/node): env/global proxy support for node:http and node:https (#34257)
    * fix(npm): share copy-package variants via symlink for class identity (#34691)
    * fix(napi): support ZeroMQ libuv addon symbols (#34657)
    * fix(install): run workspace member dependency lifecycle scripts with member INIT_CWD (#34700)
    * fix(runtime): suggest Worker/node:vm alternatives for npm:isolated-vm (#34702)
    * fix(fmt): update markup_fmt to fix quadratic inline CSS formatting (#34663)
    * fix(node): full re-export fallback for unresolvable member re-exports (#34689)
    * fix(ext/napi): clear error for Windows addons that link against node.exe (#34696)
    * fix(compile): cover CJS-deep imports under --bundle (#34534)
    * fix(runtime): suggest N-API alternatives for legacy V8/nan addons (#34695)
    * fix(core): preserve WebAssembly streaming callback across new contexts (#34679)
    * fix(ext/node): report real error code for failed dns.lookup (#34697)
    * fix(lsp): complete npm package exports (#34675)
    * fix(ext/fetch): preserve static request body length (#34546)
    * fix(lsp): recover from TSC isolate OOM instead of crashing the language server (#34693)
    * fix(lsp): use file uris for neovim virtual definitions (#34653)
    * fix(napi): report a clear error for legacy V8/nan native addons (#34683)
    * fix(lsp): walk to enabled nested workspaces (#34654)
    * fix(lsp): include configured deps in auto-imports (#34650)
    * fix(rt): support host-FS CJS files in the standalone runtime (#34560)
    * fix(ext/fs): retry without FILE_FLAG_BACKUP_SEMANTICS on Windows when driver rejects it (#34686)
    * fix(lsp): support test steps from imported helpers (#34648)
    * chore(lsp): test cover for wasm multi-value return types (#34652)
    * perf(ext/fetch): cache lowercased header names per Headers instance (#33683)
    * fix(lsp): handle parser panics while parsing documents (#34640)
    * perf(ext/node): gate node:http async resource entry (#34608)
    * feat(compile): scope --bundle npm embed to packages actually reached (#34532)
    * chore: cover same-dir import map auto-import alias (#34645)
    * fix(node): classify required js files as commonjs by default (#34673)
    * perf(http): remove legacy hyper 0.14 from deno_http (#34557)
    * feat(ops): add enum support to FromV8 derive (#34241)
    * fix(lsp): surface module-level uncaught errors in test runs (#34641)
    * fix(lsp): avoid empty import specifier completions (#34647)
    * fix(runtime): suggest --allow-scripts for `bindings` native addon error (#34666)
    * refactor(lsp): use ToV8 derive for LoadResponse (#34240)
    * fix(lsp): merge duplicate completion imports (#34658)
    * refactor(cli/lint): use FromV8 derive for PluginInfo (#34239)
    * fix(node): resolve CJS requires with multi-level relative specifiers on Windows (#34655)
    * fix(lsp): handle empty jsx completion ranges (#34651)
    * fix(lsp): complete string union literals containing dots (#34664)
    * fix(ext/node): capture IPC handle eagerly to fix cluster send deadlock (#34661)
    * fix(compile): transpile TypeScript imported at runtime (#34616)
    * fix(ext/fetch): implement missing Request properties (#34607)
    * fix(lsp): honor `moduleResolution: "bundler"` for npm dir imports (#34643)
    * fix(npm): clean node_modules after deno remove (#34110)
    * feat(jupyter): rewrite kernel in JS, drop zeromq/runtimelib deps (#34083)
    * feat(ext/node): support DENO_SERVE_ADDRESS override in node:http servers (#34662)
    * chore: deflake run_watch_reload_once (#34660)
    * refactor(ext/web): port ImageData to Rust with CPPGC/objectwrap (#33777)
    * fix: absolute links should be processed using directory functions (#34218)
    * fix(compile): bundle workers separately under --bundle (#34531)
    * refactor(lsp): remove unwrap() in PerformanceScopeMark drop (#34410)
    * fix(compile): allow process.chdir() into the VFS (#34610)
    * perf(runtime): update notify watcher dependency (#34567)
    * fix(compile): handle CJS and native addons in --bundle (#34529)
    * feat(task): support --env-file flag (#34508)
    * feat: bump deno_task_shell to 0.33.0 (#34642)
    * fix(test): wait for inspector to disconnect before exiting (#34559)
    * perf(ext/node): optimize empty node:http response end (#34493)
    * chore: bump tar from 0.4.45 to 0.4.46 (#34545)
    * fix(crypto): correct X448 PKCS#8 handling (#34578)
    * fix: link to docs in JSON import error message (#34611)
    * fix(compile): create code cache when importing JSON or Wasm modules (#34614)
    * feat(publish): unfurl import specifiers in Wasm modules (#34549)
    * fix(ext/node): expose gc from v8 setFlagsFromString (#34604)
    * fix(lsp): discover all tests when names are duplicated (#34624)
    * fix(ext/node): prevent buffer decode detach race (#34632)
    * fix(ext/fs): surface non-UTF-8 file names from read_dir (#34623)
    * fix: send BroadcastChannel messages before close (#34628)
    * fix(ext/node): honor windowsHide in child_process spawn (#34627)
    * fix(doc): handle non-ASCII doc lint diagnostics (#34626)
    * fix(node): support module-sync export condition (#34599)
    * test: correct source of tiny.wasm reproducer in comments (#34617)
    * docs: clarify listener close with pending accept (#34612)
    * feat(unstable): add --bundle flag to `deno compile` (#34527)
    * fix(compile): support workers loaded from blob URLs (#34574)
    * fix(compile): respect npm registry sub-paths when flattening node_modules (#34575)
    * fix(compile): don't surface graph errors for --include files (#34568)
    * chore: test vm SourceTextModule default import (#34598)
    * chore(ext/node): strengthen scrypt regression test for 128-byte keylen (#34601)
    * fix(ext/node): cover node:module SourceMap export (#34591)
    * fix(ext/http): reject Response-like return from respondWith (#34589)
    * fix(ext/node): add node:test/reporters builtin (#34595)
    * fix(node/repl): gate preview through V8 inspector throwOnSideEffect (#34566)
    * fix(ext/node): add stripTypeScriptTypes export (#34594)
    * fix(ext/node): add module findPackageJSON export (#34597)
    * chore: mark test-process-exit-code-validation.js flaky (#34588)
    * chore: test for describe.only without only failure (#34590)
    * fix(ext/napi): polyfill libuv thread + semaphore primitives (#34571)
    * fix: load classic blob worker main script directly (#34592)
    * fix(test): don't kill the deno process on top-level Deno.exit() (#34564)
    * fix(ext/node): export syncBuiltinESMExports from node:module (#34593)
    * fix(npm): downgrade latest tag for release age (#34581)
    * perf: replace ipnetwork with ipnet (#34580)
    * fix(ext/node): support vm dynamic import callback (#34572)
    * fix(jupyter): exit kernel process after sending shutdown reply (#34554)
    * test(compile): cover more sloppy import patterns (#34569)
    * fix(lsp): preserve URL extensions in `typeof import(...)` hovers (#34565)
    * fix(check): resolve npm packages without types when type checking (#34551)
    * fix(install): rewrite relative imports/scopes in copied deno.json (#34562)
    * fix(cache_dir): EnsureCachedStrategy must surface cached redirects (#34563)
    * perf(ext/web): convert hot stream queues to O(1) Queue, cache _state reads (#34437)
    * chore: update release doc template (#34425)
    * feat(task): support exclusion groups in task name wildcards (#34506)
    * perf(ext/node): cache member-export-props analysis (#34471)
    * fix(config): warn instead of erroring when workspace member dir is missing (#34511)
    * fix(cli/task): run recursive workspace tasks in parallel (#34512)
    * fix(compile): embed workspace package.json files in the VFS (#34530)
    * fix(task): preserve trailing backslashes in task arguments (#34505)
    * fix(install): allow "minimumDependencyAge" object without "age" (#34523)
    * fix(bundle): use node-style CJS interop for the Deno platform (#34533)
    * fix(compile): detect svelte-adapter-deno build output (#34535)
    * fix(ext/ffi): match V8 stack-arg layout in turbocall trampoline on Apple silicon (#34561)
    * fix(ext/node): resolve global cache packages when require referrer is outside DENODIR (#34497)
    * fix(ext/napi): polyfill more libuv symbols from compat layer (#34488)
    * chore: regression test for @types/node AbortSignal/AbortController merge (#34555)
    * fix(config): make config auto-discovery skip the same errors on every platform (#34558)
    * chore: regression test for KV panic on uncaught error with listenQueue (#34553)
    * fix(cli): suppress bug-report banner on broken pipe print panics (#34552)
    * fix(jupyter): keep kernel alive across transient peer disconnects (#34550)
    * chore: upgrade tokio-socks 0.5.1 -> 0.5.3 (#34526)
    * chore: test X-TypeScript-Types is picked up via import map (#34541)
    * chore: jupyter regression test for relative imports (#34494)
    * fix(config): hook up verbatimModuleSyntax for the emit pipeline (#34495)
    * chore: regression test for unsaved Jupyter notebook panic (#34528)
    * chore: regression test for listenQueue not blocking main thread (#34537)
    * fix(runtime): better error message when Deno.consoleSize() has no tty (#34538)
    * fix(ext/node): tolerate unreadable cwd in require._nodeModulePaths (#34542)
    * chore: regression test for `deno test --coverage` rejection reporting (#34540)
    * perf(node): lazy-load node:stream/web cluster out of the snapshot (#34548)
    * fix(ext/io): cancel pending FileResource reads on close (#34544)
    * chore: trim unused OpenTelemetry OTLP default features (#34547)
    * perf(node): lazy stdio + fix LazyEsmModuleLoader source consumption (#34440)
    * fix(resolver): don't resolve linked packages via bare specifier (#34519)
    * chore(lsp): regression test for inlay hints on computed property names (#34518)
    * fix(ext/node): disable repl preview when a custom eval is supplied (#34498)
    * fix(ext/net): re-enable 0-RTT support in QUIC (#34520)
    * fix(cache): skip WAL journal mode on WSL-1 (#34499)
    * fix(ext/node): refuse sqlite close() while a user callback is running (#34515)
    * fix(ext/http): reject Response-like return from serve handler (#34416)
    * chore(ext/web): regression test for AbortSignal.any() controller-only GC (#34516)
    * fix(add): replace panic with error when deno.json discovery fails (#34517)
    * fix(npm): hoist direct deps over higher transitive versions (#34470)
    * fix(ext/node): fix latin1Slice being too slow (#34503)
    * fix(npm): execute native binaries from npm package bin entries (#34375)
    * fix: reject empty package name in package.json dependencies (#34514)
    * fix(test): abort with a message when a test exits with sanitizeExit disabled (#34491)
    * chore(fmt): regression test for svelte switch-case in class interpolation (#34461)
    * fix(bundle): skip decorator pass when module has no decorators (#34489)
    * fix(ext/napi): disallow JS execution during napi_new_instance (#34496)
    * fix(config): warn instead of erroring when start dir is not a workspace member (#34458)
    * fix(ext/node): drop bogus Buffer.prototype._isBuffer marker (#34502)
    * feat(ext/crypto): add ML-DSA (FIPS 204) post-quantum signatures (#34448)
    * fix(core): TLA hang on dyn import when async dep triggers lazy ESM load (#34469)
    * fix(config): surface invalid "exports" map in linked/workspace packages (#34473)
    * fix(install): vendor type-only imports during `deno ci` (#34459)
    * fix(jupyter): use stable PATH entry for kernel binary path (#34492)
    * perf(ext/node): optimize node:http header matching (#34484)
    * test: regression test for RequestInit clash with @types/node (#34486)
    * fix(ext/node): support cyclic imports in vm.Module.prototype.link() (#34472)
    * test(ext/webgpu): regression test for 2d-array color attachment compute pass corruption (#34485)
    * fix(jupyter): send transient: {} in execute_result so nbclient doesn't crash (#34483)
    * chore(test): verify prompt() round-trips Unicode characters (#34482)
    * refactor: remove simd-json from process IPC parsing (#34477)
    * ci: only clone needed submodules in node_compat_test workflow (#34333)
    * feat(ext/crypto): implement ML-KEM (FIPS 203) post-quantum KEM (#34447)
    * fix(doc): don't lint private-type-ref for cross-package types (#34339)
    * fix(ext/web): forward console.group label to inspector log (#34341)
    * fix(ext/node): route node:fs.statfs through FileSystem trait (#34444)
    * fix(watch): register dynamic raw imports with file watcher (#34463)
    * fix(ext/console): degrade gracefully when getKeys throws (#24980) (#34464)
    * fix(watch): restore original cwd between watcher restarts (#34465)
    * fix(runtime/ops): unwatch shared RecommendedWatcher on FsWatcher close (#34467)
    * build: disable incremental compilation for release/bench profiles (#34480)
    * perf: enable safe ICF (identical code folding) when linking (#34478)
    * test(node_compat): ignore flaky test-dns-any.js (#34474)
    * perf(ext/node): bulk-build header array and trim header OWS in place (#34443)
    * perf(web): reduce Brotli CompressionStream binary size (#34432)
    * refactor: replace lol_html in bundle HTML rewriting (#34408)
    * fix(ext/node): vm dynamic import without callback throws ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING (#34427)
    * fix(ext/node): re-export inner spec for module.exports = require(X).Y (#34363)
    * fix(lsp): surface CSS imports as .js to TypeScript (#34419)
    * ci: get npm_publish working under pnpm 11 (#34451)
    * ci: put $PNPM_HOME/bin on PATH for npm_publish global install steps (#34449)
    * ci: fix npm_publish pnpm install failing under strict-dep-builds (#34445)
    * perf(ext/node): skip node:http perf timing without observers (#34409)
    * perf(cli): drop unused deno_ast bundler feature (#34424)
    * feat(ext/crypto): add ChaCha20-Poly1305, SHAKE, cSHAKE, TurboSHAKE, SHA-3 HMAC (#34417)
    * chore: add deno_canvas readme (#34423)
  - Update to version 2.8.1:
    * 2.8.1 (#34420)
    * fix(ext/node): emit 'error' event for fs.watch open failures (#34398)
    * fix(ext/node): tolerate non-AsyncWrap handles in _getNewAsyncId (#34413)
    * chore(ext/node): regression test for empty buffer TLS write panic (#34412)
    * fix(pack): remove automatic @deno/shim-deno injection (#34411)
    * fix(ext/fetch,ext/websocket): check resolved IPs against net deny list (#34236)
    * fix(ext/node): require env permission for process.loadEnvFile (#34350)
    * fix(ext/node): prevent panic on `node:sqlite` aggregate method (#34385)
    * fix(task): walk ancestor node_modules/.bin in BYONM mode (#34364)
    * feat(bundle): support `browser` field map in package.json (#34407)
    * fix(runtime): lazy-loaded globals should shadow on inherited [[Set]] (#34405)
    * fix(bundle): read package.json sideEffects field (#34406)
    * refactor: replace cache_control with focused parsers (#34402)
    * perf(ext/node): reuse keep-alive timer in node:http server (#34302)
    * fix(core): allow host objects to round-trip through core.deserialize (#34380)
    * fix(ext/node): do not throw NotFound for fs.exists (#34244)
    * fix(ext/node): extract cert/key from pfx in tls SecureContext (#34383)
    * fix(ext/node): accept array forms of cert/key/pfx in createSecureContext (#34379)
    * fix(ext/node): enforce minimum Miller-Rabin rounds in checkPrime (#34391)
    * fix(cli): clearer error when importing .node addon via ESM (#34361)
    * fix: support npm: specifiers in --preload and --import (#34346)
    * fix(ext/node): support PKCS#12 MACs other than SHA-1 (#34342)
    * fix(inspector): emit NodeWorker.attachedToWorker for late workers (#34377)
    * fix(ext/node): reset req.reusedSocket on transparent retry (#34376)
    * fix(ext/node): TLSSocket.authorized=false when client presents no cert (#34381)
    * fix(http): wake runtime after direct serve dispatch (#34387)
    * fix(node/util): don't invoke Proxy traps in util.inspect (#34373)
    * fix(ext/node): add missing node:util APIs getSystemErrorMap, transferableAbortSignal, transferableAbortController (#34372)
    * fix: panic in deno test --parallel (#34378)
    * refactor(ext/web): build timers directly on core.createTimer (#34358)
    * fix(transpile): preserve newlines after multi-line block comments (#34357)
    * fix(core): keep lazy_loaded_esm sources across concurrent loads (#34353)
    * fix(upgrade): zstd-compress bsdiff delta patches (#34354)
    * fix(config): don't panic when --config path can't be converted to URL (#34351)
    * chore: bump openssl from 0.10.79 to 0.10.80 (#34251)
    * fix(types): restore brotli in CompressionFormat for dom/webworker libs (#34349)
    * fix(ext/node): allow omitting arguments in base64Slice (#34318)
    * fix(ext/node): drop extra positional args in promisified fs.promises.* (#34347)
    * Revert "fix(ext/node): polyfill module.enableCompileCache and companions" (#34190) (#34348)
    * test: disable flaky cluster deadlock test (#34325)
    * chore: regression for JSDoc @example with decorator syntax (#34340)
    * fix(ext/node): attach register as static on Module (#34305)
    * refactor: replace quick-junit test reporter dependency (#34315)
    * refactor: remove shell-escape from install shims (#34313)
    * fix: allow --inspect=localhost:0 to resolve hostnames (#34230)
  - Update to version 2.8.0:
    * 2.8.0 (#34295)
    * refactor: remove base32 dependency from npm cache encoding (#34293)
    * perf(ext/net): reduce Quinn TLS provider size (#34294)
    * perf(ext/node): optimize direct ServerResponse string end (#34253)
    * feat(install): default to npm for `deno install -g` unprefixed packages (#34290)
    * feat(cli): add --watch flag to deno check (#34224)
    * feat(types): add Math.sumPrecise and Intl.Locale.prototype.variants (#34287)
    * chore: unpin twox-hash and update it to 2.1.2 (#34277)
    * fix(ext/image): handle bitmaps in `createImageBitmap` correctly (#34285)
    * feat(cli): accept `deno audit fix` as alias for `deno audit --fix` (#34273)
    * perf: use panic=abort in release builds (#34280)
    * perf: consolidate HTTP Brotli compressor setup (#34282)
    * fix(core): disable include_icu_data feature (#34279)
    * chore: add back locked-tripwire (#34275)
    * feat(ext/node): make Network.* CDP events fire under plain --inspect (#34270)
    * fix(fmt): panic on tagged HTML template with multi-level indent (#34263)
    * fix(ext/node): node:test with watch-mode events (#34254)
    * chore: upgrade deno_task_shell to 0.32.0 (#34267)
    * feat: add `deno ci` subcommand (#34235)
    * fix(ext/node): Node-compatible TAP reporter for node:test (#34255)
    * fix(ext/node): flesh out node:trace_events polyfill (#34216)
    * chore: bump deno_task_shell to 0.31.0 (#34266)
    * fix(ext/node): implement node:wasi preview1 compat (#34245)
    * feat: disable ops and resources sanitizers by default in deno test (#33250)
    * feat: v8 14.9 (#34226)
    * fix(ext/node): satisfy agent-base node:https stack-trace check (#34264)
    * fix(ext/node): attach addAbortListener to EventEmitter, fix errorMonitor (#34262)
    * fix(ext/node): readFile of large file via fd returns scrambled content (#34258)
    * feat(ext/node): emit Network.* inspector events for node:http (#34231)
    * feat: stabilize text imports (#34238)
    * fix(ext/node): expand diagnostics_channel coverage (#34243)
    * fix(ext/node): improve worker_threads MessagePort compatibility (#34250)
    * chore: remove unused deps (#34249)
    * feat(ext/node): support KeyObject structured clone over MessagePort (#34229)
    * fix(ext/node): throw ERR_INVALID_ARG_VALUE for falsy dns.lookup hostname (#34234)
    * chore: update sys_traits to 0.1.28 and unpin (#34139)
    * feat(ext/websocket): emit Network.* inspector events for WebSocket (#34222)
    * fix(cli): make deno why work with jsr deps (#34227)
    * refactor: use `ToV8` on enums instead of serde (#31991)
    * feat(ext/fetch): emit Network.* inspector events for fetch() (#34220)
    * fix(ext/node): run load hook chain on every require() of a builtin (#34223)
    * fix(lsp): don't panic on unresolved dts import hover (#34112)
    * fix(ext/node): module hook fixes for ESM nextLoad, createRequire URL, and builtin redirects (#34219)
    * perf: lazy-load more modules in the snapshot (#34061)
    * feat(ext/node): restore module.registerHooks (#34081)
    * fix(ext/node): support TLS client resume compat tests (#34095)
    * feat(ext/node): buffer Network.* bodies for inspector body-fetch commands (#34201)
    * feat(ext/node): expose inspector.isEnabled() via process.binding('inspector') (#34203)
    * feat(ext/node): implement NodeRuntime.notifyWhenWaitingForDisconnect (#34204)
    * fix(ext/node): DSA keygen with arbitrary modulusLength (#34206)
    * chore: enable test-https-connecting-to-http (#34207)
    * chore: enable test-crypto-keygn-async-rsa node compat test (#34208)
    * fix(ext/node): export UV_EOF and fix Socket._final without connect (#34211)
    * chore: ignore async-loader node compat tests (#34210)
    * test: enable test-inspector-break-e.js (#34205)
    * chore: skip tests requiring internal JSStream binding (#34199)
    * chore: ignore tests failing on aarch64 release builds (#34196)
    * fix(ext/node): avoid panic in vm.createContext loop at isolate teardown (#34195)
    * fix(ext/node): add process._debugEnd() / process._debugProcess() (#34194)
    * chore: remove test-import-require-tla-twice failing on aarch64 (#34193)
    * fix: report eval scripts as `[eval]` URL for inspector (#34192)
    * chore: enable 397 passing-but-unenabled tests (#34184)
    * fix(ext/node): polyfill module.enableCompileCache and companions (#34190)
    * chore: regression test for process._getActiveHandles() in 'exit' handler (#34191)
    * chore: ignore es-module/test-cjs-legacyMainResolve tests (#34186)
    * fix(ext/node): add v8.startupSnapshot API polyfill (#34189)
    * fix(ext/node): per-request executionAsyncResource() for async_hooks (#34188)
    * fix(ext/node): tls server error message, rejection capture, two compat tests (#34183)
    * fix(ext/node): improve http server parser compat (#34094)
    * fix(doc): resolve npm entrypoints without types (#34147)
    * fix(ext/node): preserve raw socket connect when wrapping TLS (#34093)
    * fix(ext/node): complete TLS peer cert chains (#34098)
    * fix(ext/crypto): normalize P-521 SPKI exports (#34087)
    * fix(node): weakly track util.aborted resources (#34142)
    * fix(task): escape backticks in forwarded args (#34151)
    * fix(ext/node): isolate TLS client reject session resumption (#34097)
    * fix(ext/node): support shouldUpgradeCallback in http server (#34092)
    * fix(ext/node): add v8.GCProfiler (#34158)
    * fix(ext/node): implement TCP/TLS socket useUserBuffer (#34164)
    * chore: mark parallel/test-shadow-realm-* as ignored (#34155)
    * fix(ext/node): expose internal/net as requireable module (#34152)
    * fix(ext/node): add v8.queryObjects() and util.queryObjects() (#34159)
    * fix(ext/node): implement Module._stat (#34157)
    * fix(ext/node): refresh async id for reused agent sockets (#34138)
    * fix(ext/node): expose internal webstreams modules (#34107)
    * fix(ext/node): expose internal/async_hooks as requireable module (#34116)
    * fix(ext/node): expose internal/tty as requireable module (#34105)
    * fix(ext/node): add test.expectFailure to node:test (#34130)
    * fix(ext/node): normalize underscored V8 flags (#34129)
    * fix(ext/node): add linkRequests/moduleRequests/instantiate to node:vm (#34131)
    * fix(ext/node): expose internal/options as requireable module (#34117)
    * fix(ext/node): expose internal/fs/promises with FileHandle (#34118)
    * fix(ext/node): add active process resources APIs (#34101)
    * fix(ext/url): align URLSearchParams with Node for node:url compat (#34119)
    * feat(ext/node): implement Network CDP domain for inspector (#32707)
    * fix(ext/node): improve node:tls test compatibility (#34067)
    * fix(ext/node): improve https agent compat (#34091)
    * fix(ext/node): report directory imports with node error code (#34076)
    * fix(ext/node): align nextTick ordering in ESM (#34085)
    * feat(ext/node): add createHistogram to node:perf_hooks (#34003)
    * fix(ext/node): emit destroy for cleared immediates (#34084)
    * fix(ext/node): emit deprecation warnings for legacy stream/_tls_wrap requires and module.parent (#34086)
    * feat(ext/node): implement node:wasi (#34089)
    * fix(ext/node): expose internal/js_stream_socket and add default read path (#34088)
    * perf(ext/web): optimize TextEncoder encodeInto result (#34055)
    * fix(ext/node): reject structuredClone for file-backed Blobs (#34075)
    * fix(ext/crypto): add SHA3 support to crypto.subtle.digest (#32342)
    * fix(ext/node): expose `E` and `SystemError` from `internal/errors` (#34080)
    * Revert module loader hooks stack (#34077)
    * fix: bump deno_graph to 0.108.2 for wasm multi-value return types (#34070)
    * fix(task): support recursive task completions in workspaces (#32422)
    * fix(ext/crypto): validate raw key length on X25519/X448/Ed25519 importKey (#33944)
    * fix: fix CJS re-export analysis for npm packages (#33263)
    * fix(test): include --watch=<paths> in watched paths (fixes #21704) (#32621)
    * refactor(core): pre-resolve child imports before V8 module registration (#34050)
    * fix(ext/process): respect AbortSignal in Deno.Command.output() (#34069)
    * fix(ext/node): align node stream `destroy` named export (#33573)
    * feat(cli): support workspaces in `deno bump-version` (#33689)
    * refactor(tsc): drop redundant timer globals from Deno libs (#34028)
    * fix(core): short-circuit async-resolve when it returns an already-registered module (#34058)
    * fix(ext/fetch): close response_rid when abort races op_fetch_send completion (#33928)
    * fix(ext/node): surface ERR_REQUIRE_ASYNC_MODULE/CYCLE_MODULE codes and fix TLA retry (#34060)
    * fix(ext/node): use primordials in internal_binding/symbols.ts (#33865)
    * feat(ext/node): convert node:url/util/zlib to synthetic_esm (#34041)
    * fix(ext/websocket): don't panic on H2 stream reset in poll_write (#33982)
    * feat(core): synthetic_esm extension DSL + node:worker_threads canary (#34038)
    * fix(ext/node): fire uncaughtExceptionMonitor with correct origin for sync top-level throws (#34048)
    * fix(ext/node): implement displayErrors for vm scripts (#33942)
    * fix(ext/node): don't emit ServerResponse 'finish' after client abort (#34026)
    * fix(ext/node): implement vm.SyntheticModule constructor (#34014)
    * fix(ext/node): add util.setTraceSigInt stub (#34013)
    * feat(ext/node): implement postMessageToThread cross-thread messaging (#34015)
    * fix(ext/node): Worker rejects --heap-prof and --cpu-prof execArgv flags with wrong error (#34011)
    * ci: fix ARM Linux XL runner label (#34039)
    * fix(ext/url): URLSearchParams Node-compat error messages on invalid this and missing args (#34017)
    * refactor(ext/node): merge 02_init.js into 01_require.js (#34035)
    * ci: use larger ARM Linux runner for release LTO build on main/tags (#34034)
    * fix(ext/node): implement SocketAddress class (#34020)
    * fix(ext/node): tagged template literal support for SQL (#34018)
    * fix(ext/node): detect non-mtime stat changes in StatWatcher (#33950)
    * ci: use larger Linux runner for LTO release build on main/tags (#34029)
    * fix(ext/node): close named-pipe handles after child_process.spawn on Windows (#33941)
    * perf(ext/fetch): skip dict-converter walk on default init in Request/fetch/Response.json (#33999)
    * fix(node/sqlite): implement DatabaseSync.serialize() and deserialize() (#34010)
    * fix(ext/node): apply encoding to Dirent name/parentPath in fs.readdir (#33972)
    * fix(ext/node): prevent top-level `await test(...)` deadlock in node:test (#33947)
    * fix(node/fs): readSync with position argument returns EINVAL (#34021)
    * fix(ext/node): skip user module.register() load hooks for node:/ext: builtins (#34006)
    * fix(ext/napi): run weak-callback finalizers synchronously in second-pass (#34023)
    * ci: pin rustup-init to 1.28.2 to work around broken 1.29.0 (#34024)
    * perf(snapshot): dedupe JS sources between binary and v8 snapshot (#33992)
    * fix(ext/node): MessagePort.on('message') should deduplicate listeners (#33991)
    * ci: bump cacheVersion to 113 (#34022)
    * fix(ext/node): expose internal/url so require('internal/url') works (#34012)
    * perf(ext/webidl): hoist EMPTY_OPTS for converter opts default (#34007)
    * fix(ext/node): retry named-pipe connect on ERROR_PIPE_BUSY (Windows) (#33974)
    * feat(npmrc): support min-release-age (#33983)
    * perf(ext/node): convert net, _tls_common, _tls_wrap to lazy-loaded JS (#33997)
    * fix(ext/node): apply Deno's resolver inside loader-hook defaultResolve (#33964)
    * ci: update to use pull_request (#33981)
    * fix(ext/node): throw OpenSSL-shaped error from tls.createSecureContext when clientCertEngine is set (#33691)
    * fix(ext/node): omit glibc version fields on musl/non-Linux (#33987)
    * perf(ext/node): convert _stream_* polyfills to lazy-loaded JS (#33988)
    * fix(core): evaluate pre-instantiated module in lazy_load_esm_module (#33973)
    * fix(install): regenerate lockfile with --force on global install (#33970)
    * perf(ext/node): convert child_process, fs, http, http2, https, inspector to lazy-loaded JS (#33967)
    * refactor(ext): drop generics from deno_kv and deno_cron extensions (#33966)
    * fix(install): don't treat JS scripts with non-Node shebang as native binaries (#33971)
    * fix(workspace): clamp CLI include paths to member folder (#33949)
    * perf(ext/web): linear-time set/delete on FormData, URLSearchParams, Headers (#33961)
    * fix: handle native binary bin entries in global npm install (#33935)
    * perf(ext/node): convert timers, tls, tty, url, v8, worker_threads, zlib to lazy-loaded JS (#33960)
    * fix(resolver): handle tag version req in byonm resolver (#33962)
    * perf(ext/node): convert cluster, console, constants, crypto, dgram, dns to lazy-loaded JS (#33951)
    * perf(ext/node): convert fs internals, timers, tty, url, webstreams to lazy-loaded ESM (#33939)
    * test: ignore test-domain-no-error-handler-abort-on-uncaught tests (#33937)
    * perf(ext/node): convert fs helpers, streams, dgram, dns/utils to lazy-loaded ESM (#33936)
    * feat(ext/node): implement node:module SourceMap API (#32890)
    * feat(task): prefix output lines with task name when running in parallel (#33805)
    * fix(core): prevent TLA hang when has_tick_scheduled is set during async module evaluation (#33278)
    * chore: add Claude Code skills for PR review, issue triage, node compat, and code quality (#33933)
    * perf(ext/node): convert http2, readline, stream_base_commons to lazy-loaded JS (#33932)
    * fix(ext/node): enable test-crypto.js node compat test (#33822)
    * fix(ext/node): node:repl improvements (#33930)
    * fix(ext/node): node:test improvements (#33929)
    * perf(ext/node): convert child_process, cluster, console to lazy-loaded JS (#33925)
    * fix(ext/node): add ERR_REQUIRE_ASYNC_MODULE and ERR_REQUIRE_CYCLE_MODULE error codes (#33921)
    * perf(ext/node): convert internal/crypto to lazy-loaded JS (#33919)
    * fix(ext/node): prevent panic when importing node builtins after module.register() (#33920)
    * perf(ext/node): convert node:path to lazy-loaded JS (#33917)
    * fix(ext/node): run register() hooks in worker thread, add --experimental-loader flag (#33906)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33913)
    * fix(ext/tls): upgrade rustls to fix SSL cert validation regression (#33912)
    * fix(ext/node): drive TLSWrap cycle on JSStream writes to fix deadlock (#33914)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33909)
    * fix(ext/node): emit diagnostics_channel events for HTTP server (#33908)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33902)
    * fix(ext/node): implement ALPNCallback and SNICallback for TLS server (#33360)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33900)
    * fix(node): fix registerHooks for custom file type loaders (#33899)
    * feat(test): add timeout option to Deno.test() (#33815)
    * fix(ext/node): add post-resolution deny check in TCPWrap connect (#33880)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33897)
    * fix: disable V8 external memory check to prevent panic on large TypedArrays (#33896)
    * test: use local server for ip_address_unsafe_ssl test (#33898)
    * fix(ext/node): improve module hooks support (#33877)
    * feat(ext/web): support structured clone for Blob and File (#33827)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33882)
    * chore: upgrade Rust toolchain to 1.95.0 (#33294)
    * fix(ext/node): restore llhttp parser.data after execute to handle re-entrant calls (#33832)
    * fix(ext/node): emit http PerformanceObserver entries for HttpClient and HttpRequest (#33826)
    * perf(http): don't add Vary header if response is not compressed (#33892)
    * fix(ext/node): register sigwinch listeners for stdout/stderr (#33890)
    * chore: disable dns timeout test on windows (#33888)
    * perf(http): split clear-text HTTP autodetect connection task (#33887)
    * chore: update aws-lc-rs/aws-lc-sys to eliminate duplicate version (#33885)
    * fix(ci): disable test-child-process-send-returns-boolean.js on windows (#33883)
    * fix(ext/node): support abstract Unix sockets in node:net pipe bind (#33872)
    * fix(ext/node): fix child_process.send() backpressure return value (#33869)
    * perf(ext/node): convert node:events and stream internals to lazy-loaded JS (#33881)
    * perf(ext/node): convert node:util, node:assert to lazy-loaded (#33876)
    * feat(ext/node): support NODE_EXTRA_CA_CERTS (#33148)
    * feat(core): support lazy_loaded_esm modules via import statements (#33873)
    * feat(compile): add progress bar for deno compile (#33874)
    * perf(ext/node): convert more polyfills to lazy-loaded JS (#33871)
    * perf(ext/node): replace node: imports with core.loadExtScript for buffer and nextTick (#33862)
    * chore(deps): bump openssl from 0.10.78 to 0.10.79 (#33868)
    * chore: fix build (#33870)
    * feat(compile): support module.register() and module.registerHooks() in compiled binaries (#33853)
    * feat: add --package-json flag to deno add/install/remove/uninstall (#33199)
    * feat: add `deno pack` command to create npm tarballs (#32139)
    * fix(init): replace add(2,3) template with Deno.serve HTTP server (#33042)
    * feat(ext/node): support sending dgram.Socket handles over IPC (#33863)
    * perf(runtime): convert 8 runtime JS files to lazy-loaded scripts (#33864)
    * fix(ext/node): skip ESM load hook bridge for CJS modules (#33861)
    * perf(libs/core): drop libuv-style partial-read break to fix node:http p99 (#33860)
    * fix(ext/node): handle connectionsCheckingInterval option and send 408 for request timeout (#33836)
    * feat(ext/node): implement module.register() API (#33849)
    * fix(watch): apply `--watch-exclude` filter to file change events (#33854)
    * fix(ext/node): support node:fs APIs on VFS files in deno compile (#33803)
    * fix(ext/process): tolerate unlinked cwd in spawn (#33587)
    * fix(npm): resolve catalog: overrides from workspaces object form (#33816)
    * perf(core): SIMD ASCII fast path for op_decode (#33720)
    * feat(npm): add hoisted node_modules linker mode (#32788)
    * feat(ext/node): ESM import() support for module.registerHooks() (#33763)
    * feat: update TypeScript to 6.0.3 (#32944)
    * perf(http): directly dispatch into js request handler (#33845)
    * perf(ext/node): convert 62 more polyfill files to lazy-loaded scripts (#33835)
    * chore: bump dprint-plugin-typescript to 0.96.0, remove deno-fmt-ignore-file (#33839)
    * fix(update): `deno update --lockfile-only` should not update config (#33746)
    * perf(http): avoid ReadableStream when full body already buffered (#33844)
    * fix(ext/node): implement node:cluster on unix (#33752)
    * Revert "fix(ext/node): support AES-128-ECB cipher for PKCS#8 private key encryption and decryption" (#33837)
    * fix(ext/node): pass URL to kOnHeadersComplete when request has no headers (#33831)
    * feat: include node lib by default and use NodeJS.Timeout for timers (#33823)
    * fix: include node lib by default and use NodeJS.Timeout for timers (#33823)
    * fix(ext/node): accept CryptoKey input in createPublicKey/createPrivat… (#33750)
    * perf(ext/node): convert errors.ts, util.mjs, and foundation layer to lazy-loaded scripts (#33830)
    * ci: disable flaky Node compat test (#33833)
    * fix(ext/node): support AES-128-ECB cipher for PKCS#8 private key encryption and decryption (#33809)
    * fix(ext/node): implement noDelay property on net.Server and apply TCP_NODELAY to accepted  (#33828)
    * fix(ext/node): enable test-crypto-sign-verify node compat test (#33810)
    * fix(ext/node): fix module resolution for nested package.json files (#33767)
    * perf(ext/node): convert validators.mjs and dependencies to lazy-loaded scripts (#33821)
    * fix(ext/node): propagate highWaterMark option from http.createServer to req and res (#33825)
    * fix(ext/node): emit DEP0192 deprecation warning when _tls_common is required (#33819)
    * fix(ext/node): enable quic node compat tests by correcting .mjs file extensions in config (#33824)
    * fix(ext/node): expose http2 test bindings and route pushStream through pushPromise (#33741)
    * fix(ext/node): throw ERR_INVALID_ARG_VALUE for odd-length headers array in http.ServerResp (#33820)
    * fix(ext/node): implement AES Key Wrap and Key Wrap with Padding ciphers (#33813)
    * fix(ext/node): enable test-crypto-rsa-dsa node compat test with DSA encrypted keys (#33811)
    * perf(ext): convert ext/kv and ext/webgpu JS sources to lazy-loaded scripts (#33818)
    * perf(ext): convert ext/process and ext/http JS sources to lazy-loaded scripts (#33817)
    * feat(ext/node): implement vm.SourceTextModule with microtaskMode afterEvaluate support (#33603)
    * fix(ext/node): enable test-crypto-keygen-async-explicit-elliptic-curve (#33812)
    * fix(ext/node): align crypto KeyObject PKCS#8 encryption, JWK input and PSS salt with Node (#33757)
    * fix(ext/node): allow explicit paramEncoding for EC key generation (#33807)
    * fix(ext/node): share TLS session cache and ticketer for tls.TLSSocket session resumption (#33693)
    * fix(ext/node): throw correct error for encrypted PEM key in privateDecrypt (#33808)
    * perf(ext): convert ext/telemetry and ext/cron JS sources to lazy-loaded scripts (#33801)
    * fix(publish): don't panic on provenance generation in non-GitHub CI (#33802)
    * fix(ext/node): emit Protocol error when http2 client connects to non-h2 server (#33740)
    * fix(ext/node): accept ArrayBufferView in tls.setDefaultCACertificates (#33700)
    * feat: support Deno.upgradeWebSocket with node:http upgrade events (#33342)
    * perf(ext/fs): convert ext/fs JS source to lazy-loaded script (#33800)
    * perf(ext): convert ext/cache, ext/canvas, ext/crypto JS sources to lazy-loaded scripts (#33778)
    * fix(ext/node): emit perf_hooks PerformanceEntry for http2 sessions and streams (#33618)
    * fix(npm): support `catalog:` protocol in overrides (#33799)
    * perf: monch 0.6 (#33643)
    * fix(ext/node): decrypt legacy Proc-Type/DEK-Info encrypted PEM private keys (#33769)
    * perf(ext): convert ext/fetch JS sources to lazy-loaded scripts (#33784)
    * fix(ext/node): wire up http2 per-session maxOutstandingPings flag (#33791)
    * fix(ext/node): TLSSocket.setServername throws typed errors (#33744)
    * fix(ext/node): fix TLS peer certificate multi-value fields, issuer chain, and EC curve names (#33782)
    * fix(ext/node): use core.loadExtScript for deno_web/deno_io polyfill deps (#33798)
    * perf(ext): convert ext/ffi JS source to lazy-loaded script (#33780)
    * fix(ext/node): support undici dispatcher for allowHTTP1 websocket upgrades (#33731)
    * fix(ext/node): handle HTTP/2 flow control (#33795)
    * fix(ext/node): support CA certificate introspection and off-thread loading tests (#33708)
    * fix(ext/node): implement h2 END_STREAM packing and Http2Session PerformanceObserver entries (#33796)
    * chore(ext/node): enable parallel/test-http2-client-unescaped-path node compat test (#33789)
    * fix(ext/node): import/export PKCS#8 and legacy encrypted PEM private keys (#33762)
    * fix(ext/node): wire HTTP/2 PING ack callbacks and emit payload buffer (#33794)
    * fix(ext/node): unblock fs.open on FIFOs and read pipes correctly in http2 respondWithFile (#33792)
    * fix(ext/node): implement ECDH validation and DH verifyError (#33751)
    * fix(ext/node): enable test-http2-server-shutdown-redundant (#33793)
    * fix(ext/node): wire http2 maxSettings option to nghttp2_option_set_max_settings (#33790)
    * perf(ext): convert ext/io, ext/os, ext/net JS sources to lazy-loaded scripts (#33779)
    * fix(ext/node): wrap process.chdir errors with path/dest/syscall (#33584)
    * fix(ext/node): support `encoding` option in `fs.watch` (#33634)
    * perf(ext/fetch): fast-path string in BodyInit_DOMString converter (#33676)
    * perf(ext/web): add hyper-fast path for TextDecoder.decode (#33674)
    * fix(ext/node): emit drained server close on next tick for Node parity (#33672)
    * feat(npm): add `catalog:` protocol for centralized dependency versions in workspaces (#32947)
    * feat(add/install): default to npm registry for unprefixed packages (#33246)
    * perf(ext/geometry): avoid heap allocation for the argument that requires a fixed length of sequence (#33688)
    * perf(ext/web): convert all ext/web JS sources to lazy-loaded scripts (#33760)
    * feat(core): add async module resolution support via ModuleResolveResponse (#32432)
    * fix(ext/node): align scrypt behavior and performance with Node (#33773)
    * test: enable parallel/test-http2-respond-errors.js (#33738)
    * fix(ext/node): set OSSL error codes and key-type checks in stateless diffieHellman (#33772)
    * fix(ext/node): throw ERR_CRYPTO_HASH_FINALIZED on subsequent Hash.digest() calls (#33774)
    * ci: run Node compat tests everyday (#33771)
    * fix(ext/node): implement missing node:test APIs (#33764)
    * fix(ext/node): support PKCS#8 encrypted private key PEM export via PBES2 (#33758)
    * fix(ext/node): decrypt encrypted private keys in publicEncrypt/privateDecrypt and ignore passphrase (#33770)
    * fix(ext/node): support encrypted PKCS#8 DER private key export and import (#33756)
    * fix(console): don't trigger proxy get trap for nodejs.util.inspect.custom (#33730)
    * fix(ext/node): pad DH shared secret and fix prime sign byte for stateless diffieHellman (#33761)
    * feat: OffscreenCanvas (#29357)
    * fix(ext/node): use proper error codes for tls.TLSSocket.setServername() (#33745)
    * feat(ext/telemetry): add gRPC protocol support for OTLP exporter (#30365)
    * feat(ext/node): implement module.registerHooks() API for CommonJS (#33733)
    * fix(ext/node): implement mock.getter, mock.setter, mockImplementation in node:test (#33755)
    * fix(ext/node): handle unhandled rejections in node:test without crashing runner (#33749)
    * fix(ext/node): support sending net.Socket and net.Server handles to child processes on unix (#33605)
    * feat(core): add `Deno.core.loadExtScript()` for lazy-loaded scripts (#33739)
    * fix(ext/node): fix TLS crash with Happy Eyeballs address fallback (#33641)
    * fix(ext/node): expose Http2Session and nghttp2ErrorString on http2 internalBinding (#33732)
    * fix(node/tls): handle detached ArrayBuffer in TLSWrap write methods (#33737)
    * fix(ext/node): validate fs.watch options.ignore (#33574)
    * perf(ext/node): true writev on tcp sockets for node:http (#33659)
    * fix(ext/node): route ServerHttp2Stream.respond through binding proto (#33736)
    * fix(ext/node): expose Http2Session and nghttp2ErrorString on http2 internalBinding (#33742)
    * feat: framework detection for deno compile (#33164)
    * fix(repl): drain microtasks after inspector polling to avoid 'Promise was collected' (#33735)
    * feat(x): add --package/-p flag for specifying package separately from binary (#32855)
    * feat: add `deno transpile` subcommand (#32691)
    * fix(ext/web): respect cancelable and passive flags in Event.returnValue setter (#33651)
    * fix(ext/web): convert MessageEvent ports via WebIDL sequence iteration (#33652)
    * fix(ext/node): validate data type in Cipheriv/Decipheriv update() (#33649)
    * fix(ext/node): add emitExperimentalWarning/pendingDeprecate to internal/util, support modifyPrototype option in util.deprecate (#33660)
    * fix(ext/node): expose internal/util/debuglog and add formatTime helper (#33665)
    * fix(ext/node): make hideStackFrames actually hide frames, expose internal/validators (#33673)
    * chore: ignore test-https-client-get-url (#33699)
    * perf(ext/web): lazy-init EventTarget listeners table (#33734)
    * fix(ext/node): expose Http2Stream and nghttp2ErrorString on http2 internalBinding (#33729)
    * perf(ext/webidl): fast path for createDictionaryConverter undefined input (#33692)
    * chore: disable http2 info headers errors case
    * perf(ext/web): structuredClone primitive fast path (#33728)
    * feat(cli): add `deno why` subcommand (#32908)
    * fix(ext/node): add tls.getCaCertificates() (#32032)
    * chore: skip test-http2-util-update-options-buffer (internal state buffers) (#33717)
    * fix(ext/node): defer http2 stream window replenishment while paused (#33640)
    * fix(ext/node): use queueMicrotask in fs.close to avoid sanitizer false-positive (#33714)
    * feat: implement `deno audit --fix` (#32909)
    * fix(ext/node): allow tls.Server SecureContext without cert/key for SNICallback (#33715)
    * fix(ext/node): bind setImmediate callback this to the Immediate instance (#33716)
    * fix(ext/node): map rustls record-decode errors to OpenSSL-style "wrong version number" (#33711)
    * fix(ext/node): expose TLS server name (SNI) on server-side TLSSocket via getServername op (#33725)
    * fix(node:http2): preserve timeout inspect links on proxied session sockets (#33721)
    * fix(ext/node): expose http2 internalBinding and add missing HTTP2_HEADER_* constants (#33726)
    * test: enable parallel/test-dns-lookup-promises-options-deprecated.js (#33710)
    * test: enable 3 already-passing Node compat tests (#33687)
    * perf(core): cap V8 platform thread pool to 4 threads (#33697)
    * perf(ext/websocket): lazy-load WebSocket and WebSocketStream JS (#33701)
    * test: enable 2 already-passing Node compat tests (#33706)
    * feat(install): add --os and --arch flags for cross-platform npm installs (#32785)
    * fix(ext/node): port internal/priority_queue and expose it via require (#33696)
    * fix(ext/node): dns resolveAny with real ANY query, retry/maxTimeout support (#33577)
    * fix(ext/node): enforce OpenSSL SECLEVEL key-strength check in createSecureContext (#33686)
    * fix(ext/node): cancel pending TLS writes when the socket closes (#33690)
    * feat(install): added --prod to skip dev deps and @types (#33248)
    * test: ignore parallel/test-fixed-queue.js (#33682)
    * perf(ext/web): fast path for TextEncoder.encodeInto (#33675)
    * fix(ext/node): preserve AsyncLocalStorage context across HTTP/2 client streams (#33677)
    * fix(ext/node): support `signal` option in `fs.watch`/`fs.promises.watch` (#33650)
    * test: enable 7 already-passing Node compat tests (#33669)
    * feat(cli): add `deno bump-version` subcommand (#30562)
    * fix(ext/node): align inspector WebSocket URL with Node.js format (ws://host:port/UUID) (#33592)
    * feat: use Node.js timers by default and remove global proxy (#33249)
    * feat: disable "no-process-global", "no-node-globals" lint rules by default (#33247)
    * fix(ext/node): emit ERR_HTTP2_MAX_PENDING_SETTINGS_ACK via session error instead of throwing (#33679)
    * fix(ext/node): apply http1Options to HTTP/2 secure server fallback (#33678)
    * feat(unstable): support TC39 import defer proposal (#32360)
    * fix(ext/node): add `limits` property on `node:sqlite` DatabaseSync (#33106)
    * fix(ext/node): expose http2 session setNextStreamID with capital-ID method name (#33666)
    * fix(ext/fs): run open_async on the blocking pool so FIFO opens don't stall the runtime (#33667)
    * fix(ext/node): add http2.performServerHandshake to polyfill (#33668)
    * fix(ext/node): emit DEP0111/DEP0119 from process.binding under --pending-deprecation (#33594)
    * fix(ext/node): bind to IPv6 wildcard for default Server.listen() to enable dual-stack (#33617)
    * fix(ext/node): forward http2 protocol errors from invalid frame callback to session error event (#33630)
    * fix(ext/node): send http2 GOAWAY before stream RSTs so peer sees session destroy code (#33637)
    * fix(ext/node): emit ERR_HTTP2_TOO_MANY_INVALID_FRAMES for empty DATA frames without END_STREAM (#33644)
    * fix(ext/node): use ASCII byte-truncation in http2 writeAsciiString polyfill (#33645)
    * feat(unstable): Geometry Interfaces Module Level 1 (#27527)
  - Update to version 2.7.14:
    * 2.7.14 (#33639)
    * feat(upgrade): delta updates via bsdiff patches (#33274)
    * fix(ext/node): treat unsolicited HTTP/2 PING ACK as connection-level protocol error (#33625)
    * chore: ignore parallel/test-http2-debug.js (#33628)
    * fix(ext/node): implement dns Resolver cancel() and timeout support (#33580)
    * fix(ext/web): retain `source` from MessageEventInit (#33500)
    * test: enable 9 already-passing Node compat tests (#33582)
    * fix(ext/node): submit http2 RST_STREAM before flushing END_STREAM DATA frame on respondWithFD read (#33633)
    * fix(ext/node): emit http2 frameError on send failure with translated HTTP/2 error code (#33631)
    * fix(ext/node): make http2 session.origin() round-trip origins and respect TLS servername (#33629)
    * fix(ext/node): use proper error codes for require() invalid arguments (#33609)
    * fix(ext/node): validate ciphers option in tls.createSecureContext() (#33597)
    * fix(ext/node): fix TLS client certificate authentication verification (#33576)
    * fix(ext/node): align node:test `it`/`describe` with Node, enable passing compat tests (#33593)
    * fix(ext/node): validate `fs.watch` boolean options (#33627)
    * fix(ext/node): brand-check SecureContext._external accessor (#33569)
    * fix(ext/node): support `ignore` option in `fs.watch` and `fs.promises.watch` (#33610)
    * fix(ext/node): allow `https.Agent()` without `new`, enable passing compat tests (#33601)
    * fix(ext/node): correct buffer-length check in `Readable._fromList` decoder branch (#33624)
    * fix(config): don't exclude workspace members from deploy file patterns (#33562)
    * fix(ext/net): default Deno.listenDatagram hostname to 0.0.0.0 (#33496)
    * fix(ext/node): close fd on error in http2 stream respondWithFile (#33614)
    * fix(ext/node): expose http2 sensitive headers received with NV_FLAG_NO_INDEX flag (#33626)
    * fix(ext/node): defer drain in http2 shutdownWritable so pushStream after end() works (#33619)
    * fix(ext/node): forward enableConnectProtocol setting to peer in HTTP/2 SETTINGS frame (#33616)
    * fix(ext/node): honor weight option in http2 client.request and emit DEP0194 (#33622)
    * chore: enable parallel/test-http2-generic-streams-sendfile (#33620)
    * chore: enable parallel/test-http2-write-finishes-after-stream-destroy (#33621)
    * chore: enable parallel/test-http2-server-close-idle-connection.js (#33615)
    * chore: enable parallel/test-http2-client-proxy-over-http2 (#33613)
    * fix(ext/node): plumb llhttp error code, reason, and bytes parsed through HTTPParser (#33591)
    * fix(ext/node): add _idleStart and _idleTimeout to Timeout (#33604)
    * fix(ext/node): rename _destroySsl to _destroySSL to match Node.js API (#33599)
    * chore: disable flaky node compat test (test-child-process-stdio-reuse-readable-stdio.js) (#33602)
    * Revert "fix(ext/node): make IPC writes synchronous to match Node.js behavior (#33522)" (#33598)
    * ci: shard node_compat tests into 3 parallel jobs (#33600)
    * fix(ext/node): fix closeIdleConnections destroying active connections (#33596)
    * test: ignore test-trace-events-bootstrap.js (#33590)
    * fix(ext/node): improve perf_hooks timerify and add missing exports (#33581)
    * fix(ext/node): throw ERR_INVALID_ARG_VALUE when rmdir gets options.recursive (#33565)
    * fix(ext/node): use ERR_INVALID_ARG_TYPE for tls.createServer non-object options (#33589)
    * fix(ext/node): fix TLS socket error ordering and app data leak before identity verification (#33585)
    * fix(ext/node): implement dns.reverse() and fix dns.lookup() family parameter (#33579)
    * fix(ext/node): implement node:cluster fork/Worker and worker-side detection (#33493)
    * fix(ext/node): handle undefined http2 ping payload and cancel pending pings on destroy (#33561)
    * fix(ext/node): cancelling Readable.toWeb(req) no longer destroys the socket (#33570)
    * fix(ext/node): strip trailing dot from SRV target in dns.resolveSrv() (#33578)
    * fix(ext/node): track http2 custom settings and SETTINGS ACK callbacks (#33518)
    * fix(ext/node): http2 createConnection support and per-frame socket writes (#33520)
    * fix(task): use explicit workspace root check in directory-name fallback (#33540)
    * fix(ext/webidl): set ERR_ILLEGAL_CONSTRUCTOR code on illegal constructor calls (#33535)
    * test: enable 7 already-passing Node compat tests (#33568)
    * fix(ext/node): make IPC writes synchronous to match Node.js behavior (#33522)
    * chore: enable parallel/test-worker-http2-generic-streams-terminate (#33563)
    * fix(ext/node): flush GOAWAY before destroying http2 socket and expose internal/http2/core (#33566)
    * fix(ext/node): validate options.type in Readable.toWeb (#33560)
    * chore(tests): enable 158 passing node compat tests (part 2/3) (#33411)
    * fix(ext/node): fix spawnSync internal API for monkey-patching and killSignal (#33545)
    * fix(ext/node): yield to I/O in http2 write path so stream pipeline finishes (#33541)
    * fix(ext/node): align util.styleText with Node (#33547)
    * fix(ext/node): null-proto child_process options to block prototype pollution (#33555)
    * fix(ext/node): use AbortSignal.addEventListener in addAbortListener (#33557)
    * fix(ext/node): wire up captureRejection handler for http2 servers (#33542)
    * fix(ext/node): align node:module behavior with Node (#33482)
    * fix(ext/node): wire JSStreamSocket handle write/shutdown for http2 (#33526)
    * fix(ext/node): encode http2 headers as Latin-1 to fix response splitting (#33531)
    * fix(ext/node): pass stream fd to child process stdio instead of inheriting (#33525)
    * fix(ext/node): fix TLS socket lifecycle and readStop backpressure (#33524)
    * fix(ext/node): implement fs.mkdtempDisposableSync / fsPromises.mkdtempDisposable (#33533)
    * fix(ext/node): prevent duplicate close emit when http2 client socket i (#33538)
    * test: ignore test-child-process-spawnsync-shell compat test (#33532)
    * fix(ext/node): pass reusePort flags in Server.listen() without host (#33530)
    * feat(ext/node): add fs.Utf8Stream
    * fix(ext/node): enforce HTTP/2 server header list size limits (#33494)
    * fix(ext/node): enforce http2 maxSessionInvalidFrames limit (#33515)
    * fix(ext/node): support v1 X.509 certs and http2 ALPN fallback (#33510)
    * fix(ext/node): support ALPNCallback in http2.createSecureServer (#33521)
    * fix(ext/node): timer _destroyed flag, Symbol.dispose, and setInterval abort (#33528)
    * perf: optimize worker and MessagePort message passing (#32657)
    * test(node_compat): enroll parallel/test-crypto-hash-stream-pipe.js (#33519)
    * fix(task): match workspace directory name in --filter (#33499)
    * fix(ext/node): isolate parentPort from globalThis in worker_threads (#32596)
    * fix(coverage): exclude transformer-injected helpers from coverage (#33481)
    * fix: match single-char wildcard segments in npm package imports (#33513)
    * fix(ext/node): use node:timers for http server connection checks, expo (#33483)
    * fix(ext/node): support http2 pushStream and client push events (#33516)
    * fix(ext/node): support reusePort option and fix bind/pipe handling in node:net (#33416)
    * fix(ext/node): accept X.509v1 server certs in tls.createServer (#33505)
    * fix(ext/node): emit stream-level PROTOCOL_ERROR in node:http2
    * fix(ext/bundle): clearer error when Deno.bundle is called in compiled binary (#33503)
    * fix(ext/node): emit Buffer for http2 'goaway' opaqueData (#33502)
    * fix(ext/node): support encoding option in fs.readdir; don't double-call glob callback (#33501)
    * fix(ext/fetch): don't mutate caller's options in Deno.createHttpClient (#33497)
    * fix(bundle): treat CSS same-document fragment URLs as external (#33492)
    * fix(ext/node): fix EEXIST error and data loss in writeFileSync on Windows (#33413)
    * fix(ext/node): support util.promisify on http2.connect (#33489)
    * fix(ext/node): honor http2 strictFieldWhitespaceValidation option (#33506)
    * test: enable parallel/test-http2-too-many-streams.js (#33507)
    * fix(ext/node): rebind http2 state buffers post-snapshot, enforce maxHeaderListPairs (#33495)
    * chore: clean up WPT runner output (#33487)
    * fix(ext/fs): normalize Deno.watchFs paths so events drop ./ segments (#33490)
    * fix(ext/node): improve Node.js timer compatibility (#33479)
    * fix(ext/web): narrow ReadableStreamBYOBRequest.view to Uint8Array (#33477)
    * fix(ext/node): emit HPE_INVALID_TRANSFER_ENCODING for CL+chunked respo (#33488)
    * fix(ext/web): allow transferring non-serializable types in structuredClone (#33491)
    * chore(tests): enable 157 passing node compat tests (part 3/3) (#33412)
    * fix(ext/node): return relative path from fs.watch with recursive option (#33428)
    * chore(wpt): update cache-storage-keys expectation after #33275 (#33484)
    * fix(ext/web): structuredClone of non-serializable Web types throws DataCloneError (#33465)
    * fix(ext/node): emit DEP0182 deprecation for short AES-GCM auth tag (#33469)
    * fix(ext/webidl): set ERR_INVALID_THIS code on brand-check TypeError (#33467)
    * chore(tests): enable 158 passing node compat tests (part 1/3) (#33410)
    * fix(ext/web): handle late write racing with TransformStream cancel (#33478)
    * fix(ext/web): set ERR_MISSING_ARGS code on URL.revokeObjectURL no-arg  (#33471)
    * fix(x): forward --unstable-* flags to JSR and URL targets (#33450)
    * fix(ext/node): validate boolean arg in process.setSourceMapsEnabled (#33473)
    * fix(ext/node): align crypto random* validation with Node (#33456)
    * fix(permissions): normalize paths for macOS filesystem comparison (#33451)
    * fix(ext/node): emit TimeoutNaNWarning for invalid timer durations (#33472)
    * fix(ext/node): make Buffer.prototype methods generic-callable (#33466)
    * fix(ext/node): emit DEP0031 deprecation warning for ecdh.setPublicKey( (#33468)
    * fix(ext/crypto): throw TypeMismatchError for non-TypedArray in getRand (#33470)
    * fix(cache): add missing CacheStorage.keys() and Cache.keys() methods (#33275)
    * fix(ext/node): walk sandbox prototype chain in vm property_query (#33463)
    * fix(doc): remove background from operators in dark mode code blocks (#33267)
    * fix(ext/node): enable test-als-defaultvalue-original (AsyncLocalStorage default value) (#33464)
    * fix: bound fs.readFile on non-terminating sources (#33262)
    * fix(ext/node): use ERR_INVALID_ARG_VALUE in module.createRequire (#33449)
    * fix: drop config-only unstable features from unstable_args() (#33452)
    * test: enable 20 already-passing Node compat tests (#33461)
    * test: ignore parallel/test-webcrypto-webidl.js (#33454)
    * fix(ext/web): align AbortSignal.timeout error message with Node (#33460)
    * test: ignore 3 unsupportable crypto tests (#33455)
    * fix(ext/node): add Server BlockList, asyncDispose, and misc net improvements (#33417)
    * fix(ext/node): pass signal name to process signal handlers (#33425)
    * test: ignore 2 unsupportable crypto tests (#33457)
    * fix(ext/node): honor requestCert/ca on node:tls server, populate getPeerCertificate() (#33439)
    * fix(ext/node): implement StatWatcher.ref() / unref() (#33408)
    * fix(ext/node): use Node's address-type check in dgram Socket.send (#33420)
    * test: ignore parallel/test-crypto-fips.js (#33453)
    * fix(ext/node): validate process.chdir argument is a string (#33401)
    * fix(ext/node): replace unwrap with error propagation in parallel cp (#33396)
    * fix(ext/node): emit tlsClientError instead of crashing on TLS init failure (#33429)
    * fix(ext/node): align fs.truncate / ftruncate argument validation with Node (#33418)
    * fix(ext/node): throw ERR_INVALID_URL from http/https request string URL (#33427)
    * fix(ext/node): cache hash digest so it survives stream.pipeline (#33440)
    * fix(ext/node): implement BlockList.rules / isBlockList / toJSON / fromJSON (#33445)
    * fix(ext/node): validate dgram options.recvBufferSize / sendBufferSize (#33444)
    * fix(ext/node): emit StatWatcher 'stop' event asynchronously (#33448)
    * fix(ext/node): attach path/syscall to fs.lstat / realpath / link errors (#33446)
    * fix(ext/web): route console.dirxml through the log printer (#33443)
    * fix(ext/fetch): use byte ReadableStream for Node Readable request bodies (#33432)
    * fix(ext/node): make process.constructor a proper instanceof check (#33447)
    * fix(ext/node): include accepted values in Console colorMode error (#33424)
    * fix(ext/node): fix ERR_INVALID_CHAR message & OutgoingMessage.prototype.write (#33430)
    * docs: clarify --watch-hmr does not restart on file changes (#33381)
    * fix(ext/node): import kIncomingMessage/kServerResponse in http2 allowHTTP1 fallback (#33435)
    * chore: bump tokio-eld to 0.3 to fix UAF causing deno test SIGSEGV (#33375)
    * fix(ext/node): implement Socket.resetAndDestroy with TCP RST in node:net (#33415)
    * fix(ext/node): async fs.stat/lstat throwIfNoEntry + deprecate fs.Stats (#33436)
    * perf: upgrade rusty_v8 to 147.4.0 (#33422)
    * perf(ext/node): pool 64KB read buffers to reduce allocation pressure (#33395)
    * fix(node/compat): fix shard report merging and fetching in CI reporting (#33431)
    * fix(ext/node): support BlockList, AbortSignal, and constructor options in node:net Socket (#33414)
    * fix(node/compat): disable flaky test-child-process-exec-kill-throws on Windows (#33426)
    * fix(node/compat): disable flaky test-fs-read-stream-pos on Windows (#33421)
    * fix(ext/node): accept string mode in fs.mkdir and fs.mkdirSync (#33409)
    * fix(ext/node): validate oaepHash in publicEncrypt/privateDecrypt (#33388)
    * fix(ext/node): implement process.debugPort with ToInt32 coercion (#33403)
    * ci: shard node_compat tests into 3 parallel jobs (#33298)
    * fix(node/buffer): fix panic in transcode with odd-length UTF-16LE input (#33390)
    * fix(ext/node): drain pending TLS cleartext in enc_write_cb (#33378)
    * fix(ext/node): reject non-ArrayBufferView data in fs.writeFileSync (#33406)
    * fix(ext/node): attach input URL to ERR_INVALID_FILE_URL_PATH (#33398)
    * fix(ext/node): name custom-promisified functions after their originals (#33407)
    * fix(ext/node): throw TypeError for Symbol keys/values in process.env (#33399)
    * fix(ext/node): hide aggregateTwoErrors frame in AggregateError stack (#33402)
    * fix(ext/node): align module.builtinModules / getBuiltinModule with Node (#33404)
    * fix(ext/node): flush HTTP/2 client preface after settings submission (#33387)
    * fix(ext/node): encode more chars in url.pathToFileURL() (#33397)
    * chore(deps): bump openssl from 0.10.72 to 0.10.78 (#33376)
    * fix(ext/node): re-arm Windows named pipe server after accept (#33369)
    * fix(ext/node): fix fs.glob skipping siblings with **/../* patterns (#33372)
    * Revert "fix(ext/napi): implement real V8 handle scopes and callback scopes" (#33363)
    * fix(ext/napi): implement napi_async_init and napi_async_destroy (#33282)
  - Update to version 2.7.13:
    * 2.7.13 (#33359)
    * perf(ext/node): elide async_hooks emit in timers when no hooks registered (#33355)
    * fix(ext/node): enable HTTP parser consume fast path (#33354)
    * perf(ext/node): flush-free header fast path in HTTP parser (#33351)
    * fix(ext/node): free uv_write and uv_shutdown requests in every exit path (#33350)
    * perf(libs/core): poll only ready handles and yield between I/O batches (#33349)
    * perf(ext/node): reduce writev op allocations and write copies (#33352)
    * fix(ext/node): http client compat improvements (#33337)
    * fix(ext/node): support FD-indexed stdio inheritance in spawnSync (#33341)
    * refactor: replace ext/web timer imports with core timers or node:timers (#33121)
    * perf: reduce memory usage of Command.output() (#33335)
    * fix(ext/napi): defer GC weak-callback finalizers to the event loop (#33260)
    * fix(ext/http): treat empty Host header as missing in request URL (#33234)
    * fix(ext/node): http2 improvements — constants, error codes, settings, validation (#33332)
    * fix(ext/node): improve node:tls compat (validation, pipes, JS streams) (#33331)
    * fix: update v8 crate to 147.2.1 (#33318)
    * fix(ext/node): fix multiple http2 bugs (#33315)
    * fix(ext/napi): implement zero-copy external Latin-1 strings (#33283)
    * fix(ext/node): support RSA-PSS keys in crypto.verify with null algorithm (#33314)
    * fix(ext/node): defer JS stream encOut to avoid reentrant CppGC borrow (#33304)
    * fix(ext/node): ChildProcess.kill() returns false when process already exited (#33305)
    * test(npm): add regression test for update breaking peer dep lockfile entries (#33309)
    * fix(ext/napi): implement real V8 handle scopes and callback scopes (#33281)
    * fix(ext/node): auto-start server-side STARTTLS handshake, add TLS upgrade tests (#33303)
    * fix(runtime): warn on unsupported web Worker options and fix recv panic (#33310)
    * fix(ext/node): enforce maxHeaderSize in HTTP parser (#33306)
    * fix(ext/node): address node:http rewrite review comments (#33299)
    * fix(ext/node): flush HTTP/2 HEADERS frame after client request (#33300)
    * refactor(ext/node): remove JS LibuvStreamWrap class (#33297)
    * refactor(ext/node): use native LibUvStreamWrap based Wrap's to reduce code duplication (#33301)
    * fix(ext/node): fix playwright on windows (#33295)
    * fix(audit): migrate to bulk advisory endpoint (#33292)
    * fix(console): find nodejs.util.inspect.custom on Proxy objects via get trap (#33265)
    * feat(ext/node): rewrite node:http with llhttp and native TCPWrap (#33208)
    * fix(ext/node): fix Module._resolveLookupPaths and require.resolve compat (#33261)
    * fix(test): fix specific_canary upgrade test on Windows (#33286)
    * test: fetch latest canary hash dynamically in specific_canary test (#33279)
    * fix: add note for canary's 30-day retention period (#33271)
    * ci: fix false positives in no-deno-api lint plugin (#33270)
    * fix(doc): Add Prism support for JSX/TSX code blocks (#33255)
    * feat(upgrade): support installing from a PR (#33252)
    * fix: restore glibc < 2.27 compatibility for Linux release builds (#33259)
    * fix(ext/node): fix EEXIST error and file corruption with writeFileSync on Windows (#33253)
    * chore: upgrade rusty_v8 to 147.1.0 (#33235)
    * feat(ext/node): implement node:repl module (#32799)
  - Update to version 2.7.12:
    * 2.7.12 (#33227)
    * fix(permissions): normalize IPv4-mapped IPv6 addresses in net permission checks (#33223)
    * fix(core): fix uv_pipe_open handle lifecycle to match libuv (#33225)
    * test(permissions): add proptest property-based tests (#33224)
    * feat(ext/node): add fs.SyncWriteStream (#33226)
    * refactor: remove _readWithCancelHandle from Stdin (#33222)
    * fix(core): handle WouldBlock in op_print for non-blocking stdio (#33221)
    * test: prevent task/signals spec test from hanging in CI (#33020)
    * fix(permissions): check deny rules against resolved IPs to prevent numeric hostname bypass (#33203)
    * fix(io): remove global stdio statics, handle non-blocking stdin (#33219)
    * perf(ext/node): use aws-lc-sys EVP API for chacha20-poly1305 (#33110)
    * fix(ext/napi): use per-isolate Private key for napi_wrap/napi_unwrap (#33204)
    * Revert "feat: disable ops and resources sanitizers by default in deno test (#33158) (#33215)
    * feat(ext/node): add llhttp-based HTTPParser with native cppgc binding (#33202)
    * fix(runtime): cache canonicalized watch paths, fix spurious events (#33123)
    * Revert "feat(install): added --prod to skip dev deps and @types (#32863) (#33212)
    * Revert "feat: use Node.js timers by default (#33118)" (#33211)
    * test(permissions): add missing unit tests for permission system (#33207)
    * Revert "feat: disable "no-process-global", "no-node-globals" lint rules by default (#33147) (#33213)
    * Revert "feat(add/install): default to npm registry for unprefixed packages (#33156) (#33214)
    * fix(core): free UvLoopInner on uv_loop_t drop to prevent worker memory leak (#33200)
    * fix(ext/node): throw on cipher update with input >= 2^31-1 bytes (#33201)
    * fix(node): validate resolved main path stays within package directory (#33170)
    * refactor(ext/node): wire up native TLSWrap from JS (#33184)
    * fix(ext/webgpu): accept `ArrayBuffer` in `GPUQueue.writeBuffer()` as data source (#33152)
    * fix(core): use c_char instead of i8 in uv_buf_t base cast (#33179)
    * fix(ext/node): add dns.getDefaultResultOrder() API (#33197)
    * fix(otel): add timeout to OTEL HTTP exporter to prevent hangs (#33159)
    * fix(schema): fix the `publish: false` of deno.json schema (#33196)
    * feat: native uv_pipe_t implementation with NativePipe and FdTable (#33165)
    * fix(repl): surface CDP protocol errors and fix race in wait_for_response (#33190)
    * feat(ext/node): add native TLSWrap cppgc object (Rust core) (#33183)
    * refactor(ext/node): prep for native TLSWrap (#33182)
    * refactor(ext/process): bypass resource table for Node child_process stdio (#33176)
    * fix(ext/node): implement uv_ref for native TCP handles (#33174)
    * fix(ext/node): remove dead legacy TCP server accept path (#33172)
    * refactor: move FdTable to ext/io (#33169)
    * Revert "feat(unstable): add deno tsconfig subcommand (#33160)" (#33162)
    * feat(unstable): add `deno tsconfig` subcommand (#33160)
    * fix(ext/node): implement timeout, killSignal, and pid for child_process spawnSync (#32810)
    * feat: disable ops and resources sanitizers by default in deno test (#33158)
    * fix(ext/node): implement TCP.open(fd) (#33155)
    * feat(add/install): default to npm registry for unprefixed packages (#33156)
    * feat: disable "no-process-global", "no-node-globals" lint rules by default (#33147)
    * fix(ext/node): create net.Socket from file descriptors (#33150)
    * fix(ext/node): support numeric FDs in child_process stdio array (#33140)
    * fix(ext/node): rewrite Pipe.open(fd) to use raw fd ops (#33136)
    * fix: linked packages with peer deps failing to cache from lockfile (#33143)
    * refactor: remove forked typescript-go infrastructure (#33133)
    * feat(install): added --prod to skip dev deps and @types (#32863)
    * fix: update release template workflow URLs to .generated.yml (#33116)
    * refactor(ext/node): rework stream wrap infrastructure for reentrant safety (#33100)
    * fix(ext/node): return real OS file descriptors from node:fs APIs (#33039)
    * refactor: remove Node/Deno global proxy and simplify CJS wrapper (#33122)
    * feat: use Node.js timers by default (#33118)
    * refactor: remove LSP integration from repl and jupyter (#33119)
  - Update to version 2.7.11:
    * 2.7.11 (#33114)
    * ci: fix start_release workflow (#33113)
    * ci: remove stale gha-creds cleanup after gcloud removal (#33112)
    * fix(ext/node): fire fs.watch events for immediate writes (#32935) (#32989)
    * ci: update to gagen 0.3 for maintainable pinning of all workflow dependencies (#33082)
    * feat: add alpha and beta release channel support (#33098)
    * fix(watch): reduce graceful shutdown timeout from 5s to 500ms (#33099)
    * ci: remove legacy gcloud upload (#33088)
  - Update to version 2.7.10:
    * 2.7.10 (#33092)
    * fix(ext/node): add chacha20-poly1305 cipher support (#33084)
    * fix(ext/node): improve sign/verify crypto compat with Node.js (#33083)
    * fix(ext/node): return pid from spawnSync (#33081)
    * fix(ext/node): improve GCM cipher compat with Node.js (#33079)
    * feat: add include and exclude fields to compile config (#33024)
    * fix(ext/node): drain pending messages before emitting worker exit event (#32623)
    * fix(ext/node): fix BadResource error in FileHandle.readLines() (#32685)
    * fix: use case-insensitive path matching for permissions on Windows (#33073)
    * fix(resolver): resolve npm packages that shadow Node built-in names in BYONM mode (#32865)
    * fix(outdated): use dist-tags.latest for Latest column, matching npm/pnpm/bun (#32939)
    * fix(npm): resolve linked packages not published to npm registry (#33021)
    * fix(ext/web): fix infinite loop in WebTransport datagram overflow handling (#33075)
    * docs: clarify mkdir does not throw with recursive: true (#33019)
    * fix(serde_v8): use actual bytes written in to_utf8_slow (#33074)
    * fix(ext/node): escape shell metacharacters in child_process args on Windows (#33071)
    * fix(lsp): don't double-encode query/fragment in notebook cell URIs (#33070)
    * fix(install): all package.json aliases should be added to node_modules (#33068)
    * fix(ext/http): gracefully handle consumed external in OTel ops (#33027)
    * chore: Use *mut _ and *const _ for type inference (#33053)
    * fix(lsp): suggest import map aliases in auto-imports for local directories (#33048)
    * chore(ext/node): remove unused op_node_is_tty (#33045)
    * chore: upgrade sys_traits 0.1.27 (#33040)
    * fix(ext/node): `process.argv[0]` is equivalent to execPath (#28915)
  - Update to version 2.7.9:
    * 2.7.9 (#33022)
    * Revert "fix(ext/node): support numeric FDs in child_process stdio array (#32959)" (#33017)
    * refactor(core): libuv compatibility improvements for uv_compat (#33015)
    * fix(compile): strip duplicate exe path from argv when standalone binary relaunches (#33016)
    * fix(publish): vite import.meta.hot not type checking (#32127)
    * fix(ext/node): rewrite Windows TTY reading to match libuv (console mode, encoding, raw + line mode) (#32999)
    * fix(ext/node): add Symbol.dispose and Symbol.asyncDispose to fs.Dir (#33000)
    * fix(ext/http): use clone_external in op_http_metric_handle_otel_error (#33005)
    * fix(ext/node): use constant-time comparison for secret key equality (#32994)
    * fix(compile): use execPath for process.argv[1] in standalone binaries (#32990)
    * fix(ext/node): `util.stripVTControlCharacters` compatibility (#32942)
    * refactor(core): reduce JS<->Rust event loop hops (#32844)
    * chore: add lint plugin to track Deno.* API usage in node polyfills (#32964)
    * perf(ops): replace per-op generated slow metrics wrappers with shared dispatch (#32889)
    * test: add edge case and worker termination tests for Node-API (#32986)
    * test: mark unsupported Node compat tests as ignored (#32956)
    * fix(cli): show clean error instead of panic for invalid --unsafely-ignore-certificate-errors value (#32868)
  - Update to version 2.7.8:
    * 2.7.8 (#32985)
    * test(napi): add more coverage for advanced features (#32963)
    * fix(resolver): fall through to .deno/ when BYONM node_modules version mismatches (#32981)
    * fix(compile): skip Node-to-Deno arg translation in standalone binaries (#32980)
    * fix(npm): use box-drawing style for deprecated package warnings (#32979)
    * fix(ext/node): support http2 createConnection sockets (#32733)
    * fix: include Temporal types in deno types output (#32952)
    * fix(resolver): prefer exact version match in BYONM npm resolution (#32977)
    * fix(cli): fix arrow keys in interactive picker on Windows (#32978)
    * fix(ext/node): support numeric FDs in child_process stdio array (#32959)
    * fix(cli): parse --frozen flag for deno update and deno outdated (#32975)
    * fix(lockfile): truncate frozen lockfile error diff to 50 lines (#32976)
    * fix: handle inner quotes in double-quoted env values in .env file (#32930)
    * refactor: use sys_traits more in deno_npmrc (#32955)
    * test(napi): add coverage tests for data types and object operations (#32962)
    * chore: upgrade V8 to 147.0.0 (#32965)
    * fix(napi): add test coverage and fix escape_handle/throw bugs (#32960)
    * fix(ext/node): close libuv handle on HandleWrap.close() for new-style handles (#32958)
    * fix(ext/napi): pass valid env to tsfn call_js_cb after close race (#32957)
    * fix(node/http): stop leaking TCP wrappers on HTTPS upgrade with createConnection TLSSocket (#32961)
    * feat(ext/telemetry): add console exporter for OpenTelemetry (#32717)
    * fix(fmt): delegate component expression formatting to markup_fmt (#29763)
    * fix(ext/node): `fs.cp` across allowed dirs with ignored read permissions (#32927)
    * fix(fmt): update markup_fmt to 0.27.0 and malva to 0.15.2 (#32949)
    * fix(ext/node): drain all ready connections in poll_tcp_handle to prevent accept starvation (#32943)
    * refactor(core): use uv_check_t handle for setImmediate (#32879)
    * fix(ext/web): handle null options in removeEventListener (#32605)
    * docs: fix duplicated wording in LSP symbol comments (#32368)
    * fix(inspector): send executionContextDestroyed on process.exit() (#32934)
    * docs: update Claude instructions (#32818)
    * feat(ext/napi): add node_api_create_object_with_named_properties (#32906)
    * chore: consolidate Copilot review instructions and add runtime-aware guidelines (#32938)
    * fix(npm): skip `file:` and `link:` dependencies in npm packages (#32876)
    * refactor: `deno_npmrc` crate (#32936)
    * feat(core): implement NodeRuntime CDP domain and fix --inspect-brk blocking (#32714)
    * fix(ext/node): defer uv_write callbacks to prevent re-entrancy panic (#32919)
    * fix(ext/node): fix node:domain across async boundaries (#32897)
    * fix(ext/web): AbortSignal.any() memory leak with long-lived signals (#32916)
    * fix(ext/node): fix IPC stdio handling in child_process (#32920)
    * perf(ext/web): use simdutf for base64 encode/decode (#32743)
    * fix(ext/node): fix Buffer.concat truncating buffers larger than 4GB (#32913)
    * fix(ext/node): set fd property on TTY ReadStream and WriteStream (#32880)
    * fix(ext/node): enable node:fs compat tests + lchmod fix (#32892)
    * fix(ext/node): preserve TLS upgrade state on reconnect (#32838)
    * fix(ext/node): return all own properties from VM context property enumerator (#32911)
    * fix(ext/node): child_process improvements (internalMessage, argv0, DEP0190) (#32885)
    * fix(ext/console): handle throwing Symbol.toStringTag getter gracefully (#32917)
    * fix(ext/node): do not throw error for `readline.createInterface` outside TTY (#32874)
    * chore: update deno_doc crate (#32896)
    * ci: add Copilot review instructions (#32887)
    * chore(deps): bump aws-lc-sys from 0.38.0 to 0.39.0 (#32883)
    * fix: skip flaky test-process-threadCpuUsage-worker-threads on Windows (#32886)
    * chore(deps): bump tar from 0.4.43 to 0.4.45 (#32882)
    * fix(audit): respect package.json overrides in vulnerability checks (#32878)
    * fix(npm): create shims for all bin entries during global npm install (#32607)
    * fix(ext/node): pass uid/gid to spawn and implement process.getgroups (#32772)
    * fix(ext/node): sqlite prepare() options, defensive default, iterator invalidation (#32756)
    * perf: upgrade to jsonc-parser 0.32 (#32864)
    * fix(ext/node): don't fire upgrade event for h2c requests (#32866)
    * fix(ext/node): update process.versions.napi to 9 (#32870)
    * fix(ext/node): improve process.hrtime argument validation (#32837)
    * fix(ext/node): implement process.threadCpuUsage() (#32829)
    * fix(ext/node): freeze os.constants.signals to match Node.js (#32836)
    * fix(ext/node): enable node compat test for v8.getHeapStatistics (#32833)
    * fix: rewrite approve_scripts_no_lock as PTY tests, skip lockfile test on Windows (#32853)
    * fix(npm): `approve-scripts` detects packages when lockfile is disabled (#32842)
    * refactor(core): clean up timer implementation, build web timers on Node Timeout (#32843)
    * fix(ext/node): emit request "close" before socket "free" in keep-alive path (#32811)
    * test: add per-file timeout and reduce CI job timeout (#32840)
    * feat(ext/crypto): implement P-521 sign, verify, and ECDH derive (#32602)
    * feat: use lockfile from jsr package for global install (#32490)
    * fix: make flamegraph SVG fill full browser viewport (#32727)
    * feat(ext/telemetry): copy relevant span attributes to HTTP metrics (#32720)
    * refactor(core): move timer processing from Rust to JavaScript (#32543)
    * fix(ext/node): improve readline and EventEmitter compat (#32826)
    * docs: update contributing guidelines (#32747)
  - Update to version 2.7.7:
    * 2.7.7 (#32835)
    * fix(ext/node): add key/IV length validation for aes-128-cbc and ecb cipher modes (#32824)
    * fix(ext/node): improve node:dns module compatibility (#32704)
    * fix(watch): support graceful shutdown via SIGTERM dispatch (#32564)
    * fix(ext/node): set kLastWriteWasAsync in JS write path to prevent double callback (#32814)
    * fix(core): implement select fallback on macOS (#32812)
    * fix(ext/node): use constant-time comparison for GCM auth tag verification (#32817)
    * fix(ext/node): validate process.exitCode and fix process constructor name (#32806)
    * fix(ext/node): skip normalization in path.win32.join for reserved device names (#32808)
    * fix(ext/node): add disabled process function stubs in worker threads (#32809)
    * fix(ext/node): improve process.title and support --title flag (#32201)
    * fix(ext/node): support interface option for IPv6 multicast membership (#32754)
    * chore: re-enable compile determinism test (#31651)
    * perf(ext/webidl): optimize dictionary converters (#32729)
  - Update to version 2.7.6:
    * 2.7.6 (#32800)
    * fix(ext/node): fix 8 Node.js compat test failures (#32755)
    * perf(ext/web): optimize URLPattern ops to reduce serde overhead and GC pressure (#32766)
    * feat(core): update v8 to 146.8.0 with foreground task ownership (#32771)
    * feat(ext/node): add MIMEType, convertProcessSignalToExitCode, Symbol.dispose for ChildProcess (#32793)
    * test: prevent Claude from running entire spec suite (#32797)
    * fix(ext/node): improve worker_threads path validation and error handling (#32791)
    * fix(ext/node): fix TLA stall with native TTY handles and make stdio indestructible (#32792)
    * feat(eval): auto-detect CJS vs ESM in deno eval (#32472)
    * fix(ext/node): fix Buffer.concat, expose internal/buffer, implement markAsUntransferable (#32760)
    * fix(ext/node): rewrite node:tty on top of uv compat (#32777)
    * perf(linux): trim glibc malloc arena after module loading (#32662)
    * fix(ext/node): allow passing `FileHandle` as `fd` argument for `WriteStream` and `ReadStream` (#32770)
    * fix(process): allow unref'd child processes to outlive parent (#32563)
    * perf(lsp): replace dissimilar with imara-diff (#32700)
    * fix(core): don't panic in to_v8_error when JS error builder callback fails (#32749)
    * feat(ext/signals): support additional signals on Windows (#32689)
    * fix(repl): fix panic when pressing Tab at beginning of line (#32750)
    * perf(ext/web): optimize TextEncoder/TextDecoder hot paths (#32735)
    * perf(ext/web): add write buffering for FsFile.writable streams (#32676)
    * fix(ext/node): signal listeners added via `process.once` can now be removed (#32606)
    * fix(ext/telemetry): add exception.* attributes to OTEL log records (#32726)
    * fix(ext/web): upgrade QuotaExceededError to DOMException derived interface (#32244)
    * fix(test): allow test functions to override reported location (#32732)
    * perf(ext/node): move `fs.cpSync` implementation to rust (#32687)
    * fix(ext/node): fix send() validation in child_process IPC (#32779)
    * fix(ext/node): improve Node.js crypto compatibility (#32690)
    * fix(core): prevent panic when multiple lazy-loaded ESM modules are loaded during TLA (#32769)
    * fix(ext/ffi): retain backing store references in nonblocking calls (#32775)
    * feat(ext/telemetry): support array values in OTEL attributes (#32748)
    * perf(ext/napi): use threadpool for async work instead of spawning threads (#32776)
    * fix(ext/node): require --allow-net for udp.send (#32774)
    * fix(ext/node): validate handle type in child_process send() (#32711)
    * fix(ext/node): fix IPC message prototype for child_process JSON (#32731)
    * refactor: force a reason on clippy overrides (#32761)
    * perf(core): optimize V8-to-Rust string conversion with ValueView (#32688)
    * fix(ext/node): fix multiple deepEqual comparison issues (#32763)
    * fix(ext/console): make timer and counter state per-instance to fix OTEL console wrapping (#32719)
    * fix(runtime): apply source maps to CPU profiler output (#32634)
    * chore: update node_test submodule to Node.js 25.8.1 (#32705)
    * fix(coverage): don't mark lines uncovered when zero-count range only partially overlaps (#32601)
    * fix(ext/telemetry): add `log.iostream` attribute to console logs (#32723)
    * fix(ext/otel): don't mark server spans as error for 4xx responses (#32722)
    * fix(ext/node): allow IPv6 multicast addresses in UDP addMembership/dropMembership (#32739)
    * fix(ext/node): fix AbortController signal handling in child_process s… (#32713)
    * fix(ext/node): accept all TypedArrays in spawnSync input option (#32712)
    * fix(ext/node): enable 8 already-passing child_process compat tests (#32710)
    * fix(ext/node): include prototype env vars in child_process spawn (#32699)
    * fix(ext/node): fix perm checks in TCPWrap (#32721)
    * fix(runtime): use XML-valid entity in flamegraph SVG (#32716)
    * fix(ext/node): support encrypted PEM export and deprecated hash option in crypto keygen (#32703)
    * fix(ext/napi): keep event loop alive while uv_async_t handle is active (#32702)
    * fix(tsc): move more node resolution errors to typescript diagnostics (#32697)
    * fix(ext/node): set up stdio streams on failed child_process spawn (#32698)
    * test: update WPT expectations to match current test results (#32701)
    * feat: add --cpu-prof-flamegraph to generate interactive SVG flamegraphs (#32572)
    * perf(ext/web): optimize node:buffer base64 encode/decode (#32647)
    * fix(ext/napi): prevent spurious TypeError from napi_coerce_to_object on null/undefined (#32695)
    * fix: restore --env-file parent directory traversal and do not error in `deno compile` for not found env file (#32686)
    * fix(ext/node): improve X509Certificate Node.js compatibility (#32671)
    * fix(lsp): align organize imports output with tsgo (#32677)
    * fix(npm): resolve bundled npm deps in packages properly when not using a `node_modules` directory (#32679)
    * fix(ext/web): support %j JSON format specifier in console.log (#32684)
    * fix(watch): dispatch unload and process exit events on restart (#32664)
    * refactor(ext/node): consolidate node:fs (part 9) (#32659)
    * fix(web): support structuredClone for DOMException (#32675)
    * fix(ext/node): implement safe, add, rem options for crypto.generatePrime (#32618)
    * fix(ext/crypto): support structuredClone for CryptoKey (#32674)
    * perf(fmt): speed up file diffing (#30644)
    * fix(ext/node): remove extra properties from node:fs exports (#32670)
    * fix(ext/node): emit "connect" event on http.Server for CONNECT requests (#32599)
    * feat(core): add cloneable resource registry for structured clone (#32672)
    * fix(ext/node): use non-blocking write in fs.writev (#32673)
    * perf(npm): run lifecycle scripts in parallel (#32666)
    * fix(ext/node): wrap non-Error unhandled rejections in ERR_UNHANDLED_REJECTION (#32535)
    * chore(npm): fix debug panic in DepEntryCache (#32668)
    * fix(runtime): reduce memory retention after web worker termination (#32617)
    * fix(runtime): display proper error when throwing in event handlers (#32663)
    * chore(x): improve developer CLI with help, structure, and test filters (#32665)
    * fix(ext/napi): call wrap/ref finalizers at shutdown (#32592)
    * fix(ext/node): improve crypto.generateKeyPair validation (#32620)
    * fix(cli): update typescript-go to 2026-03-09 (#32656)
    * fix: wake event loop when V8 posts foreground tasks from background threads (#32450)
    * fix(npm): support npmrc certfile + keyfile (#32655)
    * chore: add test to ensure dlls are lazily loaded on windows (#32648)
    * chore: respect char boundaries in node_compat test output truncation (#32658)
    * fix(npm): retain authorization header on http->https redirect (#29878)
    * perf(ext/web): reduce promise allocations in streams (#32652)
    * refactor(ext/node): consolidate `node:fs` (part 8) (#32640)
    * perf(install): avoid unnecessary package info fetches when running lifecycle scripts (#32653)
    * chore: add `./x` developer CLI tool (#32470)
    * fix(ext/signals): prevent panic on FreeBSD (#32518)
    * chore(deno_npm): use `Rc<PackageNv>` more (#32650)
    * fix(ext/fetch): retry on stale pooled HTTP/1.1 connections (#32566)
    * chore: fix windows build with latest msvc (#32644)
    * ci: rename `lint ci status` to `ci status` (#32391)
    * refactor(ext/node): consolidate `node:fs` (part 7) (#32631)
    * fix(npm): handle read-only bin files when setting up node_modules/.bin (#32632)
    * fix(ext/node): handle signal 0 in child_process.kill() (#32294)
    * chore: remove warning building deno_npm_cache in Wasm (#32637)
    * fix(ext/node): fix TLS JSStreamSocket resource leak causing process hang (#32325)
    * fix(ext/node): handle cargo features during publish (#32636)
  - Update to version 2.7.5:
    * 2.7.5 (#32633)
    * fix(ext/node): handle generateKeyPair 2-arg call and enable PQC tests (#32619)
    * chore(deps): bump quinn-proto from 0.11.12 to 0.11.14 (#32624)
    * fix(ext/http): allow rejecting HTTP upgrades with non-101 status codes (#32615)
    * fix(ext/node): fix multiple node:dgram compatibility issues (#32520)
    * feat(doc): support npm packages in `deno doc` (#32435)
    * fix(npm): memoize peer cache hit checks to prevent combinatorial explosion (#32609)
    * fix(ext/node): add `node_api_create_property_key_(latin1/utf8)` (#32559)
    * fix: flush CPU profile and coverage data on Deno.exit() (#32591)
    * fix(npm): support npmrc email authorization (#32616)
    * feat(ext/node): add `node_api_create_object_with_properties` API (#31443)
    * fix(ext/node): run worker_threads eval code in sloppy mode (#32428)
    * fix(lsp): tsgo scope attribution for asset files (#32608)
    * fix(ext/napi): run async work execute callback on a worker thread (#32560)
    * perf(ext/node): move most `fs.cp` logic to rust (#32580)
    * fix(ext/node): make tty ReadStream/WriteStream callable without `new` (#32537)
    * fix(ext/node): add missing http2 header constants (#32611)
    * refactor(ext/node): consolidate node:fs modules (part 6) (#32588)
    * test: ignore some Node compat tests (#32556)
    * test: support `--list` flag in custom test harnesses (#32553)
    * fix(ext/node): napi_set_instance_data on exit (#32509)
    * fix(ext/node): rewrite http2 implementation (#32418)
    * fix(ext/node): improve node:dns compat (#32536)
    * fix(ext/node): emit correct error codes for unsupported PQC key types (#32533)
    * fix(console): prevent multi-line object values in console.table (#32604)
    * refactor(ext/node): remove multipleResolves process event handling (#32577)
    * fix(ext/node): multiple readline improvements (#32538)
    * fix(ext/node): use max salt length as default for RSA-PSS signing (#32534)
    * fix(ext/node): initialize debuglog testEnabled with safe default (#32598)
    * fix(ext/websocket): handle non-ASCII bytes in WebSocket response headers (#32594)
    * fix(ext/node): fix multiple DiffieHellman crypto bugs (#32531)
    * fix(napi): remove unimplemented Node-API symbols from napi_sys (#32593)
    * test: allow WPT tests to be marked as flaky (#32438)
    * refactor(napi): replace external napi-sys with in-tree napi_sys crate (#32582)
    * fix(ext/node): emit DEP0198 warning for SHAKE digests without outputLength (#32521)
    * feat(ext/node): implement KeyObject.toCryptoKey() and KeyObject.from(CryptoKey) (#32523)
    * fix(ext/node): improve getCipherInfo and allow repeated Hmac digest() (#32522)
    * fix(ext/node): implement ECDH.convertKey and fix related ECDH bugs (#32532)
    * fix(ext/otel): remove panicking unwraps in telemetry code (#32557)
    * fix: ensure binaries distributed in `@deno/...` npm packages are exectuable (#32581)
    * feat: --cpu-prof flags for CPU profiles (#31909)
    * refactor(ext/node): consolidate node:fs modules (part 5) (#32573)
    * perf(lsp): drop jsx import source cache (#32506)
    * refactor(core): remove OpMetricsSummary (#32569)
    * refactor: move Temporal types to separate lib.temporal.d.ts (#32571)
    * fix(lsp): properly sync root files with tsgo (#32455)
    * refactor(ext/node): consolidate node:fs modules (part 4) (#32555)
    * refactor(core): clean up RecursiveModuleLoad API (#32424)
    * ci: run ecosystem tests only on weekdays (#32554)
    * docs: document --env-file flag in Deno.Env type definitions (#32546)
    * feat(coverage): add function coverage to summary and HTML reports (#32507)
    * perf(npm): improve decompression speed more (#32547)
    * perf(npm): less syscalls in tarball extraction (#32541)
    * refactor(ext/node): consolidate node:fs modules (part 3) (#32525)
    * refactor: use sys_traits deno_dotenv (#32542)
    * perf(npm): remove folder canonicalization in tarball extract (#32540)
    * fix: support value substitution when loading environment variable files (#32495)
    * ci: remove issue insight workflow (#32539)
    * fix(ext/node): make TTY stdout/stderr indestructible (#32530)
    * perf(npm): use libdeflater and preallocate buffer (#32511)
    * fix(ext/node): support des-ede3-cbc cipher and allow Cipheriv/Decipheriv without new (#32519)
    * feat(otel): allow feeding permission audit data into OTEL  (#32501)
    * fix: normalize `capture` to boolean in `removeEventListener` options (#32508)
    * refactor(ext/node): consolidate fs modules (batch 2) (#32505)
    * chore: better structured Slack output for issue_pr_insights (#32503)
    * fix: set `process.features.openssl_is_boringssl` to `true` (#32512)
    * test: add expected failure support to node_compat test harness (#32451)
    * fix(ext/node): implement proper `resourceLimits` for `node:worker_threads` (#32430)
    * docs: add GitHub Copilot instructions (#32492)
    * refactor(ext/node): consolidate fs modules and move promises to internal/fs (#32502)
    * fix(core): switch to V8 Explicit microtask policy for correct nextTick ordering (#32466)
    * test: modernize "node_compat" test runner (#32482)
    * fix(ext/node): implement `node:v8` heap APIs (#32483)
    * fix: prevent panic on dynamic import with non-string error name (#32498)
    * chore: upgrade aws-lc- crates (#32499)
  - Update to version 2.7.4:
    * 2.7.4 (#32494)
    * fix(deploy): correctly handle version lookup (#32489)
    * ci: maybe fix spec test timeout (#32487)
    * fix(test): restart all tests on env file change (#32461)
    * fix(ext/node): use sync writes for TTY stdout/stderr WriteStream (#32488)
    * perf(npm): actually improve `npm install -g deno` binary startup performance (#32467)
    * chore: update rusty_v8 hashes in nix flake (#32471)
    * chore: update deno_std submodule to latest commit (#32469)
    * ci: Add GHA automation for daily issue and PR insights (#32449)
    * fix(ext/node): deep `assert` compatibility (#32434)
    * fix(core): uv_compat cleanup and fixes (#32458)
    * refactor: split up tools::installer into global and local modules (#32463)
    * Reland refactor(core): move nextTick/immediate queues into core, replace ops with shared buffers (#32440) (#32465)
    * ci: fix deno_core changes check in shallow clones (#32464)
    * Revert "refactor(core): move nextTick/immediate queues into core, replace ops with shared buffers (#32440) (#32462)
    * refactor(core): move nextTick/immediate queues into core, replace ops with shared buffers (#32440)
  - Update to version 2.7.3:
    * 2.7.3 (#32459)
    * perf(npm): improve `npm install -g deno` binary startup performance (#32439)
    * fix(deploy): dont use jsr api for deploy subcommand (#32441)
    * fix(npm): don't panic when peer dep is not in snapshot (#32454)
    * fix(npm): regression where resolution was missing dependencies (#32453)
    * fix(ext/node): support HTTP over Windows named pipes in node:http (#32414)
    * refactor(config): handle workspaces properly for deploy config (#32445)
    * ci: run node_compat_tests only on weekdays (#32446)
    * ci: fix npm publish (#32437)
    * test: dgram.addMembership EINVAL error regression test (#32256)
    * refactor: move `deno_cache_dir` into Deno repo (#32426)
    * fix(ext/node): handle partial writes to process.stdout/stderr (#32433)
    * refactor(wpt): split expectation.json into per-suite files (#32395)
    * fix(ext/node): make UDP socket ops synchronous, implement missing dgram methods (#32381)
  - Update to version 2.7.2:
    * 2.7.2 (#32429)
    * fix(npm): NPM_CONFIG_REGISTRY correctly overrides .npmrc (#32394)
    * perf(install): improve parallelism of fetches during npm resolution (#32416)
    * fix(ext/node): gracefully exit on invalid NODE_CHANNEL_FD instead of panicking (#32421)
    * chore(deno_npm): remove ancestors iterator (#32420)
    * fix(ext/node): support SEC1 EC private key import/export in `node:crypto` (#32401)
    * ci: skip deno-core-test when no relevant files changed (#32404)
    * fix(ext/crypto): fix P-521 EC key export for all formats (#32412)
    * fix: validate cron schedule when using cron socket (#32406)
    * refactor: consolidate `utils::watcher_env_tracker` to `utils::env` (#32419)
    * ci: use hash service for reducing duplicate work (#32411)
    * fix(ext/node): support RSA PSS padding option in crypto sign/verify (#32269)
    * perf(install): split tarball extraction into decompress + write, limit write concurrency (#32408)
    * fix(ext/node): CBC decipher setAutoPadding(false) incorrectly strips bytes (#32403)
    * fix: process level environment variables should take precedence over env files (#32407)
    * fix(ext/node): implement KeyObject.equals, fix createCipheriv with KeyObject/null IV (#32409)
    * fix(compile): store self extracting dir in hidden dir beside executable (#32329)
    * fix(ext/crypto): handle wrong algorithm in subtle.importKey without panicking (#32410)
    * fix(ext/node): support Ed25519, X25519, and P-521 keys in X509Certificate.publicKey (#32267)
    * fix(node/crypto): handle empty input in decipher final with auto_pad=false (#31958)
    * fix(npm): peerDependency resolution leading to multiple versions being installed + hanging (#32358)
    * fix(ext/node): support DER-encoded keys in publicEncrypt/privateDecrypt (#32291)
    * ci: replace Cirrus runners and cache with GitHub defaults (#32405)
    * feat(ext/node): implement missing X509Certificate methods (#32270)
    * perf(install): move HTTP decompression for registry requests off the async event loop (#32400)
    * fix(test): dedupe discovered workspace test modules (#32380)
    * fix: fix some stack frame dimming, and make the console log more aligned with cli formatting (#32399)
    * fix(ext/node): make `execPath` named export a real string (#32396)
    * fix(ext/node): make `setAutoPadding(false)` a no-op for GCM ciphers (#32290)
    * fix(node): support ECDSA with secp256k1 in `node:crypto` (#32390)
    * fix(coverage): warn instead of erroring when source files are missing (#32398)
    * fix(ext/node): use internal compileFunction binding in CJS wrap (#32373)
    * perf(install): request abbreviated packuments from npm registry (#32364)
    * test: add regression test for catching error in require(esm) (#32352)
    * fix(ci): fix ordering of platforms in ecosystem_compat_slack (#32393)
    * fix(coverage): correct line and branch counts in coverage reports (#32312)
    * fix(node): implement process.umask properly (#32385)
    * fix(ext/node): make fsPromises.watch() a proper AsyncIterable with close() (#32378)
    * fix(ext/node): return first created path from recursive "node:fs" mkdir call (#32300)
    * fix(node): preserve AsyncLocalStorage context in stream.finished callback (#32389)
    * fix(jupyter): handle shutdown and interrupt requests per protocol (#32359)
    * fix:(ext/node): escape simple quotes in node:child_process (#32336)
    * fix(ext/console): support iterators in console.table (#32379)
    * fix(ext/node): handle emoji width correctly in readline (#32383)
    * fix(node): implement `resolveObjectURL` for `node:buffer` (#32382)
    * chore: bump `libuv-sys-lite` version (#32384)
    * test: disable flaky WPT test (#32386)
    * fix(cli): load multiple env files in the correct order (#32354)
    * perf(install): use aws-lc-rs for tarball integrity hashing (#32365)
    * fix(lsp): cross-scope requests (#32366)
    * fix(core): store Global<Context> ptr for libuv-compat callbacks (#32361)
    * fix: Update libffi and libffi-sys to fix build (#32301)
    * chore: merge deno_core repo into main repo (#32353)
    * fix(lsp): tsgo request cancellation (#32356)
    * fix(ext/node): support process.stdout resize events (#32343)
    * feat: v8 14.6, fix require(esm), libuv compat (#32347)
    * refactor(ext/node): `assert` get error source using V8 API (#32339)
    * fix(ext/node): provide CJS globals in worker_threads eval mode (#32266)
    * fix(node/vm): support vm.constants.DONT_CONTEXTIFY in createContext (#32337)
    * fix: deflake run_watch_env_file_with_multiline_values (#32346)
    * chore: upgrade rustyline to 17.0 and nix to 0.30 (#32344)
    * fix(lsp): tsgo typings for bytes/text imports (#32333)
    * fix(install): do not panic if lockfile incorrectly says package has a bin (#32345)
    * fix(install): global install should not warn about using node_modules dir for npm specifiers (#32341)
    * Revert "fix(ext/node): implement `after`, `afterEach`, `before`, and … (#32340)
    * refactor: add clippy rule for using `sys_traits::EnvCurrentDir::env_current_dir` (#32328)
    * ci: use s3 sync command for glob uploads (#32338)
    * chore: fix duplicate words in source comments (#32314)
    * ci: upload assets to S3 (#32335)
    * fix(ext/node): rename conflict callback field typo (#32306)
    * fix(ext/node): implement `after`, `afterEach`, `before`, and `beforeEach` of `node:test`  (#32320)
    * fix(node/buffer): fix base64 decoding for strings with hyphens (#32298)
    * 2.7.1 (#32322)
    * ci: fix script for release builds (#32321)
    * chore(jupyter): upgrade jupyter protocol dependencies (#32313)
  - Update to version 2.7.1:
    * This is a maintenance release to fix wrong output of deno --version in
    v2.7.0.
  - Update to version 2.7.0:
    * feat(audit): add --ignore flag to filter advisories by CVE ID (#32221)
    * feat(check): add --check-js flag (#32235)
    * feat(cli): add --save-exact/--exact flag to deno add and install
    (#31977)
    * feat(cli): add deno create command (#32225)
    * feat(compile): add --self-extracting flag (#32227)
    * feat(config): support include and exclude in deploy config (#32254)
    * feat(ext/bundle): Add --keep-names flag (#32285)
    * feat(ext/web): add brotli support to CompressionStream and
    * DecompressionStream (#32028)
    * feat(fmt): add --fail-fast flag to deno fmt --check (#31438)
    * feat(fs): add tryLock(exclusive?: boolean): Promise to FsFile
    (#31848)
    * feat(install): support --node-modules-dir for -g and use a manual
    * node_modules dir for installing npm: specifiers (#32302)
    * feat(task): turn off failglob by default (#32223)
    * feat(unstable): add Deno.spawn(), Deno.spawnAndWait{Sync}() (#32238)
    * feat(upgrade): cache downloaded binaries (#32187)
    * feat: deno create jsr:<package> and deno init --jsr <package> (#32229)
    * feat: add navigator.platform (#30795)
    * feat: npm overrides (#32073)
    * feat: stabilize Temporal API (#31928)
    * fix(audit): gracefully handle malformed response (#32234)
    * fix(audit): properly handle npm registries in subpaths (#32164)
    * fix(bundle): let esbuild handle data urls (#32213)
    * fix(ci): use noble apt repo for LLVM 21 packages (#32241)
    * fix(ext/node): createServer().listen().address() returns port 0 (#32248)
    * fix(ext/node): util.parseEnv and process.loadEnvFile compatibility
    (#32183)
    * fix(ext/node): add host_arch to process.config.variables (#32265)
    * fix(ext/node): add openAsBlob export to node:fs (#32261)
    * fix(ext/node): add missing process.constrainedMemory() API (#32209)
    * fix(ext/node): enable test-stdio-closed tests (#32237)
    * fix(ext/node): enable test-zlib-invalid-input-memory and test-zlib-un…
    (#32284)
    * fix(ext/node): handle shell redirections in child_process exec (#32087)
    * fix(ext/node): implement timeout and killSignal for spawn() (#32283)
    * fix(ext/node): improve process event handling and add missing APIs (#32200)
    * fix(ext/node): preserve streaming body on stale keepalive retry (#32215)
    * fix(ext/node): remove fs.promises.fstat, not a public Node.js API (#32289)
    * fix(ext/node): support URL in child_process.fork modulePath (#32268)
    * fix(ext/node): support ipv6 host in node:http (#32258)
    * fix(install): support --allow-scripts with deno install -g --compile ...
    (#32249)
    * fix(lsp): implement remaining tsgo resolver callbacks (#32303)
    * fix(lsp): qualify diagnostic source and message from tsgo (#32251)
    * fix(lsp): typescript-go basic resolution (#32016)
    * fix(node): preserve AsyncLocalStorage context in unhandledRejection handlers
    (#32264)
    * fix(node/buffer): fix latin1Slice and hexSlice returning wrong results
    (#32277)
    * fix(permissions): allow /proc/pressure/* files with --allow-read (#30780)
    * fix: deno install --force --compile (#32242)
    * fix: detect bound require reexports in cjs analysis (#32163)
    * fix: format wasm stack traces correctly, preserve context in unhandled
    * rejection, improve cppgc inheritance perf (#32293)
    * fix: format wasm stack traces per W3C spec (#32246)
  - Refresh deno-disable-lto.patch

++++ dhcp:

  - Update to version 4.4.3-P1:
    * Corrected reference count leak in leasequery packets (CVE-2022-2928).
    * Corrected memory leak in FQDN option unpacking (CVE-2022-2929).
    * Added OMAPI timed function calls.
    * Updated BIND libraries to version 9.11.36.
    * Added support for DHCPv4 option v6-only-preferred (RFC 8925).
  - Drop obsolete patches already included in version 4.4.3-P1:
    * dhcp-CVE-2022-2928.patch
    * dhcp-CVE-2022-2929.patch
  - Refresh patches:
    * 0009-dhcp-4.2.6-close-on-exec.patch
    * 0015-Expose-next-server-DHCPv4-option-to-dhclient-script.patch
    * 0016-infiniband-support.patch

++++ diffoscope:

  - update to 322:
    * Add a local version of the (deprecated) os.path.commonprefix
    method.
    * Fix compatibility with Ocaml 5.4.1.
    * Support androguard 4 and previous versions. Thanks, linsui!
    * Use --long-form arguments when calling apktool in order to
    support apktool version 3.
    * Improve header detection for Sphinx documentation projects.

++++ drawy:

  - Add patch:
    * 0001-Define-soversion-for-drawyconfig.patch

++++ editorconfig-checker:

  - Update to version 3.8.0:
    * Features
  - exclude .gpg files (#571) (e5b53f4)
    * Bug Fixes
  - anchor node_modules and target default excludes at path start
    (#568) (c0c39af)
  - honor -no-color for .ecrc deprecation warning (#575)
    (dbb0dbb)
    * Dependencies
  - chore(deps): bump actions/checkout from 6 to 7 (#573)
  - chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
    (#566)
  - chore(deps): bump codecov/codecov-action from 6 to 7 (#565)

++++ eksctl:

  - Update to version 0.228.0:
    * Features
  - feat: add support for controlPlaneEgressMode (#8770)
    * Dependencies
  - Bump github.com/aws/aws-sdk-go-v2/service/cloudformation from
    1.71.7 to 1.71.11 (#8734)
  - Bump
    github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider
    from 1.57.7 to 1.60.2 (#8735)
  - Bump github.com/aws/aws-sdk-go-v2/service/iam from 1.53.4 to
    1.53.9 (#8737)
  - Bump github.com/fatih/color from 1.18.0 to 1.19.0 (#8739)
  - Bump github.com/aws/aws-sdk-go-v2/service/outposts from
    1.57.13 to 1.59.2 (#8740)
  - Bump github.com/maxbrunsfeld/counterfeiter/v6 from 6.12.0 to
    6.12.2 (#8741)

++++ espresso:

  - update to 5.0.1:
    * The Lees-Edwards shear velocity is now properly handled in
    the simulation engine (#5282).
    * Electrokinetics unit conversion was fixed (#5304). This
    required introducing a new parameter `tau` to `EKNone` and
    `EKFFT`. In previous ESPResSo releases,
    the `tau` parameter was factored into the `prefactor`
    argument.
    * EK node and slice getters now return the imposed value for
    nodes with boundary conditions (#5327).
    * EK GPU and EK CPU objects can no longer be mixed in the same
    EK container (#5327).
    * Dihedral bonds checkpointing was fixed (#5279). A regression
    introduced in 5.0.0 prevented the checkpointing mechanism from
    reloading dihedral bo.
    * Interpolation-based constraints built from a grid now
    properly check the input grid is larger than the simulation box
    * A few missing feature checks were added to particle property
    setters and thermostat setters (#5320).
    * Features in the `myconfig.hpp` file are now evaluated
    transitively (#5297).
    * All ESPResSo versions since 4.0.0 would only activate implied
    features up to one degree of separation, leading to inconsistent
    feature activation.
    * For example, if feature A is requested in `myconfig.hpp`, and
    A depends on B, and B depends on C, only A and B would be
    activated. This issue can be encountered when a small number
    of high-level features are enabled in `myconfig.hpp`, for
    example requesting magnetodynamics would
    activate dipoles but not rotation, preventing ESPResSo from
    being compiled.
    * The Lees-Edwards boundary conditions restriction was lifted
    from the cluster analysis function (#4965).
    * The ELC error formula now follows the original paper and
    allows for ELC and ELCIC to tune to slightly larger summation
    limits
    * The Electrokinetics `EKNone` solver is now available on the
    GPU (#5304).

++++ fcitx5-table-other:

  - update to 5.1.7:
    * translation update

++++ firefox-esr:

  - Reformat the patch against current Firefox ESR 140.12.0 and add
    it as Patch28 to the .spec file.

++++ fleet-cli:

  - Update to version 0.15.4:
    * Bump x/net to v0.55 and x/crypto to v0.52 (#5355)
    * [v0.15] Do not update secret type when cloning downstream
    secrets (#5300)
    * Warn when Helm credentials are set but helmRepoURLRegex is
    empty (#5316) (#5332)
    * Update Kubernetes dependencies (#5323)
    * [v0.15] Consolidate Go modules into root go.mod (#5328)
    * Fix cloner when using tags in revision. (#5292) (#5317)
    * Dispatch release charts updates

++++ frei0r-plugins:

  - Update to version 3.2.3:
    + fix(ising0r): Use '(int8_t) rather than (char) so we get a
    defined signedness

++++ frescobaldi:

  - update to 4.0.7:
    * macOS packages are available again. Many thanks to @walkymatt
    for providing the new Apple certificate!
    * macOS: PyQt version downgraded to 6.9 to avoid the crash
    discussed in #2160
    * Reduce link cache memory usage
    * Some performance optimizations have been added in version
    1.0.5 of qpageview, which is bundled in the Windows and macOS
    packages.

++++ fresh-editor:

  - Update to version 0.4.2:
    * see https://github.com/sinelaw/fresh/releases/tag/v0.4.2

++++ gdk-pixbuf:

  - Update to version 2.44.7:
    + xpm: Fix loading the xpm module if built-in
    + glycin:
  - Fix the build on 32bit
  - Use fwrite to avoid problems with saving
  - Add signature for webp
  - Make filename tricks work in pid namespaces
    + Updated translations.

++++ gemini-cli:

  - update to 0.49.0:
    * ci(dependabot): enable cooldown period for npm packages
    * refactor(core): standardize tool output formatting
    * ci: update workflow logging and policy configurations
    * fix(core): Ensure zero-quota limits fail fast to prevent
    retry loop hang
    * fix(core): handle multi-line escaped quotes in
    stripShellWrapper
    * fix(cli): prevent path traversal vulnerabilities during skill
    install…
    * Fix/pending tools and trust overrides
    * ci: use internal environment for scheduled nightly releases
    * feat(core): Support GDC air-gapped Service Identity after
    auth library update
    * fix(cli): handle tmux false positive background detection
    * Add static eval source analyzer
    * fix(config): migrate coreTools setting to tools.core
    * fix(core-tools): resolve defensive path resolution for at-
    reference files
    * Revert "fix(core-tools): resolve defensive path resolution
    for at-reference files"
    * chore(release): bump version to
    0.49.0-nightly.20260617.g4d3dcdce1
    * fix(ci): provide fallbacks for package variables in nightly
    release
    * chore(deps): pin dependencies and enforce 14-day update
    cooldown
    * fix(ci): append trailing slash to registry url in npmrc
    * feat: add eval:inventory CLI command and reporting logic
    * fix: resolve workspace publish failures and scheduler event
    loop starvation
    * fix(ci): use wombat dressing room fallback in nightly release
    to prevent ENEEDAUTH
    * Add JSON output for eval inventory

++++ gmic:

  - Disable krita plugin on ppc64le and gimp plugin on s390x
    due to missing dependencies

++++ gitlab-container-registry:

  - Update to version 4.40.2:
    * Bug Fixes
  - driver/s3-v2: make retry delayer stateless (e927a39)
  - driver/s3-v2: strip request checksum and inject content-md5
    when checksum_disabled (71ff9d7)
  - handlers: defer router init until metadata DB resolves
    prefer-fallback (685b376)
  - s3: fix panic in Stat() call (5bcb779)
    * Build
  - deps: update module github.com/alicebob/miniredis/v2 to
    v2.38.0 (5bbd451)
  - deps: update module github.com/aws/aws-sdk-go-v2/config to
    v1.32.17 (54cfdf1)
  - deps: update module github.com/aws/aws-sdk-go-v2/config to
    v1.32.20 (ae32dec)
  - deps: update module github.com/aws/aws-sdk-go-v2/config to
    v1.32.25 (0dc8ad4)
  - deps: update module github.com/aws/aws-sdk-go-v2/credentials
    to v1.19.16 (5fdc189)
  - deps: update module github.com/aws/aws-sdk-go-v2/credentials
    to v1.19.24 (15b7b82)
  - deps: update module
    github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign to
    v1.10.0 (5c608ed)
  - deps: update module
    github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign to
    v1.11.0 (a2cd23b)
  - deps: update module
    github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign to
    v1.11.4 (b2af8ef)
  - deps: update module
    github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign to
    v1.11.6 (a0042d4)
  - upgrade golang.org/x/crypto to v0.53.0 (3e422ec)
  - upgrade to Go 1.25 (cc3c39a)

++++ glibmm2:

  - Update to version 2.88.1:
    + Documentation:
  - NMake Makefiles: Update build info again
  - README.win32.md: Update info and use UNIX line endings
    + gmmproc:
  - Add mmgir, which generates .defs files from GIR files
    generated by GObject-introspection
  - Add scripts that generate .defs files with mmgir
  - Small fixes here and there to adapt to .defs files generated
    by mmgir
  - mmgir: Fix compiling parse_gir.cc on Windows
  - Improve detection of enum and flags in documentation
    + Build:
  - Meson build:
    . Add the build-mmgir option
    . Ignore C4018 warnings
  - Autotools build: Distribute tools/mmgir
  - NMake Makefiles:
    . More consolidations
    . Update gmmproc install location
    . Build the mmgir tool if requested
    . Build generate_defs_[glib|gio]
  - Changes from version 2.88.0:
    + lib: Markup::ParseContext: Add get_offset() and get_tag_start()
    + Gio: Application: Handle empty description in
    add_main_option_entry().
    + Documentation:
  - Gio::File: Note where g_free() shall be called.
  - README.win32.md: Mention Visual Studio 2026, update build
    info
    + gmmproc:
  - tools/defs_gen/docextract: Improve extraction of enum
    enumerators. Fix the case when no enumerator is documented
    the old way in the enum block.
  - tools/defs_gen/enumextract.py, h2def.py: Ignore
    G_GNUC_FLAG_ENUM before the name of an enum definition.
    + Build:
  - Require glib >= 2.87.3
  - Meson build:
    . Don't require the 'dot' command when creating documentation
    with Doxygen.
    . Meson build: Make Visual Studio 2026 builds distinct
  - NMake Makefiles:
    . Make Visual Studio 2026 builds distinct
    . Reorganize, fix, and clean up a bit
    . Make m4 detection more flexible and robust
  - Make build process more robust

++++ glibmm2_4:

  - Update to version 2.66.9:
    + Documentation:
  - Remove obsolete FSF (Free Software Foundation) address
  - README.win32.md: Mention Visual Studio 2026, update build
    info
  - NMake Makefiles: Update build info again
    + Build:
  - Meson build: Make Visual Studio 2026 builds distinct
  - NMake Makefiles:
    . Make Visual Studio 2026 builds distinct
    . Reorganize, fix, and clean up a bit
    . Make m4 detection more flexible and robust
    . Make build process more robust
    . More consolidations
    . Update gmmproc install location
    . NMake Makefiles: Build generate_defs_[glib|gio]
  - Meson build: Don't require the 'dot' command when creating
    documentation with Doxygen.

++++ govc:

  - Update to version 0.55.0:
    * Fix
  - [13f9067] copy extra config when cloning a VM
    * Documentation
  - [4da5966] update CHANGELOG.md (#4024) (#4024)
    * Chore
  - [cb2d98b] Update version.go for v0.55.0
  - [ea4feab] sync ClientVersion with current release
  - [6c9b236] bump ClientVersion
  - [c6ee784] build govc release with Go 1.26
  - [4ddffe5] fix use of GOPATH in govc tests
  - [123588d] remove Debug on Failure from github workflow
  - [3a283ef] bump go.mod min go version to 1.25
  - [0f9c1c3] remove hardcoded go version from module cache key
  - [a03fbdf] bump github action Go versions
    * Commits
  - [cb2d98b] chore: Update version.go for v0.55.0
  - [ea4feab] chore: sync ClientVersion with current release
  - [6c9b236] chore: bump ClientVersion
  - [1584f58] chore(deps): bump actions/cache from 5.0.5 to 6.0.0
    (#4053) (#4053)
  - [8bf4e2f] chore(deps): bump actions/setup-go from 6.4.0 to
    6.5.0 (#4054) (#4054)
  - [357e439] Make VirtualDevice.NumaNode a pointer to allow node
    0
  - [078f795] chore(deps): bump nokogiri from 1.19.3 to 1.19.4 in
    /gen (#4050) (#4050)
  - [188b1f0] api: add InsufficientResourcesQuota fault type
  - [66288bb] fix(cns): restrict host-local storage tests to
    vCenter 9.1.2 and above
  - [93bcd23] Merge branch 'vmware:main' into main
  - [d80eb53] feat(cns): add host-local storage support to
    CnsVolumeCreateSpec and placement result
  - [13f9067] fix: copy extra config when cloning a VM
  - [dec970d] feat(namespace): added new structs and api
    endpoints to manage NamespaceManagement Networks
    Signed-off-by: tobiaswaelti <tobiaswaelti92@gmail.com>
  - [4cb54df] vcsim: respect tag name for setCustomValueResponse
  - [f1304a7] vcsim: support availableField retrieval in
    VirtualMachine
  - [9f9c5d3] vcsim: support parsing both xs: and xsd: type
    prefixes
  - [0a2f905] vcsim: handle invalid folder during VM cloning
  - [231bc17] chore(deps): bump golang.org/x/text from 0.34.0 to
    0.38.0 (#4037) (#4037)
  - [9252dc6] simulator: add SubnetId and SubnetInfo support
  - [9dabce8] chore(deps): bump test-unit from 3.7.7 to 3.7.8 in
    /gen (#4034) (#4034)
  - [64b9cf7] vapi/library: tolerate spaces around '=' in
    ReadManifest (#3893)
  - [98b424c] update comments
  - [dd81e2e] add new func and unit tests
  - [2870444] Address review comments
  - [e6bd854] Add govc Relocate Volume command Signed-off-by:
    Chethan Venkatesh <chethanv@vmware.com>
  - [6bbd47f] simulator: improve podman compatibility for
    container-backed VMs (#4014) (#4014)
  - [a1be2fc] simulator: add PropertyDiff, Context helpers, and
    AutoUpdate pattern (#4013) (#4013)
  - [64e90e7] vcsim: align interval counter on inventory load
  - [821585c] govmomi: Add HostDistributedVirtualSwitchManager mo
  - [fca539c] fix case-sensitive api call
  - [c6ee784] chore: build govc release with Go 1.26
  - [4da5966] docs: update CHANGELOG.md (#4024) (#4024)
  - [d2c4a46] chore(deps): bump dessant/lock-threads from 6.0.1
    to 6.0.2 (#4023) (#4023)
  - [cdc568f] chore(deps): bump dessant/lock-threads from 6.0.0
    to 6.0.1 (#4019) (#4019)
  - [60f3931] chore(deps): bump actions/stale from 10.2.0 to
    10.3.0 (#4020) (#4020)
  - [050c58c] chore(deps): bump goreleaser/goreleaser-action from
    7.2.1 to 7.2.2 (#4018) (#4018)
  - [4ddffe5] chore: fix use of GOPATH in govc tests
  - [48ab34a] api: add ConcurrentAccess to IsTransientError
    (#4017)
  - [123588d] chore: remove Debug on Failure from github workflow
  - [3a283ef] chore: bump go.mod min go version to 1.25
  - [32417d1] vcsim: fix namespace compatibility routes
  - [95c5995] test: fix secure cookie test with Go 1.26
  - [957a45d] Merge branch 'vmware:main' into main
  - [681c59b] feat(VmServiceSpec): Remove omitempty from
    VmServiceSpec spec to have it always rendered Signed-off-by:
    tribock <louis.baumann93@gmail.com>
  - [0f9c1c3] chore: remove hardcoded go version from module
    cache key
  - [a03fbdf] chore: bump github action Go versions

++++ grype:

  - Update to version 0.115.0:
    * Added Features
  - emit golang.org/x/net vulns from govlundb [PR #3534
    @willmurphyscode]
  - Merge Go vuln matches with GHSA matches [Issue #3515]
    * Bug Fixes
  - only emit records for stdlib [PR #3527 @willmurphyscode]
  - mark hummingbird distro as rolling [PR #3521
    @willmurphyscode]
  - disable go stdlib CPE matching by default [PR #3517
    @willmurphyscode]
  - merge in custom ranges when applicable [PR #3514
    @willmurphyscode]
  - exclude linux-kbuild deb indirect matches by default [PR
    [#3506] @westonsteimel]
  - avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
  - Support reading CycloneDX 1.7 SBOMs [Issue #3373]
  - Grype cannot read mariadb version correctly [Issue #3452]
  - grype hangs when downloading certain images using registry
    client [Issue #3492]
  - Can we get a fix for these Critical findings reported for
    grype [Issue #3484]
    * Additional Changes
  - Security: bump golang.org/x/crypto to v0.52.0 to resolve
    multiple CVEs [Issue #3493]
  - Security: bump golang.org/x/net to v0.55.0 to resolve CVEs
    [Issue #3494]
    * Dependencies
  - 35 dependency changes (31 updated, 3 added, 1 removed). 5
    vulnerabilities remediated.
    * Remediated (5)
  - GHSA-33vj-92qq-66hc (High) —
    github.com/containerd/containerd/v2
  - GHSA-cvxm-645q-p574 (Medium) —
    github.com/containerd/containerd/v2
  - GHSA-jpcc-p29g-p8mq (Medium) —
    github.com/containerd/containerd/v2
  - GHSA-rgh6-rfwx-v388 (High) —
    github.com/containerd/containerd/v2
  - GHSA-xhf5-7wjv-pqxp (High) —
    github.com/containerd/containerd/v2
    * Updated (31 packages)
  - github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
  - github.com/anchore/bubbly v0.2.0 → v0.2.1
  - github.com/anchore/clio v0.1.0 → v0.1.1
  - github.com/anchore/fangs v0.1.0 → v0.1.1
  - github.com/anchore/go-collections v0.1.0 → v0.1.1
  - github.com/anchore/go-homedir v0.1.0 → v0.1.1
  - github.com/anchore/go-logger v0.1.0 → v0.1.1
  - github.com/anchore/go-lzo v0.1.0 → v0.1.1
  - github.com/anchore/go-macholibre v0.1.0 → v0.1.1
  - github.com/anchore/go-make v0.5.0 → v0.8.0
  - github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
  - github.com/anchore/go-sync v0.1.0 → v0.1.1
  - github.com/anchore/stereoscope v0.2.1 → v0.2.2
  - github.com/anchore/syft v1.45.1 → v1.46.0
  - github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
  - github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
  - github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
  - github.com/containerd/containerd/v2 v2.3.1 → v2.3.2
    (remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574,
    GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388,
    GHSA-xhf5-7wjv-pqxp)
  - github.com/docker/cli v29.4.3+incompatible →
    v29.5.3+incompatible
  - github.com/google/go-containerregistry v0.21.6 → v0.21.7
  - github.com/mattn/go-runewidth v0.0.19 → v0.0.21
  - github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
  - github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
  - golang.org/x/crypto v0.52.0 → v0.53.0
  - golang.org/x/mod v0.36.0 → v0.37.0
  - golang.org/x/net v0.55.0 → v0.56.0
  - golang.org/x/sync v0.20.0 → v0.21.0
  - golang.org/x/sys v0.45.0 → v0.46.0
  - golang.org/x/term v0.43.0 → v0.44.0
  - golang.org/x/text v0.37.0 → v0.38.0
  - golang.org/x/tools v0.45.0 → v0.46.0
    * Added (3 packages)
  - github.com/piprate/json-gold v0.7.0
  - github.com/pquerna/cachecontrol v0.0.0-1555304
  - github.com/tailscale/hujson v0.0.0-ecc657c
    * Removed (1 package)
  - github.com/google/osv-scanner v1.9.2

++++ hauler:

  - update to 2.0.1 (bsc#1269433, CVE-2026-48702):
    * bump go to 1.26.4 to squash CVE noise
    * Full v2 Release notes: https://github.com/hauler-
    dev/hauler/releases/tag/v2.0.0
  - update to 2.0.0:
    * `v2.0.0` is a **major** release. It replaces Hauler's entire
    OCI plumbing... the ORAS v1 dependency and the in-house
    cosign fork with a native containerd based implementation,
    drops the deprecated `v1alpha1` API, and layers on a
    meaningful set of new capabilities and reliability fixes on
    top of that new foundation.
    * **Removed the ORAS v1 dependency** - push/pull is now driven
    directly by containerd's docker resolver and `google/go-
    containerregistry`, new `pkg/content/registry.go`
    (`RegistryTarget`) and `pkg/content/types.go` (`Target`
    interface, `IoContentWriter`) replaces what ORAS used to own.
    * **Removed the hauler-maintained cosign fork** - `pkg/cosign`
    is now a thin verify only wrapper around upstream
    `sigstore/cosign/v3`. Images are added through a native
    `s.AddImage()` path in `pkg/store`
    * **Added OCI 1.1 Referrers support** - signatures,
    attestations, and SBOMs are discovered both via the classic
    cosign tag convention (`sha256-.sig` / `.att` / `.sbom`) and
    the modern Referrers API, then correctly through the OCI
    layout

++++ hcloud-cli:

  - Update to version 1.66.0:
    * Datacenters commands are now deprecated
  - The hcloud datacenters list and hcloud datacenters describe
    commands are now deprecated.
    The endpoints GET /v1/datacenters and GET
    /v1/datacenters/{id} are now deprecated and will be removed
    after 1 Oct. 2026. After this date, requests to these
    endpoints will return HTTP 410 Gone.
    See the changelog for more details.
    https://docs.hetzner.cloud/changelog#2026-06-02-datacenters-deprecated
    * Features
  - deprecate hcloud datacenters ... commands (#1436)
    * Bug Fixes
  - cmd: Change tense for deletion of active context (#1412)
    * Dependencies
  - deps: update codecov/codecov-action action to v7 (#1440)
  - deps: update module github.com/hetznercloud/hcloud-go/v2 to
    v2.44.0 (#1437)
  - deps: update module github.com/jedib0t/go-pretty/v6 to v6.8.1
    (#1424)
  - deps: update golang.org/x/ (#1430)
  - deps: update module github.com/hetznercloud/hcloud-go/v2 to
    v2.43.0 (#1432)
  - deps: update dependency go to v1.26.4 (#1429)

++++ hugo:

  - update to 0.163.3:
    * markup/highlight: Escape lang in default code block rendering
    ce1a7e0b @bep thanks to @k0ngj1 for reporting this issue.
    * parser/pageparser: Preserve non-ASCII whitespace after e.g.
    summary divider 70a9068a @bep
    * resources: Support babel/postcss config variants 9d66d513
    @jmooring #15039 #15040 #15043
    * hugolib: Fix page/section name collision regression f0133466
    @jmooring #15046
  - update to 0.163.2:
    * Continue resolving on ERR_ACCESS_DENIED in Node's resolver
    134674f0 @bep #15041
    * markup: Standardize behavior when external converters are
    missing 147f605f @jmooring #14222

++++ istioctl:

  - update to 1.30.2:
    https://istio.io/latest/news/releases/1.30.x/announcing-1.30.2/
    No istioctl-related changes
    Security updates
    https://istio.io/latest/news/security/istio-security-2026-005/
    Envoy CVEs
    * GHSA-p7c7-7c47-pwch: (CVSS score 7.5): Fixed a
    denial-of-service vulnerability in the HTTP/3 stack via QPACK
    blocked decoding. When a QPACK header block was blocked waiting
    for dynamic table updates, the HEADERS payload bytes were
    released from QUIC receive-flow-control accounting while still
    retained in an internal decoder heap buffer, allowing a remote
    attacker to drive unbounded memory growth and trigger an
    out-of-memory condition.
    * CVE-2026-47692: (CVSS score 4.8): Fixed a bug where passthrough
    TLVs combined with added TLVs could exceed the maximum length,
    resulting in a mismatch between the size reported in the header
    and the number of bytes written. This could allow a smuggled
    request from the host writing the PROXY protocol header to the
    upstream host.
    * CVE-2026-47207: (CVSS score 6.5): Fixed a bug where the
    ext_proc server sends unexpected ProcessingResponses to Envoy.
    * CVE-2026-47205: (CVSS score 5.9): Fixed a use-after-free crash
    in the ext_authz filter when per-route service overrides are
    active and the downstream connection resets during an in-flight
    authorization check.
    * CVE-2026-47220: (CVSS score 7.5): Fixed a crash bug in the
    %REQUESTED_SERVER_NAME% formatter where the host or original
    host is not set correctly but the formatter is configured to
    access the host value.
    * CVE-2026-47221: (CVSS score 5.9): Fixed an issue when handling
    HTTP 303 internal redirects for body-less requests. The
    redirect handling code attempted to drain a request body buffer
    that was never allocated, causing a segmentation fault.
    * CVE-2026-48044: (CVSS score 7.5): Fixed a memory exhaustion
    vulnerability in the Zstd decompressor where the
    MaxInflateRatio limit was only checked after each input slice
    was fully processed, allowing a maliciously crafted compressed
    payload to expand to hundreds of MB within a single process()
    call. The inflate ratio limit is now enforced inside the inner
    decompression loop, matching the gzip and brotli decompressors
    and aborting decompression as soon as the threshold is
    breached.
    * CVE-2026-48090: (CVSS score 5.9): Fixed a bug where the
    asynchronous token change callback could be triggered after the
    filter had been torn down (onDestroy() had been called), which
    could lead to accessing dangling pointers and result in
    UAF/crash.
    * CVE-2026-47778: (CVSS score 4.4): Fixed an issue where Envoy
    could fail to validate the Subject Alternative Name (SAN) of a
    peer certificate if the SAN contained an embedded NUL byte.
    Previously, the SAN parsing was vulnerable to NUL byte
    truncation in some configurations, potentially leading to
    incorrect trust decisions.
    * CVE-2026-47204: (CVSS score 6.5): Fixed a crash or
    use-after-free when gRPC stats filter performs stat tracking on
    a direct response route.
    * CVE-2026-48497: (CVSS score 5.9): Fixed sanity checking of the
    query name length to avoid abnormal process termination. Use
    ENVOY_BUG in case the sanity check fails.
    * CVE-2026-48706: (CVSS score 5.9): Fixed a TcpStatsdSink buffer
    overflow issue with a large stats name.
    * CVE-2026-48743: (CVSS score 7.5): Fixed HTTP/3 headers-only
    request and response content-length validation and reset stream
    if inconsistent. The change is guarded by runtime guard
    envoy.reloadable_features.quic_validate_headers_only_content_length.
    * CVE-2026-47775: (CVSS score 6.8): Addressed a padding oracle in
    the OAuth2 filter’s AES-256-CBC cookie decryption. The filter
    now supports AES-256-GCM encryption with a gcm. algorithm
    marker, which authenticates the ciphertext and removes the
    oracle.
    * CVE-2026-48042: (CVSS score 7.5): Limited JSON nesting depth to
    1000. The limit could be relaxed to 10K by setting the
    envoy.reloadable_features.limit_json_parser_nesting_depth to
    false.

++++ jenkins-x-cli:

  - Update to version 3.17.25:
    * chore(deps): upgrade jenkins-x-plugins/jx-project to version
    0.2.89
  - Update to version 3.17.24:
    * chore(deps): upgrade jenkins-x-plugins/jx-preview to version
    0.7.12
  - Update to version 3.17.23:
    * chore(deps): upgrade jenkins-x-plugins/jx-verify to version
    0.3.21
  - Update to version 3.17.22:
    * chore(deps): upgrade jenkins-x-plugins/jx-promote to version
    0.6.42
  - Update to version 3.17.21:
    * chore(deps): upgrade jenkins-x-plugins/jx-admin to version
    0.3.29
  - Update to version 3.17.20:
    * chore(deps): upgrade jenkins-x-plugins/jx-pipeline to version
    0.7.40
  - Update to version 3.17.19:
    * Bug Fixes
  - update security policy (Mårten Svantesson)
  - Update to version 3.17.18:
    * deps: upgrade jenkins-x-plugins/jx-preview to version 0.7.11
    (jenkins-x-bot-test)

++++ jfrog-cli:

  - Update to version 2.111.0 (2.110.0 was not released):
    * New Features
  - [jfrog-cli] Added Post Failure Run support for poetry #3548
    (@Phavya-jfrog)
  - [jfrog-cli] Add timestamp suffix to UvBuildName for test
    isolation #3559 (@agrasth)
  - [jfrog-cli] Add timestamp suffix to Nix repos and build name
    for test isolation #3562 (@agrasth)
  - [jfrog-cli-artifactory] Add AI help coverage check to static
    analysis #490 (@ehl-jf)
  - [jfrog-cli-security] XRAY-138689 - Add Poetry support for jf
    ca #768 (@Phavya-jfrog)
    * Bug Fixes
  - [jfrog-cli] fix poetry publish command not respecting the
    repo flag #3547 (@reshmifrog)
  - [jfrog-cli] Fix/latest release for hf breaks cli #3560
    (@reshmifrog)
  - [jfrog-cli-artifactory] fix poetry publish command not
    respecting the repo flag #489 (@reshmifrog)
  - [jfrog-cli-core] Fix uncaught error in DownloadDependency
    [#1576] (@eranturgeman)
  - [jfrog-cli-security] Fix - Close log for Xray plugin #780
    (@attiasas)
  - [jfrog-cli-security] Fix cocoapods OOM #781 (@eranturgeman)
  - [jfrog-cli-security] XRAY-145623 - pip jf ca failure due to
    CVS #777 (@Phavya-jfrog)
    * Internal Changes
  - [jfrog-cli-security] Update dependencies #782 (@attiasas)
    * Other Changes
  - [jfrog-cli] common as default deployment size for artifactory
    [#3557] (@reshmifrog)
  - [jfrog-cli] RTECO-1411 Add agentplugins tests #3551
    (@udaykb2)
  - [jfrog-cli] RTECO-1074 - Remove redundant functions in agent
    namespace-1 #3566 (@udaykb2)
  - [jfrog-cli] RTECO-1074 - Remove redundant functions in agent
    namespace-2 #3567 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1074 - Remove redundant
    functions in agent namespace(1/2) #495 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1074 - Remove redundant
    functions in agent namespace-2 #498 (@udaykb2)

++++ libqxmpp:

  - Update to 1.16.1
    * New MUC implementation `QXmppMucManagerV2` with a modern, reactive,
    coroutine-based API (API not finalized yet)
    + Room joining with history options, join timeout and password support
    (XEP-0045 §7.2)
    + Message handling: `messageReceived` signal, `sendMessage()` with
    reflection matching and `sendPrivateMessage()`
    + Presence/state control: `setPresence()` (§7.7), `setNickname()`,
    `setSubject()` and `leave()` (§7.14)
    + `QXmppMucParticipant` handle with `participantJoined`/`Left` signals,
    nickname-change tracking and `selfParticipant()`
    + Roles and affiliations: `setRole()`, `setAffiliation()`,
    `requestAffiliationList()` and batch `setRoles()`/`setAffiliations()`
    (§8.5) via the new `QXmpp::Muc::Item` type
    + Reactive room properties (`QBindable`): permissions, description,
    language, contact JIDs, full `muc#roominfo` form and room type
    + Room creation, configuration and destruction (`QXmpp::Muc::Destroy`,
    §10.9) with config caching and `subscribeToRoomConfig()`
    + Kick/ban handling for status codes 301/307/321/332 with a typed
    `QXmpp::Muc::LeaveReason`
    + Mediated (§7.8.2) and direct (XEP-0249) invitations
    + Voice requests via `QXmppMucVoiceRequest` (§7.13/§8.6)
    + Reserved nickname discovery (§7.12) and room registration (§7.10)
    + Self-ping (XEP-0410), occupant ID (XEP-0421), unique room names
    (XEP-0307) and message activity indicator (XEP-0502)
    + Reactive avatar API and memory-safe shared-ownership handles
    + Add `muc_bot` example
    * Message: Add `hasSubject()`, `setSubject(std::optional<QString>)` and
    the `mucVoiceRequest()` accessor
    * DiscoveryManager: Add generic service discovery watch API
    (`QXmppDiscoServicesWatch`), used by the HTTP upload, MIX and MUC
    managers
    * MixManager: Remove ejabberd conference/text identity workaround
    * RosterManager: Implement roster versioning cache (XEP-0237 / RFC 6121
    §2.6)
    * RosterManager: Add method to update roster groups
    * Add dynamic XML extension support: `QXmpp::Xml::Element` generic element
    type, `Xml::Registry`/`Xml::Extensions` and stanza hooks
    * FileSharing: Make the `disposition` attribute optional and
    serialize QUrls percent-encoded
    * Logger: Pretty-print and ANSI-syntax-highlight XML debug output and style
    log headers with a colored type chip, direction arrows and timestamp
    * XmppSocket: Log received XML per complete stanza and skip whitespace
    pings
    * Migrate the API documentation from Doxygen to QDoc and enable
    documentation generation by default
    * Examples: Add OMEMO echo client example
    * OMEMO: Report encryption as failed when no recipient device
    (other than the own ones) could be encrypted for, instead of
    silently "succeeding"
    * OMEMO: Fix undecryptable messages by setting the 'kex'
    attribute based on the actual ciphertext message type instead
    of an application-level assumption
    + Stream: Fix dropped default namespace on incoming stanzas
    with Qt 6.12, which broke authentication, file transfers and
    stream parsing

++++ soundtouch:

  - update to 2.4.1:
    * Fix buffer overflow when processing >16 channels
    * fix: fix unused variables in DLMain
    * fix: fix warning for unused peaklevel in release mode

++++ libass:

  - Update to 0.17.5:
    * Fix limited OOB read and write in wrap_lines_measure
    * Fix OOB bit clears for negative Matroska ReadOrder fields
    * Fix \fay with glyph clusters
    * Fix small alpha changes not always splitting runs when combined with fade
    * Fades are now applied to BorderStyle=4 boxes too
    * Fonts using legacy arabic Windows charmaps are now supported
    * ass_render_frame no longer returns fully transparent images
    * Avoid SSE instructions if compiler baseline already includes AVX
  - Remove d013d97631bf86577e7eb44941b2b7b9cf4192d0.patch: included in
    upstream release

++++ libresidfp:

  - Updated to 1.1.1
    * https://github.com/libsidplayfp/libresidfp/releases/tag/v1.1.1

++++ mupdf:

  - Build against the system cmark-gfm library instead of the copy
    vendored in thirdparty/cmark-gfm, dropping the bundled(cmark-gfm)
    provides:
    * Add mupdf-system-cmark-gfm.patch to complete the upstream
    USE_SYSTEM_CMARK_GFM build path, which is incomplete in 1.28.0.

++++ python315-core:

  - Update to 3.15.0~b3:
  - Security
  - gh-151544: Modules/Setup.local is no longer used as
    a landmark to discover whether Python is running in
    a source tree, as it could potentially affect actual
    installs. The pybuilddir.txt file is now the sole indicator
    of running in a source tree.
  - gh-151159: Update macOS installer to use OpenSSL 3.5.7.
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error.
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - Core and Builtins
  - gh-151905: Fix OOM error handling in PyFrame_GetBack() to
    propagate exceptions instead of masking them as None.
  - gh-151722: Defer GC tracking of frozendict to end of
    construction. Patch by Donghee Na.
  - gh-151546: Fix the stack limit check if Python is linked to
    musl (ex: Alpine Linux). Use the stack size set by the
    linker to compute the stack limits. Patch by Victor
    Stinner.
  - gh-151510: Fix a crash in __lazy_import__() when called
    without an explicit globals argument and without a current
    Python frame.
  - gh-151461: Fix direct execution of files with invalid
    source encodings to report the underlying codec lookup or
    decoding error instead of the generic SyntaxError: encoding
    problem message. Patch by Bartosz Sławecki.
  - gh-151218: PyConfig_Set() and sys.set_int_max_str_digits()
    now replace sys.flags (create a new object), instead of
    modifying sys.flags in-place. Patch by Victor Stinner.
  - gh-151297: Fix an invalid pointer dereference that could
    occur when calling PyObject_Realloc() with a NULL pointer
    in free-threaded builds or with PYTHONMALLOC set to
    mimalloc.
  - gh-151253: If import encodings (first import) fails at
    Python startup, dump the Python path configuration to help
    users debugging their configuration. Patch by Victor
    Stinner.
  - gh-151238: Fix a crash when compiling a concatenated
    f-string or t-string if an error occurs when processing one
    of it’s parts.
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in: code compilation,
    _interpchannels module, _winapi.CreateProcess() function.
  - Now these places raise proper MemoryError errors.
  - gh-150902: Apply an existing optimization of
    PyCriticalSection (single mutex) to PyCriticalSection2:
    avoid acquiring the same locks that the current CS has
    already acquired.
  - gh-151065: Fix memory leak when using the mimalloc memory
    allocator.
  - gh-150988: Fix a reference leak in OSError when attributes
    are set before super().__init__().
  - gh-150723: Fix perf jitdump timestamps on macOS. Events
    were stamped using CLOCK_MONOTONIC, but macOS profilers
    timestamp their samples with mach_absolute_time(). The
    mismatch prevented the JIT code mappings from lining up
    with the samples, so no Python frame could be resolved.
  - gh-150723: Fix malformed perf jitdump thread ids on macOS.
    The thread_id field of the JR_CODE_LOAD record was written
    as a 64-bit value instead of the 32-bit value required by
    the jitdump format, which shifted every following field and
    prevented profilers from resolving Python frames.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149321: Do not support none as a lazy imports mode.
  - Library
  - gh-75666: Fix a reference leak in tkinter: the Tcl commands
    created for event callbacks are now deleted when a binding
    is replaced or unbound.
  - gh-151770: Fix datetime.datetime.fromisoformat() raising
    AssertionError instead of ValueError for an out-of-range
    month combined with a 24:00 time.
  - gh-151665: inspect.signature() now works on the lazy
    evaluators of type aliases and type parameters instead of
    raising ValueError.
  - gh-151695: Fix a use-after-free in the curses module. The
    encoding of the initial screen, used by curses.unctrl() and
    curses.ungetch() to encode non-ASCII characters, is now
    kept as a private copy instead of a borrowed pointer to
    a window object that may be deallocated.
  - gh-151436: Fix skewed stack trackes in the Tachyon profiler
    when caching is enabled and when generators and coroutines
    are profiled, by updating tstate->last_profiled_frame at
    every frame-removal site. The issue resulted in total
    erasure of some callers. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-151426: Fix impossible stack traces (callers and callees
    cross called, orphans and incorrect lines) in the Tachyon
    profiler when caching frames, by snapshotting the stack
    chunks before walking the frame chain on a cache miss.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-151403: Fixed a crash in subprocess.Popen (and
    _posixsubprocess.fork_exec) when an argv item’s
    __fspath__() concurrently mutates the args sequence being
    converted.
  - gh-151390: Colorize match in the REPL when followed by
    a unary + or - operator. Patch by Bartosz Sławecki.
  - gh-151126: Fix crash on unset MemoryError on allocation
    failure in ctypes.get_errno().
  - gh-151337: Avoid possible memory leak in tkinter.c on
    Windows.
  - gh-151126: Fix a crash when MemoryError in
    os._path_splitroot() was not set properly.
  - gh-149671: Restore compatibility with setuptools -nspkg.pth
    files in the site module. Inject sitedir variable in the
    frame which executes pth code. Patch by Victor Stinner.
  - gh-151295: Fixed a crash (use-after-free) in bytes.join()
    and bytearray.join() that could occur if an item’s
    __buffer__() concurrently mutates the sequence being
    joined. The mutation is now reported as a RuntimeError
    instead.
  - gh-109940: Fix Windows venv activation in cmd.exe to
    respect VIRTUAL_ENV_DISABLE_PROMPT.
  - gh-150771: Fix email messages created with shift_jis or
    euc-jp charsets. set_content() now stores the payload using
    the output charset (iso-2022-jp) so printing the message no
    longer raises UnicodeEncodeError.
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-151021: Fix mmap.mmap.find() and rfind() to return -1
    when searching for an empty subsequence with a start
    position past the end of the mapping.
  - gh-62825: Encodings “KS_C_5601-1987”, “KS X 1001”, etc are
    now aliases of “CP949” instead of “EUC-KR”.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150662: Fix the --gecko collector in profiling.sampling
    that kept every sample in memory. It now writes sample and
    marker data to temporary files and reads them back,
    ultimately building the output file at the end. Patch by
    Pablo Galindo and Maurycy Pawłowski-Wieroński.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-148932: Fix profiling.sampling on Windows virtual
    environments to resolve the actual Python PID from
    a virtual environment shim.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-53144: The email package now supports all aliases of
    Python codecs and uses MIME/IANA names for all IANA
    registered charsets.
  - gh-149891: Add support for more encoding aliases officially
    registered in IANA.
  - gh-149473: Calling os.environ.clear() now emits
    os._clearenv auditing event. Patch by Victor Stinner.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-143988: Fixed crashes in socket.socket.sendmsg() and
    socket.socket.recvmsg_into() that could occur if buffer
    sequences are concurrently mutated.
  - gh-120665: Fixed an issue where unittest loaders would load
    and instantiate unittest.TestCase-derived subclasses that
    are also abstract base classes, which can’t be
    instantiated.
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - gh-101267: When a worker process terminates unexpectedly,
    concurrent.futures.ProcessPoolExecutor now sets a separate
    BrokenProcessPool exception on each pending future instead
    of sharing a single instance among them all. Sharing one
    exception produced malformed tracebacks: each
    Future.result() call re-raised the same object, appending
    another copy of the traceback to it.
  - Documentation
  - gh-86726: Greatly expand the tkinter documentation to cover
    the full public API of the package and its submodules. The
    descriptions are oriented towards Python rather than
    Tcl/Tk, with corrected return types and
    versionadded/versionchanged information.
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-150966: Avoid prematurely terminating failing live
    sampling profiler test targets, which made stderr
    assertions flaky on ASAN buildbots.
  - gh-148853: Fix tests failing on FreeBSD in test.support’s
    in_systemd_nspawn_sync_suppressed() due to unreadable /run
    directory.
  - Build
  - gh-151163: Updated Android build to include SQLite version
    3.53.2.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-141510: Add frozendict to the fast paths of
    PyMapping_GetOptionalItem(), PyMapping_Keys(),
    PyMapping_Values(), and PyMapping_Items().
  - gh-123619: PyUnstable_Object_EnableDeferredRefcount() now
    returns 0 if the object is not tracked by the garbage
    collector: if gc.is_tracked() is false. Patch by Victor
    Stinner.
  - gh-149044: Improved error message when specifying non-type
    base classes in Py_tp_bases, Py_tp_base, and bases argument
    to PyType_FromMetaclass() and other PyType_From* functions.
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.

++++ python315-nogil-nogil-core:

  - Update to 3.15.0~b3:
  - Security
  - gh-151544: Modules/Setup.local is no longer used as
    a landmark to discover whether Python is running in
    a source tree, as it could potentially affect actual
    installs. The pybuilddir.txt file is now the sole indicator
    of running in a source tree.
  - gh-151159: Update macOS installer to use OpenSSL 3.5.7.
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error.
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - Core and Builtins
  - gh-151905: Fix OOM error handling in PyFrame_GetBack() to
    propagate exceptions instead of masking them as None.
  - gh-151722: Defer GC tracking of frozendict to end of
    construction. Patch by Donghee Na.
  - gh-151546: Fix the stack limit check if Python is linked to
    musl (ex: Alpine Linux). Use the stack size set by the
    linker to compute the stack limits. Patch by Victor
    Stinner.
  - gh-151510: Fix a crash in __lazy_import__() when called
    without an explicit globals argument and without a current
    Python frame.
  - gh-151461: Fix direct execution of files with invalid
    source encodings to report the underlying codec lookup or
    decoding error instead of the generic SyntaxError: encoding
    problem message. Patch by Bartosz Sławecki.
  - gh-151218: PyConfig_Set() and sys.set_int_max_str_digits()
    now replace sys.flags (create a new object), instead of
    modifying sys.flags in-place. Patch by Victor Stinner.
  - gh-151297: Fix an invalid pointer dereference that could
    occur when calling PyObject_Realloc() with a NULL pointer
    in free-threaded builds or with PYTHONMALLOC set to
    mimalloc.
  - gh-151253: If import encodings (first import) fails at
    Python startup, dump the Python path configuration to help
    users debugging their configuration. Patch by Victor
    Stinner.
  - gh-151238: Fix a crash when compiling a concatenated
    f-string or t-string if an error occurs when processing one
    of it’s parts.
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in: code compilation,
    _interpchannels module, _winapi.CreateProcess() function.
  - Now these places raise proper MemoryError errors.
  - gh-150902: Apply an existing optimization of
    PyCriticalSection (single mutex) to PyCriticalSection2:
    avoid acquiring the same locks that the current CS has
    already acquired.
  - gh-151065: Fix memory leak when using the mimalloc memory
    allocator.
  - gh-150988: Fix a reference leak in OSError when attributes
    are set before super().__init__().
  - gh-150723: Fix perf jitdump timestamps on macOS. Events
    were stamped using CLOCK_MONOTONIC, but macOS profilers
    timestamp their samples with mach_absolute_time(). The
    mismatch prevented the JIT code mappings from lining up
    with the samples, so no Python frame could be resolved.
  - gh-150723: Fix malformed perf jitdump thread ids on macOS.
    The thread_id field of the JR_CODE_LOAD record was written
    as a 64-bit value instead of the 32-bit value required by
    the jitdump format, which shifted every following field and
    prevented profilers from resolving Python frames.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149321: Do not support none as a lazy imports mode.
  - Library
  - gh-75666: Fix a reference leak in tkinter: the Tcl commands
    created for event callbacks are now deleted when a binding
    is replaced or unbound.
  - gh-151770: Fix datetime.datetime.fromisoformat() raising
    AssertionError instead of ValueError for an out-of-range
    month combined with a 24:00 time.
  - gh-151665: inspect.signature() now works on the lazy
    evaluators of type aliases and type parameters instead of
    raising ValueError.
  - gh-151695: Fix a use-after-free in the curses module. The
    encoding of the initial screen, used by curses.unctrl() and
    curses.ungetch() to encode non-ASCII characters, is now
    kept as a private copy instead of a borrowed pointer to
    a window object that may be deallocated.
  - gh-151436: Fix skewed stack trackes in the Tachyon profiler
    when caching is enabled and when generators and coroutines
    are profiled, by updating tstate->last_profiled_frame at
    every frame-removal site. The issue resulted in total
    erasure of some callers. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-151426: Fix impossible stack traces (callers and callees
    cross called, orphans and incorrect lines) in the Tachyon
    profiler when caching frames, by snapshotting the stack
    chunks before walking the frame chain on a cache miss.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-151403: Fixed a crash in subprocess.Popen (and
    _posixsubprocess.fork_exec) when an argv item’s
    __fspath__() concurrently mutates the args sequence being
    converted.
  - gh-151390: Colorize match in the REPL when followed by
    a unary + or - operator. Patch by Bartosz Sławecki.
  - gh-151126: Fix crash on unset MemoryError on allocation
    failure in ctypes.get_errno().
  - gh-151337: Avoid possible memory leak in tkinter.c on
    Windows.
  - gh-151126: Fix a crash when MemoryError in
    os._path_splitroot() was not set properly.
  - gh-149671: Restore compatibility with setuptools -nspkg.pth
    files in the site module. Inject sitedir variable in the
    frame which executes pth code. Patch by Victor Stinner.
  - gh-151295: Fixed a crash (use-after-free) in bytes.join()
    and bytearray.join() that could occur if an item’s
    __buffer__() concurrently mutates the sequence being
    joined. The mutation is now reported as a RuntimeError
    instead.
  - gh-109940: Fix Windows venv activation in cmd.exe to
    respect VIRTUAL_ENV_DISABLE_PROMPT.
  - gh-150771: Fix email messages created with shift_jis or
    euc-jp charsets. set_content() now stores the payload using
    the output charset (iso-2022-jp) so printing the message no
    longer raises UnicodeEncodeError.
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-151021: Fix mmap.mmap.find() and rfind() to return -1
    when searching for an empty subsequence with a start
    position past the end of the mapping.
  - gh-62825: Encodings “KS_C_5601-1987”, “KS X 1001”, etc are
    now aliases of “CP949” instead of “EUC-KR”.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150662: Fix the --gecko collector in profiling.sampling
    that kept every sample in memory. It now writes sample and
    marker data to temporary files and reads them back,
    ultimately building the output file at the end. Patch by
    Pablo Galindo and Maurycy Pawłowski-Wieroński.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-148932: Fix profiling.sampling on Windows virtual
    environments to resolve the actual Python PID from
    a virtual environment shim.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-53144: The email package now supports all aliases of
    Python codecs and uses MIME/IANA names for all IANA
    registered charsets.
  - gh-149891: Add support for more encoding aliases officially
    registered in IANA.
  - gh-149473: Calling os.environ.clear() now emits
    os._clearenv auditing event. Patch by Victor Stinner.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-143988: Fixed crashes in socket.socket.sendmsg() and
    socket.socket.recvmsg_into() that could occur if buffer
    sequences are concurrently mutated.
  - gh-120665: Fixed an issue where unittest loaders would load
    and instantiate unittest.TestCase-derived subclasses that
    are also abstract base classes, which can’t be
    instantiated.
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - gh-101267: When a worker process terminates unexpectedly,
    concurrent.futures.ProcessPoolExecutor now sets a separate
    BrokenProcessPool exception on each pending future instead
    of sharing a single instance among them all. Sharing one
    exception produced malformed tracebacks: each
    Future.result() call re-raised the same object, appending
    another copy of the traceback to it.
  - Documentation
  - gh-86726: Greatly expand the tkinter documentation to cover
    the full public API of the package and its submodules. The
    descriptions are oriented towards Python rather than
    Tcl/Tk, with corrected return types and
    versionadded/versionchanged information.
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-150966: Avoid prematurely terminating failing live
    sampling profiler test targets, which made stderr
    assertions flaky on ASAN buildbots.
  - gh-148853: Fix tests failing on FreeBSD in test.support’s
    in_systemd_nspawn_sync_suppressed() due to unreadable /run
    directory.
  - Build
  - gh-151163: Updated Android build to include SQLite version
    3.53.2.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-141510: Add frozendict to the fast paths of
    PyMapping_GetOptionalItem(), PyMapping_Keys(),
    PyMapping_Values(), and PyMapping_Items().
  - gh-123619: PyUnstable_Object_EnableDeferredRefcount() now
    returns 0 if the object is not tracked by the garbage
    collector: if gc.is_tracked() is false. Patch by Victor
    Stinner.
  - gh-149044: Improved error message when specifying non-type
    base classes in Py_tp_bases, Py_tp_base, and bases argument
    to PyType_FromMetaclass() and other PyType_From* functions.
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.

++++ taglib:

  - update to 2.3:
    * MP4: Support for chapters (Nero and QuickTime).
    * WAV: Support for BEXT and iXML chunks.
    * FLAC: Support for BEXT and iXML application blocks.
    * Opus: New audio property `outputGain()`.
    * Speed up Matroska reading by using seek head for element
    lookup.
    * Speed up Matroska writing by offering multiple write style
    modes.
    * More tolerant handling of files with oversized RIFF chunks,
    zero size ID3v2
    * frames and Matroska chapters without edition.
    * Avoid wrong content-based detection as MPEG files.
    * Fix bitrate calculations for MPEG ADTS and MP4 ESDS.
    * Fix data race with multi-threaded use of `MP4::ItemFactory`.
    * Fix unbounded recursion in EBML/Matroska `MasterElement` and
    MP4 atoms.
    * Limit number of MP4 atoms at top level.
    * Fix writing too many offsets when updating MP4 stco/co64
    atoms.
    * Fix k bounds in Shorten Rice-Golomb coding.

++++ taglib-tests:

  - update to 2.3:
    * MP4: Support for chapters (Nero and QuickTime).
    * WAV: Support for BEXT and iXML chunks.
    * FLAC: Support for BEXT and iXML application blocks.
    * Opus: New audio property `outputGain()`.
    * Speed up Matroska reading by using seek head for element
    lookup.
    * Speed up Matroska writing by offering multiple write style
    modes.
    * More tolerant handling of files with oversized RIFF chunks,
    zero size ID3v2
    * frames and Matroska chapters without edition.
    * Avoid wrong content-based detection as MPEG files.
    * Fix bitrate calculations for MPEG ADTS and MP4 ESDS.
    * Fix data race with multi-threaded use of `MP4::ItemFactory`.
    * Fix unbounded recursion in EBML/Matroska `MasterElement` and
    MP4 atoms.
    * Limit number of MP4 atoms at top level.
    * Fix writing too many offsets when updating MP4 stco/co64
    atoms.
    * Fix k bounds in Shorten Rice-Golomb coding.

++++ mesheryctl:

  - update to 1.0.49:
    * No CLI-related changes
  - update to 1.0.48:
    * General
  - Remove unused context handler methods @yi-nuo426 (#20267)
  - Refactor GetContext function documentation @yi-nuo426
    (#20266)
  - Remove unused methods from DefaultLocalProvider @yi-nuo426
    (#20268)
  - Remove commented-out Ping test code @yi-nuo426 (#20269)
  - Improve connection persistence logging and error handling
    @yi-nuo426 (#20270)
    * Meshery CLI
  - fix(mesheryctl): fix broken error handling in TestSetContext
    @Harishrs2006 (#19853)
    * Maintenance
  - ci: remove duplicate CodeQL Advanced workflow @MrDadhich456
    (#20248)
    * Documentation
  - Update overview.md @marblom007 (#20279)
  - [Docs] Sidebar TOC: render leaf pages with normal font weight
    @jamieplu (#20276)
  - Update overview.md @simihablo (#20277)
  - [Docs] TOC Sidebar uplift @jamieplu (#20275)
  - Fix v0.8 light/dark mode icon display @Katotodan (#20258)
  - update to 1.0.47:
    * General
    * Maintenance
  - Add Telemetry support with Grafana dashboards and Prometheus
    metrics @aabidsofi19 (#20161)
    * Documentation
  - [Docs] Update discussion forum link @iyush05 (#20235)
  - Add Telemetry support with Grafana dashboards and Prometheus
    metrics @aabidsofi19 (#20161)
  - [Docs] Align extension header icons across documentation
    pages @vedant21-ctr (#20255)
  - Create index.md @YASHMAHAKAL (#20254)
  - update to 1.0.46:
    * General
  - Update to Meshery Schemas v1.3.16 @jamieplu (#20247)
  - [Server] Fix duplicate ErrInvalidUUID causing "Error codes
    utility" CI failure @copilot-swe-agent[bot] (#20245)
  - feat(ui): release-scoped cache headers for the served UI
    @leecalcote (#20239)
  - [Server] fix(errors): dedupe ErrInvalidUUIDCode to unblock
    Error Codes Utility @leecalcote (#20240)
  - docs: add Bluesky social shield to README.md @KumarNirupam1
    (#20220)
  - fix(uuid): harden ignored UUID errors after the gofrs revert
    @ritzorama (#20181)
    * Maintenance
  - UI: Dependencies upgrades @leecalcote (#20238)
  - fix(install): repair broken provider-drift CI gate
    (check-install -> providers-check) + resync stale k8s
    manifest @ritzorama (#20182)
    * Documentation
  - Delete docs/meetings/2026/week-of-06-18-2026/pragalva.md
    @yi-nuo426 (#20246)
  - docs(production): cover CDN and edge caching of the served UI
    @leecalcote (#20243)
  - [Docs] fix: add missing extension icon before Kanvas title
    @smishraa30 (#20210)
  - [Docs] Remove extra empty column from Meshery Connections
    table @YASHMAHAKAL (#17994)
  - [Docs] Add Connection Wizard user and contributor guides
    @leecalcote (#20192)

++++ nelm:

  - Update to version 1.24.1:
    * Bug Fixes
  - don't hard-fail on unsupported env vars (7bc4769)
  - retry on webhooks unavailable error (#600) (ccde5a1)

++++ netavark:

  - Update to version 2.0.0:
    * This version is required for podman 6.0 and buildah 1.44
    and only supported to be used together with them
    * Removed iptables support
    * The bridge network driver now defaults to strict isolation mode;
    this means different networks can no longer talk to each by default.
    To restore the previous behavior the network must set
    the `isolate=false` option.
    * The macvlan network driver now use a default mtu of 99
    * Added network create support, podman now calls netavark create
    to create a network config.
    * The bridge network driver now supports the `outbound_addr4`
    and `outbound_addr6` options to specify the outgoing NAT source address.
    * Netavark now supports assigning multiple static ip addresses per subnet.
    * The MSRV has been bumped to v1.88.
    * Dependency updates.

++++ opa:

  - Update to version 1.18.0:
    This release contains a mix of bugfixes and small features.
    Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
    * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/<version> (<os>, <arch>), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/<version> (<os>, <arch>). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
    * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
    * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
    * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
    * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -> 1.26.4 (#8726) authored by
    @srenatus

++++ opencloud-server:

  - Update to version 7.2.0:
    Large update, please find the complete release notes here:
    https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.0
    * Breaking Changes - Action required
  - New settings required for the "sharing" service
    With OpenCloud 7.0 the "sharing" service needs a service
    account and secret to be configured. So if upgrading from a
    release prior to 7.0 please follow the steps outlined in the
    Upgrade Guide to achieve that.
  - Share-Manager migraton: First startup may take a few minutes
    When upgrading from a release before 7.x, the first container
    startup may take a few minutes before all Spaces are
    available.
    Background: Share-Manager migration
    OpenCloud 7.0.0 changes the way how space memberships are
    managed in the backend. When upgrading from a previous
    release the "sharing" service will automatically run a
    migration task to convert existing space memberships to the
    new mechanism. Depending on the number of spaces and space
    members this task can take up to a few minutes. During that
    time the member listing of spaces might be incorrect. Also it
    is not possible to change space memberships or create/delete
    spaces while the task is running. When the loglevel of the
    sharing service is set to info (OC_LOG_LEVEL=info or
    SHARING_LOG_LEVEL=info) the task will report progress of the
    migration via the logfile.
  - New OpenSearch index schema (v2) for the search service
    Note: This is only applicable to setups using the
    "opensearch" search engine with OpenCloud and does not affect
    setups using the default "bleve" search engine, as e.g. the
    standard docker compose setups do.
    With OpenCloud 7.x.x the search service now uses a new
    OpenSearch index schema (v2), adding two fields: Content
    (with term vectors, for faster highlighting via the fast
    vector highlighter) and Favorites (for searching/filtering by
    favorites).
    Since OpenSearch mappings are immutable, the existing index
    can't be migrated in place. On startup the service detects
    the mismatch and refuses to start ("manual action required").
    Required action when upgrading an OpenSearch deployment:
  - Delete the existing index ("opencloud-resource" by default,
    unless overridden via
    SEARCH_ENGINE_OPEN_SEARCH_RESOURCE_INDEX_NAME).
  - Restart the search service - it recreates the index with
    the v2 schema.
  - Trigger a full reindex of all content so the new fields get
    populated (e.g by calling opencloud search index
  - -all-spaces --force-rescan
    * Highlights
  - New, Easy to Learn Markdown Editor
  - Format content without learning Markdown syntax
    The new Markdown Editor combines the simplicity of slash
    commands with the flexibility of Markdown. Slash commands
    make formatting accessible to everyone as it helps also
    non-technical users to discover Markdown capabilities
    without needing to learn syntax first.
  - Lightweight portable and reusable format
    Markdown provides a lightweight, portable format with no
    vendor lock-in. Its simple nature makes content easier to
    version, maintain and convert into PDFs, knowledge bases
    and other formats. For many workflows Markdown offers a
    simpler and more durable alternative to heavyweight office
    formats.
  - Interchange format between humans and AI
    As AI becomes a core part of daily work, Markdown is
    emerging as a natural interchange format between humans and
    AI. Its simple structure allows both users and AI systems
    to create content easily.
  - Favorites Feature
    The new Favorites feature makes it easy to find important and
    frequently used files. Marked files are visible across all
    personal and shared spaces and can be accessed at any time
    with a single click.
    All favorites are collected centrally on a dedicated page,
    providing a quick overview of relevant content. Whether in
    list view or grid view, users can efficiently access their
    most important files without having to search for them.
    Server-side Favorites are available in the Web and will be
    available in one of the next releases of the mobile clients
    as well.
  - Photo Roll in the Preview App
    The new Photo Roll feature makes navigating image collections
    significantly easier. While viewing an image, the previous
    and next images are displayed as previews, allowing users to
    orient themselves more quickly and browse through their
    photos with ease.
  - Faster Preview App
    The Preview App has been optimized for significantly better
    performance when browsing large photo folders. Instead of
    requesting all images in full resolution only the currently
    viewed image is loaded in high quality. Images in the Photo
    Roll are loaded as small thumbnails and only for items
    currently visible within the viewport.
    Additional images are loaded dynamically while scrolling, and
    pending image requests are canceled as soon as they are no
    longer needed, particularly on slow or unstable connections.
  - Support for MOV Video Files (Preview)
    OpenCloud now supports previewing MOV video files. You can
    store MOV files in your file system and view them directly in
    the interface without converting them first.
  - Improved Breadcrumb Navigation
    Navigating deep folder structures is now faster and more
    direct. The breadcrumb navigation allows users to jump to
    higher-level folders with just a few clicks, eliminating the
    need to step back through each folder individually.
  - Keyboard Shortcuts for Global Search
    The global search bar can now be focused using keyboard
    shortcuts (s or /). When focused, the search input field is
    visually highlighted, making the active state easier to
    recognize.
  - Floating Action Button for “Create or Upload”
    The “Create or Upload” button in the Files App is now
    implemented as a Floating Action Button (FAB). Available
    actions open in a dropdown menu or bottom drawer. The button
    is disabled or hidden when the user does not have write
    permissions.
  - Consistent Context Actions on Mobile
    Contextual actions on mobile devices now open consistently in
    a bottom drawer. This follows familiar iOS and Android
    interaction patterns making the UI feel familiar.

++++ openrct2:

  - Update to version 0.5.2
    * https://github.com/OpenRCT2/OpenRCT2/releases/tag/v0.5.2
    * Improved: [#26322] [Plugin] Add footpath flags to
    FootpathSurfaceObject in the plugin API.
    * Improved: [#26566] Improve the performance of sorting sprites.
    * Fix: [#26350] [Plugin] ListViews altered by plugins post their
    creation are not invalidated.
    * Fix: [#26565] Game crashes when switching to another tab in
    the guest window.
    * Fix: [#26583] The default tab is not highlighted when opening
    a ride window.
    * Fix: [#26602] Crash when locating the nearest mechanic for a
    ride that has not previously been inspected.
    * Fix: [#26615] Missing junction path tile in Build your own
    Six Flags Over Texas.
    * Fix: [#26616] Fix gap in buyable land in Build your own
    Six Flags Magic Mountain.
    * Fix: [#26624] Tile elements selected by clicking on them with
    the tile inspector open do not always redraw correctly.
    * Fix: [#26634] Add missing park patch file for Build your own
    Six Flags Great Adventure.

++++ operator-sdk:

  - Update to version 1.42.3:
    * Release v1.42.3 (#7108)
    * updating images to ubi 9.8 (#7107)
    * Bump github.com/containerd/containerd from 1.7.32 to 1.7.33
    (#7105)
    * Bump ubi9/ubi-minimal from 9.7 to 9.8 in
    /images/custom-scorecard-tests (#7095)
    * Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/scorecard-test
    (#7096)
    * Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/operator-sdk
    (#7097)
    * Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/helm-operator
    (#7098)
    * updating ansible operator plugin version to 1.42.3 and other
    dependencies (#7106)
    * Bump github.com/containerd/containerd from 1.7.29 to 1.7.32
    (#7099)
    * Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#7094)
    * Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.19.0 (#7093)
    * Bump github.com/distribution/distribution/v3 from 3.1.0 to
    3.1.1 (#7092)
    * Bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (#7086)
    * Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
    (#7080)
    * Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    (#7081)
    * Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#7082)
    * Bump github.com/distribution/distribution/v3 from 3.0.0 to
    3.1.0 (#7078)
    * Bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 (#7075)
    * Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#7083)
    * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#7076)
    * updating generated files post 1.42.2 release (#7072)

++++ photoqt:

  - Update to 5.4:
    * add: mj2 image format
    * improve: rework image plugin handling including more
    fine-grained format/plugin management
    * improve: more efficient filtering of key/mouse events
    * improve: widen use of QHash and QSet for performance
    critical code
    * improve: general performance improvements, better safety
    handling, and tweaks to all C++ code
    * improve: system extensions are always trusted automatically
    * improve: improve performance of loading extensions
    * improve: extension API is now more flexible and powerful
    * improve: screenshots for fake transparency only taken when
    needed and properly cleaned up at session end
    * improve: actually perform requested import of backup not
    until next startup
    * improve: more robust scroll manager with new debug statements
    * improve: more reliable and better archive handling
    * improve: show more detailed error image on failure
    * improve: figure out maximum texture size and ensure panoramas
    fall within limit
    * improve: zoom/scale handling for all thumbnails
    (filedialog and bar)
    * improve: extend and improve libsai image plugin
    * improve: when calculating string widths use proper
    font metrics
    * improve: when requesting a folder in the file dialog that
    does not exist, show proper error message
    * improve: address all issues and most warnings identified
    by qmllint
    * improve: address clazy recommendations
    * improve: replace deprecated Qca with direct calls to OpenSSL
    * improve: hide footer in integrated UI when status
    info disabled
    * hide footer and menu bar when window put into fullscreen
    * fix: execution with Qt 6.4/6.5
    * fix/improve: jpeg2000 when using openjasper does not like
    multi-threading (would crash)
    * fix: the headers in the favorites column of the file dialog
    should never be highlighted
    * fix: proper exception handling with ffmpegthumbnailer API
    * fix: runtime localization change
    * fix: certain configuration combinations might not show all
    thumbnails in thumbnail bar
    * fix: height of menu items when hidden/shown at runtime
    * fix: zooming to cursor position with sidebar on the left
    * fix: proper smoothing of scaled down images
    * fix: very small zoom speeds can cause zoom to get stuck
    * fix: entering specific zoom level did not work
    * fix: special actions are only considered when such an item is
    actually visible
    * fix: image caching with associated color profile information
    * fix: handling of address text editing in file dialog
    * fix: only ever allow checking one option in the thubmnail bar
    settings context menu for image option
    * fix: faulty thumbnail image in tooltip in file browser

++++ pnpm:

  - update to 11.9.0:
    * Minor Changes
  - bae694f: Some registries generate tarballs on-demand and
    cannot provide an integrity checksum in their package
    metadata. In that case pnpm now computes the integrity from
    the downloaded tarball and stores it in the lockfile, so the
    entry is verifiable on subsequent installs instead of being
    written without an integrity (which would fail the next
    install). This also applies to --lockfile-only: the tarball
    is downloaded so its integrity can be computed. A lockfile
    entry that is still missing its integrity is rejected as a
    ERR_PNPM_MISSING_TARBALL_INTEGRITY lockfile verification
    violation (the install fails closed) rather than being
    silently re-fetched.
  - 6c35a43: Added --exclude-peers to pnpm sbom. With
    auto-install-peers (the default), peer dependencies resolve
    into the lockfile and are otherwise indistinguishable from
    the package's own dependencies. The flag drops peer
    dependencies (and any transitive subtree reachable only
    through them) from the SBOM. CycloneDX 1.7 has no scope or
    relationship that expresses "consumer-provided peer", so
    omission is the only spec-clean handling. The flag name
    matches pnpm list --exclude-peers; note the SBOM flag prunes
    a peer's exclusive subtree, which is stricter than pnpm list
    (which only hides leaf peers).
    * Patch Changes
  - 25a829e: pnpm audit --fix now writes a single combined
    minimumReleaseAgeExclude entry per package (e.g. axios@0.18.1
    || 0.21.1) instead of one entry per version, matching the
    format documented for the setting. Existing per-version
    entries in pnpm-workspace.yaml are merged into the combined
    form rather than left as duplicates. Installs that
    auto-collect immature versions into minimumReleaseAgeExclude
    now report the same combined entries, so the "Added N
    entries" message matches what is written to the manifest
    [#12534].
  - 1cbb5f2: Fixed non-deterministic peer resolution that could
    add or remove an optional transitive peer — for example
    @babel/core, reached through styled-jsx — from a package's
    peer-dependency suffix across otherwise identical installs,
    churning the lockfile and causing intermittent pnpm dedupe
  - -check failures in CI. When a package's children are
    resolved by one occurrence (the "owner") and reused by a
    deeper consumer, whether that consumer inherited the owner's
    missing peers depended on whether the owner's resolution had
    finished yet — a race under concurrent resolution. The
    decision is now a function of the dependency graph's
    structure rather than resolution-completion order.
  - d577eea: Fixed a Windows flakiness in pnpm dlx where a failed
    install could surface a spurious EBUSY: resource busy or
    locked error. The cleanup of a partially-populated dlx cache
    is now best-effort with retries and no longer masks the
    original error.
  - ec7cf70: Shortened the pnpm dlx cache path so deep dependency
    trees no longer overflow Windows' MAX_PATH, which could make
    a dependency's lifecycle script fail with spawn cmd.exe
    ENOENT.
  - 05b95ab: Fixed pnpm hanging (and crashing with an unhandled
    promise rejection) when a non-retryable network error such as
    SELF_SIGNED_CERT_IN_CHAIN occurs while fetching from a
    registry. The error is now rejected through the returned
    promise instead of being thrown inside the detached retry
    callback.
  - d3f68e2: Fix a pnpm audit performance regression on lockfiles
    that contain dependency cycles. The reachable-vulnerability
    pruning added in pnpm 11.5.1 only memoized acyclic subtrees,
    so any node whose subtree touched a cycle — together with all
    of its ancestors — was recomputed on every query, making the
    path walk quadratic. Reachability is now computed once per
    node using Tarjan's strongly-connected-components algorithm,
    so cyclic graphs are handled in linear time #12212.
  - The audit path walk also no longer recurses, so a deeply
    nested dependency graph can no longer overflow the call
    stack, and the install path to each finding is tracked
    without per-node copying, keeping memory linear in the graph
    depth.
  - 322f88f: Fix failed optional dependency updates so they don't
    rewrite unrelated dependency specs #11267.
  - 1488db1: When enableGlobalVirtualStore is toggled on for a
    project that was previously installed without it, stale
    hoisted symlinks under node_modules/.pnpm/node_modules are
    now replaced instead of being left pointing at the old
    per-project virtual store location #9739.
  - 6545793: Fixed pnpm install --ignore-workspace overwriting
    the allowBuilds map in pnpm-workspace.yaml. The ignored
    builds of a package with a build script were auto-populated
    into allowBuilds even though --ignore-workspace was passed,
    clobbering committed true/false values with the set this to
    true or false placeholder #12469.
  - fbdc0eb: Fixed minimumReleaseAgeExclude and
    trustPolicyExclude so multiple exact-version entries for the
    same package behave the same as a single || disjunction
    entry. Previously only the first matching rule's versions
    were honored, so a config like [form-data@4.0.6,
    form-data@2.5.6] could still flag form-data@2.5.6 as
    violating minimumReleaseAge, while [form-data@4.0.6 || 2.5.6]
    worked as expected #12463.
  - fa7004b: The in-memory package metadata cache is now
    populated on the exact-version disk fast path, so repeated
    resolutions of the same package within one install no longer
    re-read and re-parse the on-disk metadata. In large monorepos
    this brings the time for adding a new package down from
    minutes to seconds. The in-memory cache key now also includes
    the registry, so a package of the same name served by two
    different registries in a single install can no longer share
    a cache slot and resolve the wrong tarball.
  - 0a154b1: Fixed pnpm patch dropping the package name (and
    leaking internal option fields) when the patched dependency
    resolves to a single git-hosted version.
  - 4d3fe4b: The pnpr resolver endpoints moved under the reserved
    /-/pnpr namespace: POST /v1/resolve is now POST
    /-/pnpr/v0/resolve and POST /v1/verify-lockfile is now POST
    /-/pnpr/v0/verify-lockfile. The capability handshake at GET
    /-/pnpr advertises protocol version 0 to match. This keeps
    every pnpr-proprietary route in npm's reserved namespace, so
    it can never collide with a package path.
  - 0ec878d: Removing a runtime dependency now removes the
    matching devEngines.runtime or engines.runtime entry that was
    materialized from it. Blank runtime selectors are normalized
    to latest.
  - 17e7f2c: pnpm sbom now emits a CycloneDX issue-tracker
    external reference for components (and the root) whose
    package.json declares a bugs URL. Email-only bugs entries are
    skipped, since the reference requires a URL.
  - a84d2a1: Add @pnpm/resolving.tarball-url, which builds and
    recognizes the canonical npm tarball URL of a package. It
    vendors getNpmTarballUrl (previously the external
    get-npm-tarball-url package) and adds
    isCanonicalRegistryTarballUrl, the predicate the lockfile
    writer uses to decide whether a tarball URL is derivable from
    name+version+registry (and can therefore be omitted from
    pnpm-lock.yaml).
  - Exposing isCanonicalRegistryTarballUrl lets a custom resolver
    (pnpmfile resolvers) fronting a proxy that serves tarballs on
    a non-canonical path (e.g. an ephemeral localhost:<port>)
    rewrite the resolved tarball to the canonical form, so
    nothing host-specific is persisted to the lockfile.
    Previously this logic was private to @pnpm/lockfile.utils.
  - Two correctness fixes are included while consolidating the
    logic: the scoped-package unescape now handles uppercase %2F
    as well as %2f (percent-encoding is case-insensitive), and
    protocol-insensitive comparison strips only a leading
    http(s):// scheme instead of splitting on the first ://
    (which could truncate URLs containing a later ://).
  - 852d537: Lockfile verification no longer reports a registry
    metadata fetch failure (for example a 403/401 on a private
    registry, or a network error) as
    ERR_PNPM_TARBALL_URL_MISMATCH. When the registry can't be
    reached to verify an entry, the install now aborts with the
    registry's own fetch error (such as ERR_PNPM_FETCH_403, which
    already explains the authentication situation) instead of
    mislabeling a transport failure as lockfile tampering.
    Registry fetch errors no longer leak basic-auth credentials
    embedded in the registry URL (https://user:pass@host/) into
    their message.

++++ python-SQLAlchemy:

  - update to 2.0.51:
    * https://docs.sqlalchemy.org/en/21/changelog/changelog_20.html#change-2.0.51

++++ python-lxml:

  - update to 6.1.1 (bsc#, CVE-2026-49825):
    * The known link attributes in ``lxml.html.defs.link_attrs``
    were missing ``xlink:href``, which can be used for URL bypass
    attacks in embedded SVG/MathML/etc. content.
    * https://github.com/fedora-
    python/lxml_html_clean/security/advisories/GHSA-4jhm-
    jv67-739f
    * The Linux wheels use a patched libxslt 1.1.43, fixing
    CVE-2025-7424 and CVE-2025-11731.
    * The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424
    and CVE-2025-11731.

++++ python-mpi4py:

  - update to 4.1.2:
    * Fix build issues from breaking changes in setuptools 81.
    * Support Windows builds with Meson and Intel MPI.
    * PyPy wheels are no longer published.

++++ python-openstacksdk:

  - update to 4.17.0:
    * volume: Add support for manageable volumes, snapshots
    * Fix type for VolumeAttachment.connection_info
    * typing: Add missing find_* overrides
    * server-external-events: change resource_key to None
    * Fix backup_server proxy and action
    * typing: Correct type of create_server_image proxy method
    * volume: Allow unknown attrs for QoS specs
    * image: Add support for downloading from a specific store
    * Adding support for new add/get location apis
    * tests: Replace use of testtools.ExpectedException
    * tests: Use base test class consistently
    * tests: Remove unnecessary setUp parameter
    * tests: Remove dead cloud.clustering tests
    * fakes: Set spec_set on proxy mocks
    * fakes: Resolve TODO
    * docs: Add missing block storage docs
    * volume: Add support for clusters
    * volume: Add support for consistency groups
    * volume: Add support for service worker cleanup
    * volume: Add support for Messages resource
    * volume v2: Add missing upload_volume_to_image proxy method
    * proxy: Start passing params to Proxy._delete
    * proxy: Allow passing qs params via Proxy._delete
    * volume: Add import backup record support
    * volume: Add support for QoS Spec actions
    * volume: Add find, list QoS spec proxy methods
    * volume v2: Add QoS Spec definition
    * volume: Add missing query filters for group types
    * volume: Fix unset image metadata
    * volume v2: Add type encryption support
    * volume v2: Add volume type extra specs
    * volume v2: Add volume type update
    * volume v2: Add volume update
    * Add project_id attribute for magnum cluster
    * compute: Handle missing service
    * Changed neutron API calls to use project_id
    * typing: Correct types for Server console actions
    * typing: Sync v2, v3 restore_backup signatures
    * Fix package discovery
    * placement: add fetch_resource_provider_usages method

++++ python-tqdm:

  - update to 4.68.3:
    * `utils`: delay `os.get_terminal_size`
    * `autonotebook`: support QtConsole, Spyder, JupyterLite
    * minor docs updates
    * misc minor framework updates
    * add Python 3.14, drop 3.7 support
  - update to 4.68.2:
    * revert accidental change to `ascii` default (fixes #1760)
    * `UnicodeEncodeError: 'charmap' codec can't encode
    characters in position 6-7: character maps to ` can be fixed
    by installing `tqdm!=4.68.0,!=4.68.1`
    * misc docs updates
    * tests: fix coverage (fixes #1760)
  - update to 4.68.1:
    * set name of monitor thread
    * fix monitor thread `atexit` deadlock
    * docs: minor copyediting
  - update to 4.68.0:
    * `utils`: simplify terminal size detection
    * add `chain`, `permutations`, `combinations`,
    `combinations_with_replacement`, `batched`
    * add `product(repeat=1)` keyword argument
    * soft-deprecate `tqdm.utils.envwrap` -> `envwrap`
    * benchmarks: fix `asv`

++++ python-platformdirs:

  - update to 4.10.0:
    * feat: add user_projects_dir for $XDG_PROJECTS_DIR
    * feat: add user_publicshare_dir, user_templates_dir,
    user_fonts_dir, user_preference_dir

++++ python-Telethon:

  - update to 1.44.0:
    * Slight typings improvements.
    * Should no longer time out when dealing with server salts.
    * Should no longer lead to high CPU usage when connection is
    closed by remote.

++++ python-Wand:

  - update to 0.7.2:
    * Fixed de-synced offsets during file read operations.

++++ python-anthropic:

  - Initial package python-anthropic 0.112.0

++++ python-fastnumbers:

  - update to 5.2.0:
  - Support for Python 3.14
  - Fixed invalid license classifier ( @jzerfowski, issues #83
    and #84)
  - Explicitly set language="c++" and add -lstdc++ to solve
    linker problem on OpenSUSE
  - Fix bug where compilation warnings for MSVC were not turned
    into errors for CI testing
  - Eliminate various static analysis warnings
  - Removed support for Python 3.8
  - Add no-setuptools-scm.patch to remove the need of using
    setuptools_scm, which doesn't work with GitHub tarballs
  - Remove upstreamed patch:
  - opensuse-build.patch

++++ python-grpcio:

  - update to 1.81.1:
    * Add typing_extensions dep to aio Bazel target. (#42001)
    * Drop 3.9. (#42145)
    * grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)
    * [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)
    * Remove GIL from ReceiveMessageOperation.un_c method. (#41812)
    * Support observability in AsyncIO stack. (#41573)
    * Trim Python2 backward compatiblity syntax - removed (object) inheritance

++++ python-icalendar:

  - update to 7.2.0:
    * Created an ical_value property for the vFrequency component,
    mirroring the existing pattern on vWeekday. @mvanhorn (Issue
    * Created an ical_value property for the vGeo component.
    * Added type hints to component methods.
    * Added test coverage for icalendar.compatibility.deprecate_for_version_8().
    * The Alarm.uid accessor now falls back to vendor-specific UID
    properties (the existing X-ALARMUID and the newly added
    X-EVOLUTION-ALARM-UID) when no canonical UID is present, so
    alarms exported by Evolution/GNOME Calendar expose a usable
    identifier. single_string_property now accepts an ordered list
    of fallback keys so further vendor aliases can be added later.
    * The rdates and exdates properties are now writable: assigning a
    list replaces the RDATE/EXDATE values, del (or assigning an
    empty list or None) clears them, and assigning the value the
    getter returns round-trips.

++++ python-installer:

  - update to 1.0.1:
    * Include docs and tests in sdist again
    * Fix long path issue on Windows
    * Fix date in changelog
    * Use `os.path.abspath()` instead of `Path.resolve()` for
    performance

++++ python-jiter:

  - update to 0.15.0:
    * expose `known_number_bytes` and parser methods for bytes ->
    number

++++ python-jwcrypto:

  - update to 1.5.8:
    * Fix list iteration in claim format validation
    * fix: bump minimum cryptography dependency to >= 39.0.0
    * Wrap JWKSet parsing errors in InvalidJWKValue
    * jwt: add opt-in strict_serialization to enforce compact form

++++ python-kafka-python:

  - update to 3.0.6:
    * consumer: track current leader epoch in addition to record
    epoch
    * Also `wait_for_topics` on <0.10 test fixtures
    * Reserve buffer capacity before every encode_into write
    * Fix backoff on bootstrap init failure after connection_made
    * Add new extended logging args to docs/cli
    * Fix `_build_transport` / `conn.close` race
    * net.transport: Fix closed/write_eof handling in
    `_write_to_sock`
    * Fix kafka.net.connection await: raise connection failures
    * bootstrap connection log changes
    * Improve connection logging; dont log version check if matches
    expected
    * tests: print integration fixture output to console if no log
    handlers
    * docs: Add title headings for KafkaConsumer/KafkaProducer; add
    sphinx-argparse to requirements-dev.txt
    * Consumer: fix multi-broker fetch busy wait loop
    * net: inject KernelEvent handler exceptions into coro; warn
    dont crash if task state is still RUNNING
    * Fix: do not mark coordinator dead on all HeartbeatResponse
    errors
    * Improve task cleanup with net.cancel(task), TaskState, and
    consolidated wait_io cleanup
    * Fix/net selector task already done
    * Fixup socks5_proxy deprecation warning
    * log metadata refresh failure stacktraces as DEBUG not ERROR
    * log heartbeat rebalance response as INFO, not WARNING
    * add --log-format, --log-date-format, --log-file, --log-config
    * fix comma-separated --bootstrap-servers parsing
    * fix memory leak of cancelled timeout tasks (@azdobylak /
    [#3077])
    * receive_message_max_bytes default 100MiB
    (consumer/producer/admin); check against fetch_max_bytes and
    max_partition_fetch_bytes in Consumer

++++ python-langchain-anthropic:

  - Initial package python-langchain-anthropic 1.4.8

++++ python-langchain-aws:

  - Initial package python-langchain-aws 1.6.1

++++ python-langchain-core:

  - Initial package python-langchain-core 1.4.8
  - Initial package python-langchain-openai 1.3.3
  - Initial package python-langchain-protocol 0.0.18

++++ python-langgraph:

  - Initial package python-langgraph 1.2.6
  - Initial package python-langgraph-checkpoint 4.1.1
  - Initial package python-langgraph-cli 0.4.30
  - Initial package python-langgraph-prebuilt 1.1.0
  - Initial package python-langgraph-sdk 0.4.2

++++ python-langsmith:

  - Update to 0.9.3:
    * Client library for the LangSmith observability and evaluation
    platform; many releases of fixes and new tracing/evaluation
    features since 0.1.52.
    * websockets is now a core runtime dependency.
  - Switch Source to the PyPI sdist (langsmith-%{version}.tar.gz)
    instead of the GitHub archive; the sdist ships only the Python
    client and its unit tests.
  - Build with the hatchling backend (upstream moved away from poetry).
  - Drop the langsmith console-script and its update-alternatives
    handling; upstream no longer ships a CLI entry point.
  - Add new runtime dependencies required by this release: python-anyio,
    python-distro, python-sniffio, python-typing_extensions,
    python-uuid-utils, python-websockets and python-xxhash; tighten the
    existing dependency floors.

++++ python-moreorless:

  - update to 0.6.0:
    * Fix missing f-prefix on error strings in combined.py
    * Reject structurally invalid hunks in patch application

++++ python-mutagen:

  - update to 1.48.1:
    * Revert: ``ID3: Fix saving ID3v2 comment fields from
    COMM:desc:lang tags`` to fix duplicated COMM frames in some
    cases. :pr:`713`
    * Drop Support for Python 3.7, 3.8 and 3.9 :pr:`611` :pr:`657`
    :pr:`689`
    * ID3: Add ``salt`` attribute to APIC frames to allow multiple
    APIC frames with
    * identical descriptions :pr:`675`
    * ID3: Preserve order of APIC frames relative to each other
    when saving :bug:`436` :pr:`676`
    * ID3: Fix reading/writing v1.0 and v1.1 comment/track fields
    :bug:`668` :pr:`686`
    * ID3: Fix saving ID3v2 comment fields from ``COMM:desc:lang``
    tags :bug:`660` :pr:`709`
    * ID3: Consider size of extended header when reading ID3 data
    :bug:`630` :pr:`631`
    * EasyID3: Fix handling of ``albumartistsort`` as ``TSO2`` with
    ``TXXX:ALBUMARTISTSORT``
    * fallback for reading :pr:`649`
    * MP3: do not fail on non-ASCII lame header version flags
    :pr:`664`
    * OggOpus: Provide a bitrate property :bug:`475` :pr:`704`
    * MP4: Fall back to parsing length from ``mvhd`` if there is no
    ``trak`` info :pr:`682`
    * MP4: Fix chapter timestamp parsing :bug:`639` :pr:`640`
    * OGG: Fix saving files with trailing null bytes :bug:`591`
    :pr:`674`
    * mid3v2: Fix ``--list-frames-v2.2`` option :bug:`669`
    :pr:`683`
    * Set ``__cause__`` on ``MutagenError`` to preserve exception
    chain :bug:`703` :pr:`710`
    * Explicitly define exports with ``__all__`` in
    ``mutagen/__init__.py`` :bug:`647` :pr:`696`
    * docs: Fix code example for :class:`flac.Picture` :pr:`673`
    * docs: Initial :doc:`dev/index` with implementation notes for
    ID3 :pr:`633`
    * Switch from poetry to uv for development :pr:`687`
    * Changed the default branch from master to main

++++ python-nh3:

  - update to 0.3.6:
    * Validate clean_content_tags conflict with tags
    * Document tag_attribute_values as alternate to attributes
    * Add nh3.escape alias for clean_text
    * Bump pyo3 from 0.28.3 to 0.29.0
    * Expose ammonia's url_relative policy via url_relative kwarg

++++ python-ormsgpack:

  - Initial package python-ormsgpack 1.12.2
  - Rust crates are vendored via the cargo_vendor source service
    (vendor.tar.zst)

++++ python-pbs-installer:

  - update to 2026.6.10:
    * update cpython build releases and hashes

++++ python-pdm-backend:

  - update to 2.4.9:
    * Adjust the expected test output to include editables 0.6

++++ python-persistent:

  - update to 6.7:
    * Add preliminary support for Python 3.15b1.

++++ python-phonenumbers:

  - update to 9.0.33
    * Merge metadata changes from upstream 9.0.33

++++ python-pillow-heif:

  - update to 1.4.0:
    * `libheif` was updated from the `1.21.2` to `1.23.0` version.
    * `libde265` was updated from the `1.0.16` to `1.1.0` version.
    * `libx265` was updated from the `4.1` to `4.2` version. #426
    * Minimum required `libheif` version is `1.19.0`. #416
    * `options.ALLOW_INCORRECT_HEADERS` option. Starting with
    `libheif` `1.22.0`, libheif itself rejects images whose
    decoded size does not match the `ispe` header. #426
    * `sRGB` NCLX color profile (`BT.709` primaries) is now written
    by default during encoding when no color information was
    provided, to avoid color shifts in viewers. #407

++++ python-plumbum:

  - update to 2.0.1:
    * Make SwitchInfo hashable again so requires=/excludes= work
    * Drop unused conda.recipe
    * Support async mode (#768)  Support popen on async pipelines
    (#795, #804)
    * Support popen on async pipelines
    * More pathlib API supported
    * Support color string processing
    * Remove pywin32 dependency and replace WinAPI calls with a
    custom ctypes wrapper
    * Full static typing  Add paramiko machine typing (#746) Add
    remote typing (#744) Add sshmachine typing (#745) Add typing
    for color (#730) Add typing for fs (#737) Add typing for
    local machine (#743) Typing paths (#733) Adding rest of
    typing (#739) Enable tc ruff check (#752) More safe types
    (#741) Should be safe types (#740) Type only session (#742)
    Types for Application (#735) Typing for commands (#738) Type
    examples too (#748) Typing fixes from Ruff (#749) Minor
    typing updates (#780)
    * Add paramiko machine typing
    * Add remote typing
    * Add sshmachine typing
    * Add typing for color
    * Add typing for fs
    * Add typing for local machine
    * Typing paths
    * Adding rest of typing
    * Enable tc ruff check
    * More safe types
    * Should be safe types
    * Type only session
    * Types for Application
    * Typing for commands
    * Type examples too
    * Typing fixes from Ruff
    * Minor typing updates

++++ python-prettytable:

  - update to 3.18.0:
    * Add support for Python 3.16 (#470) @hugovk
    * Support multiline headers (#451) @wyllys66
    * Support reStructuredText tables (#449) @hugovk
    * Support `int_format`, `float_format` and `custom_format` for
    CSV (#448) @hugovk
    * Add caption support for Markdown (#342) (#430) @stuertz
    * Validate column-specific options when dict attrs are modified
    (#429) @stuertz
    * Overwrite int/float formatter with `custom_formatter` (#425)
    @stuertz
    * Document `paginate()` (#420) @stuertz
    * Docs: add example of using `custom_format` (#405) @stuertz
    * Improve type coverage of `colortable` (#459) @jorenham
    * Improve wcwidth>=0.3.5 integration and performance (#440)
    @jquast
    * Replace `re.split` with `str.split` and remove `re` import
    (#443) @hugovk
    * Speed up import time (#471) @hugovk
    * Stop testing experimental Python 3.13t (#469) @hugovk
    * Performance: deprecate and defer import of `TableHandler`
    (#460) @hugovk
    * Expand tabs in cell values so columns stay aligned (#468)
    @gaoflow
    * Drop stale `align`/`valign` keys when `field_names` are
    renamed (#465) @SAY-5
    * Fix bleeding of wrapped colours into table edges (#452)
    @jquast
    * Fix `horizontal_align_char` getter (#445) @hugovk
    * Allow different types for Cursor than only sqlite3.Cursor
    (#419) @stuertz
    * Remove duplicate line (#446) @hugovk
    * Document `header_horizontal_char` and remove a duplicate
    docstring line (#467) @Labib-Bin-Salam

++++ python-propcache:

  - update to 0.5.2:
    * Added support for newer type hints and remove Optional and
    Union from all annotations -- by :user:`Vizonex` Related
    issues and pull requests on GitHub: :issue:`193`.
    * Dropped support for Python 3.9 as it has reached end of life.
    Related issues and pull requests on GitHub: :issue:`216`.
    * Changed the Cython build dependency from ~= 3.1.0 to >=
    3.2.0, removing the upper version bound to avoid conflicts
    for downstream packagers -- by :user:`jameshilliard` and
    :user:`gundalow`. The upstream Cython version is pinned to
    3.2.4 in the CI/CD environment. Related issues and pull
    requests on GitHub: :issue:`184`, :issue:`188`, :issue:`214`.
    * Start building and shipping riscv64 wheels -- by
    :user:`justeph`. Related issues and pull requests on GitHub:
    :issue:`194`.
    * The PEP 517 build backend now supports a new build-inplace
    config setting (and PROPCACHE_BUILD_INPLACE environment
    variable) for controlling whether to build the project in-
    tree or in a temporary directory. It only affects wheels and
    is set up to build in a temporary directory by default. It
    does not affect editable wheel builds; they will keep being
    built in-tree regardless. Here's an example of using this
    setting:  $ python -m build --config-setting=build-
    inplace=true  Additionally, when building wheels in an
    automatically created temporary directory, the build backend
    now normalizes the respective file system path to a
    deterministic source checkout directory by injecting the
  - ffile-prefix-map compiler option into the CFLAGS environment
    variable, as suggested by known reproducible build practices.
    The effect is that downstreams will get reproducible build
    results. Related issues and pull requests on GitHub:
    :issue:`218`.

++++ python-proto-plus:

  - update to 1.28.0:
    * no upstream changelog available

++++ python-rebulk:

  - Update to version 4.2.2
    Bug Fixes:
    * match: Make Match.hash independent of the mutable value
    Chores:
    * toposort: Purge Python 2 remnants from the vendored module
    Refactoring:
    * Drop dead getargspec fallback and leftover commented code
    * pattern: DRY Pattern.init and RePattern._match
  - Update to version 4.2.1
    Bug Fixes:
    * chain: Sort matches by match_index before groupby
    Performance Improvements_
    * utils: Set-based extend_safe with unhashable fallback
  - Update to version 4.2.0
    Bug Fixes:
    * typing: Reject dataclass/TypedDict as Key value_type
    Chores:
    * Sync uv.lock with released version 4.1.0
    Features:
    * typing: Matches.named accepts multiple names (any-of)
    * typing: Typed value retrieval — Key[T] and Matches.to (v5 POC)

++++ python-redis-entraid:

  - update to 1.2.1:
    * Bump PyJWT to 2.13

++++ python-reproject:

  - update to 0.21.0:
    * Fixes to HiPS functionality
    * Give each thread its own copy of the WCS in the dask HiPS

++++ python-robotframework-seleniumlibrary:

  - update to 6.9.0:
    * SeleniumLibrary 6.9.0 is a new release with several
    enhancements and bug fixes. A couple new keywords, for drag
    and drop as well as getting css properties, have been added.
    Secret type support has be added. An issue with using lists
    with chaining locators has been fixed. Several of the minimum
    required versions have been updated.
    * SeleniumLibrary supports Python 3.10 through 3.14, Selenium
    4.29.0 through 4.44.0 and Robot Framework 6.1.1 and 7.4.2.

++++ python-ruff:

  - update to 0.15.20
    * Preview features
    * Allow human-readable names in rule selectors
    * Emit a warning instead of an error for unknown rule selectors
    * Match noqa shebang handling in ruff:ignore comments
    * [ruff] Remove pytest-fixture-autouse (RUF076)
    * Documentation
    * Add versioning sections to custom crate READMEs
    * Update ruff_python_parser README for crates.io
    * [perflint] Clarify that PERF402 applies to any iterable

++++ python-serpent:

  - update to serpent-1.43:
    * Fixed multiple bugs in serialization and parsing (complex
    number edge cases, custom types etc)
    * Changed java maven publishing method

++++ python-setuptools-rust:

  - update to 1.13.0:
    * Add `generated-files` option to `RustExtension` to copy files
    from the build script output directory to the wheel. #574
    * Add `-Zunstable-options` when querying rustc for information
    about custom JSON targets. #587

++++ python-slack-sdk:

  - update to 3.42.0:
    * feat: add authorship arguments to assistant threads and chat
    stream
    * feat(blocks): add Card, Carousel, and Alert block types
    * feat(models): add BlockChunk type to
    chat.{start,append,stop}Stream methods
    * feat: add highlight_type to files.completeUploadExternal and
    files_upload_v2
    * fix: pass default ssl=True to aiohttp to avoid deprecation
    warning
    * fix: Improve type annotations in `SignatureVerifier`
    * Fix typo in SectionBlock field validation
    * fix: improve Socket Mode client stability and correctness
    * fix: pin cryptography<46 for PyPy 3.10 CI builds
    * fix: resolve OAuth installation store bugs and typos
    * docs - adds chat_stream helper to python sdk docs (removing
    from bolt-py)
    * docs(maintainers): adding block kit types instructions

++++ python-snowballstemmer:

  - update to 3.1.1:
    * Fix a segmentation fault after reporting an error for a
    string command not followed by a string variable name or
    string literal.
    * Variable localisation was failing to check the expression
    on the RHS of an integer test for uses of a variable, so could
    incorrectly localise an integer variable whose value should
    have persisted between calls to a function.
    * Inline some routines which are only used once.  This is
    done for routines consisting of a single non-compound command
    * Simplify `not` applied to an integer test by removing the
    `not` and flipping the sense of the test (e.g. `not $(x > y)`
    becomes `$(x <= y)`) which results in simpler generated code.
    * Fix segmentation fault if -syntax is used on a program with
    no code.
    * Fix segmentation fault on some assignment syntax errors.
    * Fix bug introduced in v3.0.0 with conversion of `among`
    starter.  If there were any commands after the among in the
    same command list then the among itself would get lost.

++++ python-social-auth-core:

  - update to 5.0.2:
    * LINE backend now validates callback state before exchanging
    authorization codes, preventing login CSRF.
    * Shopify backend now sends and validates OAuth state,
    preventing login CSRF.
    * Updated the Google OAuth documentation link.
    * Externally resumable partial request links now require
    confirmation even in the browser session that created the
    partial, preventing validation links from being consumed by a
    plain GET.
    * LoginRadius backend now validates callback state to prevent
    login CSRF.
    * Odnoklassniki app backend now ignores untrusted callback API
    hosts and validates returned user details.
    * Partial pipeline resume now requires session ownership or
    explicit external resume confirmation to prevent login CSRF.
    * SAML responses are now validated against the original
    AuthnRequest when possible.
    * Twilio backend now preserves HTTPS callback URLs and
    validates callback state to prevent login CSRF.
    * Auth0 OpenID Connect configuration now uses the correct base
    URLs.
    * Authentication now handles invalid email addresses without
    crashing.
    * Vend OAuth user IDs are now scoped by shop.
    * VK app authentication now requires an auth key.

++++ python-sphinxcontrib-serializinghtml:

  - update to 2.0.0:
    * Adopt Ruff
    * Tighten MyPy settings
    * Update GitHub actions versions

++++ python-sse-starlette:

  - update to 3.4.5:
    * fix: test selection

++++ python-tableauserverclient:

  - update to 0.41:
    * **PDF export: vizWidth/vizHeight now sent in requests** (PR
    [#1795]) -- fields existed on `PDFRequestOptions` but were
    never serialized; now wired up for both views and workbooks
    * **Workbook description included in update requests** (PR
    [#1791]) -- was silently dropped before; now sent at API 3.21+
    * **Users endpoint: filter by email** (PR #1789, closes #1562)
    * **ConnectionItem: add `database_name` field** (PR #1787,
    closes #1571)
    * **SVG format support for view/custom view images** (PR #1755)
    * **Batch create schedule** (PR #1714)
    * **Delete view** (PR #1712)
    * **Users CSV import** (PR #1409) -- bulk add/remove via
    `Iterable[UserItem]`
    * **Extensions API support** (PR #1672)
    * **Collections in favorites** (PR #1647)
    * **WebAuthoringForFlows permission capability** (PR #1642)
    * **OIDC endpoints** (PR #1630) -- create, update, delete, get
    by ID
    * **Toggle attribute capture for a site** (PR #1619)
    * **Update multiple connections in one call** (PR #1638) -- for
    workbooks and datasources
    * **Make refresh consistent** (PR #1665) -- all three endpoints
    now accept either an item or an ID string
    * **UAT (unified access token) JWT login** (PR #1671)
    * **ResourceReference is hashable** (PR #1668)
    * **SiteAuthConfiguration `__str__`/`__repr__`** (PR #1641)
    * **Customized Monthly schedule interval** (PR #1670, closes
    [#1365])
    * **`project.get_by_id()`** (PR #1736, closes #816)
    * **Release automation** (PR #1613) -- publish to PyPI
    triggered by GitHub Release event
    * **Always use server version by default** (PR #1796, closes
    [#876], #959) -- auto-detects REST API version after signin
    * **Handle missing `t:error` element in server responses** (PR
    [#1794]) -- was crashing as `NonXMLResponseError` instead of
    showing the real XML
    * **Deprecate removed `no_extract` parameter** (PR #1793) --
    raises `DeprecationWarning` and maps to
    `include_extract=False` instead of hard `TypeError`
    * **Webhook event name prefix handling** (PR #1790, closes
    [#1597]) -- accept both prefixed and unprefixed event/source
    names
    * **`QuerySet.__iter__`: use `return` not `raise
    StopIteration`** (PR #1788) -- PEP 479: `StopIteration`
    inside a generator becomes `RuntimeError`
    * **Duplicate extract job (409093) is a warning, not an error**
    (PR #1785) -- extended from workbooks to datasources and
    flows
    * **Timeout error messages point to `TSC_CHUNK_SIZE_MB`** (PR
    [#1781]) -- 504s during chunked upload now give actionable
    guidance
    * **Bulk user add: don't default `authSetting` to
    `ServerDefault`** (PR #1779) -- was wrong for Tableau Cloud
    * **Quote tag labels containing spaces or commas** (PR #1782,
    closes #1738)
    * **`authentication_type` optional in `update_connections`**
    (PR #1778)
    * **View filter parameters prefix** (PR #1633, closes #1632) --
    parameters need `vf_Parameters.` prefix
    * **409 duplicate extract check in workbooks** (PR #1733,
    closes #1090)
    * **Datasource description in publish and update XML** (PR
    [#1682])
    * **Datasource owner/project parsing when User Visibility is
    Limited** (PR #1700)
    * **Custom view workbook/view setter** (PR #1730)
    * ## Infrastructure / Packaging
    * **Wheel packaging fix + release safety checks** (PR #1798) --
    correct `packages.find` exclude list; adds CI jobs to verify
    wheel structure pre-publish and smoke-test after publish
    * **Remove deprecated `cgi` module** (PR #1771, closes #1745)
    * **Update license info in `pyproject.toml`** (PR #1776)
    * **pytest-xdist for parallel test runs** (PR #1681)
    * **`tmp_path` fixture in download tests** (PR #1800) -- avoids
    writing files to cwd during parallel test runs

++++ python-testscenarios:

  - Update to 0.6.2:
    * Claim Python 3.10 - 3.14 support.
    * Fix compatibility with recent versions of fixtures, testtools.
    * Switch to hatchling/hatch-vcs build backend.
    * Test suite relocated to top-level tests/ directory.
  - Remove obsolete use-assertequal.patch

++++ python-tifffile:

  - update to 2026.6.1:
    * Replace NullContext with contextlib.nullcontext (breaking).
    * Fix writing monochrome linear_raw (#328).
    * Fix keyboard axis selection in imshow interactive viewer
    (#327).
    * Fix reading short ASCII string tag values from NDPI.
    * Add option to suppress writing extrasamples tag.
    * Verify origin of codecs.

++++ python-tiktoken:

  - update to 0.13.0:
    * Update fancy-regex for significantly increased performance
    * Branch byte pair encoding to fix performance on unusual input
    * Fix AttributeError caused by incomplete redaction of
    experimental code
    * Update version of `pyo3`
    * Update version of optional dependency `blobfile`

++++ python-typepy:

  - update to 2.0.0:
    * Replace pytz with ZoneInfo + misc datetime fixes
  - update to 1.3.5:
    * Bump the actions-dependencies group across 1 directory with 6
    updates
    * Fixed an invalid input handle for DateTimeConverter
    * Add support for Python 3.14
    * Fix logic issues in type checking and conversion functions

++++ python-typer:

  - Update to 0.27.8
    * Make second column of Rich help output reflect the type
    consistently, even when using metavar.
    * Fix formatting in NoSuchOption.format_message().

++++ python-ujson:

  - update to 5.13.0:
    * Create manylinux2014 wheels
    * Add support for Python 3.15
    * Disable global interpreter lock for freethreading
    * Move metadata from `setup.cfg` to `pyproject.toml` (#736)
    * Tighten UTF-8 validation for `ujson.dumps(b"...",
    reject_bytes=False)`
    * Replace generated `version.h` with macro (#735) @hugovk

++++ python-uv:

  - upadate to 0.11.25
    * Enhancements
    * Add a full "lockfile" to tool receipts
    * Allow scoped overrides to add dependencies
    * Avoid writing redundant lockfile markers with tool.uv.environments
    * Factor supported environments out of lockfile markers
    * Recommend our own build backend in the build frontend
    * Reject wheels with multiple .dist-info directories
    * Simplify dependency markers under parent reachability
    * Support scoped dependency exclusions
    * Support scoped dependency overrides
    * Explain why files are skipped in registry index parsing
    * Preview features
    * Add uv workspace list --scripts
    * Support centralised environments in uv venv
    * Use locked ty versions in uv check
    * Add centralized storage of project environments
    * Verify lockfile hashes before reusing a cached ty in uv check
    * Use locked dependency selection for uv check --script
    * Bug fixes
    *
    * Preserve standalone markers in workspace metadata
    * Reject uv build if the cache dir is enclosed

++++ python-wrapt:

  - update to 2.2.2:
    * When @wrapt.lru_cache was applied to an instance method that
    was overridden in a subclass, and the subclass method called
    the base class method via super(), a RecursionError was
    raised instead of the base class method being invoked. The
    per-instance cache for each method was stored as an attribute
    on the instance whose name was derived only from the method
    __name__, so the base and derived methods shared a single
    cache slot. The subclass cache was therefore found again when
    the base method was reached through super(), re-entering the
    subclass body and recursing without end. The cache attribute
    name now incorporates a unique identifier for each decorated
    method so that a base method and a method that overrides it
    use distinct per-instance caches. With thanks to the reporter
    of issue #342.
    * When @wrapt.lru_cache was applied to a method of a class
    deriving from wrapt.ObjectProxy, the per-instance cache was
    stored on the wrapped object rather than on the proxy. This
    is because the proxy __setattr__ forwards attribute
    assignment to the wrapped object for any name that is not a
    recognised proxy attribute, and the cache attribute name was
    not one. Storing the cache on the wrapped object had several
    consequences: the wrapped object was polluted with cache
    attributes it never defined; the cache held a reference back
    to the proxy through the bound method it wrapped, so a
    wrapped object that outlived the proxy kept the proxy alive
    and prevented its collection; wrapping an object that does
    not accept arbitrary attributes, such as one using __slots__,
    caused the first cached call to fail with an AttributeError;
    and two proxies sharing a single wrapped object shared one
    cache and could return results computed for the wrong proxy.
    The cache attribute is now stored on the proxy itself using
    the proxy __self_setattr__ method when the instance is a
    wrapt object proxy, falling back to setattr for ordinary
    instances.

++++ python-xxhash:

  - update to 3.8.0:
    * Speed up module-level one-shot digest(), intdigest(), and
    hexdigest() functions by switching them to METH_FASTCALL.
    * Keep one-shot argument handling consistent with hash
    constructors, including positional and keyword input/seed
    arguments, duplicate argument errors, and oversized seed
    wrapping.
    * Fix error handling in the xxh3_128 integer digest path so
    allocation failures are reported cleanly.
    * Fix Python 3.8 builds by adding a PyModule_AddType
    compatibility fallback with correct reference counting.
    * Correct type stubs for xxh64_digest(), xxh64_hexdigest(), and
    xxh64_intdigest(), they were incorrectly aliased to xxh3_64
    functions.
    * Fix memory leak in copy() and new() when memory allocation
    fails (rare edge case)
    * Fix seed/reset state initialization in xxh32 and xxh64
    (unlikely to affect normal usage)
    * Replace Py_BuildValue with PyLong_FromUnsignedLong/LongLong
    for performance
    * Update README examples to use bytes literals

++++ python-zeroconf:

  - update to 0.150.0:
    * Add async_update_interfaces to rescan network interfaces at
    runtime
    * Precompute address hash instead of per-instance lru_cache
    * Add benchmarks for cache mark-to-expire path
    * Add benchmarks for ipaddress object creation and hashing
    * Synchronise test_integration on browser first-query

++++ python-zopfli:

  - update to 0.4.3:
    * Add Windows ARM64 wheel to CI build matrix
  - update to 0.4.2:
    * Support building on free-threaded Python
    * Fix sdist build and add setuptools_scm to build system
    requirements

++++ python315:

  - Update to 3.15.0~b3:
  - Security
  - gh-151544: Modules/Setup.local is no longer used as
    a landmark to discover whether Python is running in
    a source tree, as it could potentially affect actual
    installs. The pybuilddir.txt file is now the sole indicator
    of running in a source tree.
  - gh-151159: Update macOS installer to use OpenSSL 3.5.7.
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error.
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - Core and Builtins
  - gh-151905: Fix OOM error handling in PyFrame_GetBack() to
    propagate exceptions instead of masking them as None.
  - gh-151722: Defer GC tracking of frozendict to end of
    construction. Patch by Donghee Na.
  - gh-151546: Fix the stack limit check if Python is linked to
    musl (ex: Alpine Linux). Use the stack size set by the
    linker to compute the stack limits. Patch by Victor
    Stinner.
  - gh-151510: Fix a crash in __lazy_import__() when called
    without an explicit globals argument and without a current
    Python frame.
  - gh-151461: Fix direct execution of files with invalid
    source encodings to report the underlying codec lookup or
    decoding error instead of the generic SyntaxError: encoding
    problem message. Patch by Bartosz Sławecki.
  - gh-151218: PyConfig_Set() and sys.set_int_max_str_digits()
    now replace sys.flags (create a new object), instead of
    modifying sys.flags in-place. Patch by Victor Stinner.
  - gh-151297: Fix an invalid pointer dereference that could
    occur when calling PyObject_Realloc() with a NULL pointer
    in free-threaded builds or with PYTHONMALLOC set to
    mimalloc.
  - gh-151253: If import encodings (first import) fails at
    Python startup, dump the Python path configuration to help
    users debugging their configuration. Patch by Victor
    Stinner.
  - gh-151238: Fix a crash when compiling a concatenated
    f-string or t-string if an error occurs when processing one
    of it’s parts.
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in: code compilation,
    _interpchannels module, _winapi.CreateProcess() function.
  - Now these places raise proper MemoryError errors.
  - gh-150902: Apply an existing optimization of
    PyCriticalSection (single mutex) to PyCriticalSection2:
    avoid acquiring the same locks that the current CS has
    already acquired.
  - gh-151065: Fix memory leak when using the mimalloc memory
    allocator.
  - gh-150988: Fix a reference leak in OSError when attributes
    are set before super().__init__().
  - gh-150723: Fix perf jitdump timestamps on macOS. Events
    were stamped using CLOCK_MONOTONIC, but macOS profilers
    timestamp their samples with mach_absolute_time(). The
    mismatch prevented the JIT code mappings from lining up
    with the samples, so no Python frame could be resolved.
  - gh-150723: Fix malformed perf jitdump thread ids on macOS.
    The thread_id field of the JR_CODE_LOAD record was written
    as a 64-bit value instead of the 32-bit value required by
    the jitdump format, which shifted every following field and
    prevented profilers from resolving Python frames.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149321: Do not support none as a lazy imports mode.
  - Library
  - gh-75666: Fix a reference leak in tkinter: the Tcl commands
    created for event callbacks are now deleted when a binding
    is replaced or unbound.
  - gh-151770: Fix datetime.datetime.fromisoformat() raising
    AssertionError instead of ValueError for an out-of-range
    month combined with a 24:00 time.
  - gh-151665: inspect.signature() now works on the lazy
    evaluators of type aliases and type parameters instead of
    raising ValueError.
  - gh-151695: Fix a use-after-free in the curses module. The
    encoding of the initial screen, used by curses.unctrl() and
    curses.ungetch() to encode non-ASCII characters, is now
    kept as a private copy instead of a borrowed pointer to
    a window object that may be deallocated.
  - gh-151436: Fix skewed stack trackes in the Tachyon profiler
    when caching is enabled and when generators and coroutines
    are profiled, by updating tstate->last_profiled_frame at
    every frame-removal site. The issue resulted in total
    erasure of some callers. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-151426: Fix impossible stack traces (callers and callees
    cross called, orphans and incorrect lines) in the Tachyon
    profiler when caching frames, by snapshotting the stack
    chunks before walking the frame chain on a cache miss.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-151403: Fixed a crash in subprocess.Popen (and
    _posixsubprocess.fork_exec) when an argv item’s
    __fspath__() concurrently mutates the args sequence being
    converted.
  - gh-151390: Colorize match in the REPL when followed by
    a unary + or - operator. Patch by Bartosz Sławecki.
  - gh-151126: Fix crash on unset MemoryError on allocation
    failure in ctypes.get_errno().
  - gh-151337: Avoid possible memory leak in tkinter.c on
    Windows.
  - gh-151126: Fix a crash when MemoryError in
    os._path_splitroot() was not set properly.
  - gh-149671: Restore compatibility with setuptools -nspkg.pth
    files in the site module. Inject sitedir variable in the
    frame which executes pth code. Patch by Victor Stinner.
  - gh-151295: Fixed a crash (use-after-free) in bytes.join()
    and bytearray.join() that could occur if an item’s
    __buffer__() concurrently mutates the sequence being
    joined. The mutation is now reported as a RuntimeError
    instead.
  - gh-109940: Fix Windows venv activation in cmd.exe to
    respect VIRTUAL_ENV_DISABLE_PROMPT.
  - gh-150771: Fix email messages created with shift_jis or
    euc-jp charsets. set_content() now stores the payload using
    the output charset (iso-2022-jp) so printing the message no
    longer raises UnicodeEncodeError.
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-151021: Fix mmap.mmap.find() and rfind() to return -1
    when searching for an empty subsequence with a start
    position past the end of the mapping.
  - gh-62825: Encodings “KS_C_5601-1987”, “KS X 1001”, etc are
    now aliases of “CP949” instead of “EUC-KR”.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150662: Fix the --gecko collector in profiling.sampling
    that kept every sample in memory. It now writes sample and
    marker data to temporary files and reads them back,
    ultimately building the output file at the end. Patch by
    Pablo Galindo and Maurycy Pawłowski-Wieroński.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-148932: Fix profiling.sampling on Windows virtual
    environments to resolve the actual Python PID from
    a virtual environment shim.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-53144: The email package now supports all aliases of
    Python codecs and uses MIME/IANA names for all IANA
    registered charsets.
  - gh-149891: Add support for more encoding aliases officially
    registered in IANA.
  - gh-149473: Calling os.environ.clear() now emits
    os._clearenv auditing event. Patch by Victor Stinner.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-143988: Fixed crashes in socket.socket.sendmsg() and
    socket.socket.recvmsg_into() that could occur if buffer
    sequences are concurrently mutated.
  - gh-120665: Fixed an issue where unittest loaders would load
    and instantiate unittest.TestCase-derived subclasses that
    are also abstract base classes, which can’t be
    instantiated.
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - gh-101267: When a worker process terminates unexpectedly,
    concurrent.futures.ProcessPoolExecutor now sets a separate
    BrokenProcessPool exception on each pending future instead
    of sharing a single instance among them all. Sharing one
    exception produced malformed tracebacks: each
    Future.result() call re-raised the same object, appending
    another copy of the traceback to it.
  - Documentation
  - gh-86726: Greatly expand the tkinter documentation to cover
    the full public API of the package and its submodules. The
    descriptions are oriented towards Python rather than
    Tcl/Tk, with corrected return types and
    versionadded/versionchanged information.
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-150966: Avoid prematurely terminating failing live
    sampling profiler test targets, which made stderr
    assertions flaky on ASAN buildbots.
  - gh-148853: Fix tests failing on FreeBSD in test.support’s
    in_systemd_nspawn_sync_suppressed() due to unreadable /run
    directory.
  - Build
  - gh-151163: Updated Android build to include SQLite version
    3.53.2.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-141510: Add frozendict to the fast paths of
    PyMapping_GetOptionalItem(), PyMapping_Keys(),
    PyMapping_Values(), and PyMapping_Items().
  - gh-123619: PyUnstable_Object_EnableDeferredRefcount() now
    returns 0 if the object is not tracked by the garbage
    collector: if gc.is_tracked() is false. Patch by Victor
    Stinner.
  - gh-149044: Improved error message when specifying non-type
    base classes in Py_tp_bases, Py_tp_base, and bases argument
    to PyType_FromMetaclass() and other PyType_From* functions.
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.

++++ python315-documentation:

  - Update to 3.15.0~b3:
  - Security
  - gh-151544: Modules/Setup.local is no longer used as
    a landmark to discover whether Python is running in
    a source tree, as it could potentially affect actual
    installs. The pybuilddir.txt file is now the sole indicator
    of running in a source tree.
  - gh-151159: Update macOS installer to use OpenSSL 3.5.7.
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error.
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - Core and Builtins
  - gh-151905: Fix OOM error handling in PyFrame_GetBack() to
    propagate exceptions instead of masking them as None.
  - gh-151722: Defer GC tracking of frozendict to end of
    construction. Patch by Donghee Na.
  - gh-151546: Fix the stack limit check if Python is linked to
    musl (ex: Alpine Linux). Use the stack size set by the
    linker to compute the stack limits. Patch by Victor
    Stinner.
  - gh-151510: Fix a crash in __lazy_import__() when called
    without an explicit globals argument and without a current
    Python frame.
  - gh-151461: Fix direct execution of files with invalid
    source encodings to report the underlying codec lookup or
    decoding error instead of the generic SyntaxError: encoding
    problem message. Patch by Bartosz Sławecki.
  - gh-151218: PyConfig_Set() and sys.set_int_max_str_digits()
    now replace sys.flags (create a new object), instead of
    modifying sys.flags in-place. Patch by Victor Stinner.
  - gh-151297: Fix an invalid pointer dereference that could
    occur when calling PyObject_Realloc() with a NULL pointer
    in free-threaded builds or with PYTHONMALLOC set to
    mimalloc.
  - gh-151253: If import encodings (first import) fails at
    Python startup, dump the Python path configuration to help
    users debugging their configuration. Patch by Victor
    Stinner.
  - gh-151238: Fix a crash when compiling a concatenated
    f-string or t-string if an error occurs when processing one
    of it’s parts.
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in: code compilation,
    _interpchannels module, _winapi.CreateProcess() function.
  - Now these places raise proper MemoryError errors.
  - gh-150902: Apply an existing optimization of
    PyCriticalSection (single mutex) to PyCriticalSection2:
    avoid acquiring the same locks that the current CS has
    already acquired.
  - gh-151065: Fix memory leak when using the mimalloc memory
    allocator.
  - gh-150988: Fix a reference leak in OSError when attributes
    are set before super().__init__().
  - gh-150723: Fix perf jitdump timestamps on macOS. Events
    were stamped using CLOCK_MONOTONIC, but macOS profilers
    timestamp their samples with mach_absolute_time(). The
    mismatch prevented the JIT code mappings from lining up
    with the samples, so no Python frame could be resolved.
  - gh-150723: Fix malformed perf jitdump thread ids on macOS.
    The thread_id field of the JR_CODE_LOAD record was written
    as a 64-bit value instead of the 32-bit value required by
    the jitdump format, which shifted every following field and
    prevented profilers from resolving Python frames.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149321: Do not support none as a lazy imports mode.
  - Library
  - gh-75666: Fix a reference leak in tkinter: the Tcl commands
    created for event callbacks are now deleted when a binding
    is replaced or unbound.
  - gh-151770: Fix datetime.datetime.fromisoformat() raising
    AssertionError instead of ValueError for an out-of-range
    month combined with a 24:00 time.
  - gh-151665: inspect.signature() now works on the lazy
    evaluators of type aliases and type parameters instead of
    raising ValueError.
  - gh-151695: Fix a use-after-free in the curses module. The
    encoding of the initial screen, used by curses.unctrl() and
    curses.ungetch() to encode non-ASCII characters, is now
    kept as a private copy instead of a borrowed pointer to
    a window object that may be deallocated.
  - gh-151436: Fix skewed stack trackes in the Tachyon profiler
    when caching is enabled and when generators and coroutines
    are profiled, by updating tstate->last_profiled_frame at
    every frame-removal site. The issue resulted in total
    erasure of some callers. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-151426: Fix impossible stack traces (callers and callees
    cross called, orphans and incorrect lines) in the Tachyon
    profiler when caching frames, by snapshotting the stack
    chunks before walking the frame chain on a cache miss.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-151403: Fixed a crash in subprocess.Popen (and
    _posixsubprocess.fork_exec) when an argv item’s
    __fspath__() concurrently mutates the args sequence being
    converted.
  - gh-151390: Colorize match in the REPL when followed by
    a unary + or - operator. Patch by Bartosz Sławecki.
  - gh-151126: Fix crash on unset MemoryError on allocation
    failure in ctypes.get_errno().
  - gh-151337: Avoid possible memory leak in tkinter.c on
    Windows.
  - gh-151126: Fix a crash when MemoryError in
    os._path_splitroot() was not set properly.
  - gh-149671: Restore compatibility with setuptools -nspkg.pth
    files in the site module. Inject sitedir variable in the
    frame which executes pth code. Patch by Victor Stinner.
  - gh-151295: Fixed a crash (use-after-free) in bytes.join()
    and bytearray.join() that could occur if an item’s
    __buffer__() concurrently mutates the sequence being
    joined. The mutation is now reported as a RuntimeError
    instead.
  - gh-109940: Fix Windows venv activation in cmd.exe to
    respect VIRTUAL_ENV_DISABLE_PROMPT.
  - gh-150771: Fix email messages created with shift_jis or
    euc-jp charsets. set_content() now stores the payload using
    the output charset (iso-2022-jp) so printing the message no
    longer raises UnicodeEncodeError.
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-151021: Fix mmap.mmap.find() and rfind() to return -1
    when searching for an empty subsequence with a start
    position past the end of the mapping.
  - gh-62825: Encodings “KS_C_5601-1987”, “KS X 1001”, etc are
    now aliases of “CP949” instead of “EUC-KR”.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150662: Fix the --gecko collector in profiling.sampling
    that kept every sample in memory. It now writes sample and
    marker data to temporary files and reads them back,
    ultimately building the output file at the end. Patch by
    Pablo Galindo and Maurycy Pawłowski-Wieroński.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-148932: Fix profiling.sampling on Windows virtual
    environments to resolve the actual Python PID from
    a virtual environment shim.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-53144: The email package now supports all aliases of
    Python codecs and uses MIME/IANA names for all IANA
    registered charsets.
  - gh-149891: Add support for more encoding aliases officially
    registered in IANA.
  - gh-149473: Calling os.environ.clear() now emits
    os._clearenv auditing event. Patch by Victor Stinner.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-143988: Fixed crashes in socket.socket.sendmsg() and
    socket.socket.recvmsg_into() that could occur if buffer
    sequences are concurrently mutated.
  - gh-120665: Fixed an issue where unittest loaders would load
    and instantiate unittest.TestCase-derived subclasses that
    are also abstract base classes, which can’t be
    instantiated.
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - gh-101267: When a worker process terminates unexpectedly,
    concurrent.futures.ProcessPoolExecutor now sets a separate
    BrokenProcessPool exception on each pending future instead
    of sharing a single instance among them all. Sharing one
    exception produced malformed tracebacks: each
    Future.result() call re-raised the same object, appending
    another copy of the traceback to it.
  - Documentation
  - gh-86726: Greatly expand the tkinter documentation to cover
    the full public API of the package and its submodules. The
    descriptions are oriented towards Python rather than
    Tcl/Tk, with corrected return types and
    versionadded/versionchanged information.
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-150966: Avoid prematurely terminating failing live
    sampling profiler test targets, which made stderr
    assertions flaky on ASAN buildbots.
  - gh-148853: Fix tests failing on FreeBSD in test.support’s
    in_systemd_nspawn_sync_suppressed() due to unreadable /run
    directory.
  - Build
  - gh-151163: Updated Android build to include SQLite version
    3.53.2.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-141510: Add frozendict to the fast paths of
    PyMapping_GetOptionalItem(), PyMapping_Keys(),
    PyMapping_Values(), and PyMapping_Items().
  - gh-123619: PyUnstable_Object_EnableDeferredRefcount() now
    returns 0 if the object is not tracked by the garbage
    collector: if gc.is_tracked() is false. Patch by Victor
    Stinner.
  - gh-149044: Improved error message when specifying non-type
    base classes in Py_tp_bases, Py_tp_base, and bases argument
    to PyType_FromMetaclass() and other PyType_From* functions.
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.

++++ python315-nogil:

  - Update to 3.15.0~b3:
  - Security
  - gh-151544: Modules/Setup.local is no longer used as
    a landmark to discover whether Python is running in
    a source tree, as it could potentially affect actual
    installs. The pybuilddir.txt file is now the sole indicator
    of running in a source tree.
  - gh-151159: Update macOS installer to use OpenSSL 3.5.7.
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error.
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - Core and Builtins
  - gh-151905: Fix OOM error handling in PyFrame_GetBack() to
    propagate exceptions instead of masking them as None.
  - gh-151722: Defer GC tracking of frozendict to end of
    construction. Patch by Donghee Na.
  - gh-151546: Fix the stack limit check if Python is linked to
    musl (ex: Alpine Linux). Use the stack size set by the
    linker to compute the stack limits. Patch by Victor
    Stinner.
  - gh-151510: Fix a crash in __lazy_import__() when called
    without an explicit globals argument and without a current
    Python frame.
  - gh-151461: Fix direct execution of files with invalid
    source encodings to report the underlying codec lookup or
    decoding error instead of the generic SyntaxError: encoding
    problem message. Patch by Bartosz Sławecki.
  - gh-151218: PyConfig_Set() and sys.set_int_max_str_digits()
    now replace sys.flags (create a new object), instead of
    modifying sys.flags in-place. Patch by Victor Stinner.
  - gh-151297: Fix an invalid pointer dereference that could
    occur when calling PyObject_Realloc() with a NULL pointer
    in free-threaded builds or with PYTHONMALLOC set to
    mimalloc.
  - gh-151253: If import encodings (first import) fails at
    Python startup, dump the Python path configuration to help
    users debugging their configuration. Patch by Victor
    Stinner.
  - gh-151238: Fix a crash when compiling a concatenated
    f-string or t-string if an error occurs when processing one
    of it’s parts.
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in: code compilation,
    _interpchannels module, _winapi.CreateProcess() function.
  - Now these places raise proper MemoryError errors.
  - gh-150902: Apply an existing optimization of
    PyCriticalSection (single mutex) to PyCriticalSection2:
    avoid acquiring the same locks that the current CS has
    already acquired.
  - gh-151065: Fix memory leak when using the mimalloc memory
    allocator.
  - gh-150988: Fix a reference leak in OSError when attributes
    are set before super().__init__().
  - gh-150723: Fix perf jitdump timestamps on macOS. Events
    were stamped using CLOCK_MONOTONIC, but macOS profilers
    timestamp their samples with mach_absolute_time(). The
    mismatch prevented the JIT code mappings from lining up
    with the samples, so no Python frame could be resolved.
  - gh-150723: Fix malformed perf jitdump thread ids on macOS.
    The thread_id field of the JR_CODE_LOAD record was written
    as a 64-bit value instead of the 32-bit value required by
    the jitdump format, which shifted every following field and
    prevented profilers from resolving Python frames.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149321: Do not support none as a lazy imports mode.
  - Library
  - gh-75666: Fix a reference leak in tkinter: the Tcl commands
    created for event callbacks are now deleted when a binding
    is replaced or unbound.
  - gh-151770: Fix datetime.datetime.fromisoformat() raising
    AssertionError instead of ValueError for an out-of-range
    month combined with a 24:00 time.
  - gh-151665: inspect.signature() now works on the lazy
    evaluators of type aliases and type parameters instead of
    raising ValueError.
  - gh-151695: Fix a use-after-free in the curses module. The
    encoding of the initial screen, used by curses.unctrl() and
    curses.ungetch() to encode non-ASCII characters, is now
    kept as a private copy instead of a borrowed pointer to
    a window object that may be deallocated.
  - gh-151436: Fix skewed stack trackes in the Tachyon profiler
    when caching is enabled and when generators and coroutines
    are profiled, by updating tstate->last_profiled_frame at
    every frame-removal site. The issue resulted in total
    erasure of some callers. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-151426: Fix impossible stack traces (callers and callees
    cross called, orphans and incorrect lines) in the Tachyon
    profiler when caching frames, by snapshotting the stack
    chunks before walking the frame chain on a cache miss.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-151403: Fixed a crash in subprocess.Popen (and
    _posixsubprocess.fork_exec) when an argv item’s
    __fspath__() concurrently mutates the args sequence being
    converted.
  - gh-151390: Colorize match in the REPL when followed by
    a unary + or - operator. Patch by Bartosz Sławecki.
  - gh-151126: Fix crash on unset MemoryError on allocation
    failure in ctypes.get_errno().
  - gh-151337: Avoid possible memory leak in tkinter.c on
    Windows.
  - gh-151126: Fix a crash when MemoryError in
    os._path_splitroot() was not set properly.
  - gh-149671: Restore compatibility with setuptools -nspkg.pth
    files in the site module. Inject sitedir variable in the
    frame which executes pth code. Patch by Victor Stinner.
  - gh-151295: Fixed a crash (use-after-free) in bytes.join()
    and bytearray.join() that could occur if an item’s
    __buffer__() concurrently mutates the sequence being
    joined. The mutation is now reported as a RuntimeError
    instead.
  - gh-109940: Fix Windows venv activation in cmd.exe to
    respect VIRTUAL_ENV_DISABLE_PROMPT.
  - gh-150771: Fix email messages created with shift_jis or
    euc-jp charsets. set_content() now stores the payload using
    the output charset (iso-2022-jp) so printing the message no
    longer raises UnicodeEncodeError.
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-151021: Fix mmap.mmap.find() and rfind() to return -1
    when searching for an empty subsequence with a start
    position past the end of the mapping.
  - gh-62825: Encodings “KS_C_5601-1987”, “KS X 1001”, etc are
    now aliases of “CP949” instead of “EUC-KR”.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150662: Fix the --gecko collector in profiling.sampling
    that kept every sample in memory. It now writes sample and
    marker data to temporary files and reads them back,
    ultimately building the output file at the end. Patch by
    Pablo Galindo and Maurycy Pawłowski-Wieroński.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-148932: Fix profiling.sampling on Windows virtual
    environments to resolve the actual Python PID from
    a virtual environment shim.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-53144: The email package now supports all aliases of
    Python codecs and uses MIME/IANA names for all IANA
    registered charsets.
  - gh-149891: Add support for more encoding aliases officially
    registered in IANA.
  - gh-149473: Calling os.environ.clear() now emits
    os._clearenv auditing event. Patch by Victor Stinner.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-143988: Fixed crashes in socket.socket.sendmsg() and
    socket.socket.recvmsg_into() that could occur if buffer
    sequences are concurrently mutated.
  - gh-120665: Fixed an issue where unittest loaders would load
    and instantiate unittest.TestCase-derived subclasses that
    are also abstract base classes, which can’t be
    instantiated.
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - gh-101267: When a worker process terminates unexpectedly,
    concurrent.futures.ProcessPoolExecutor now sets a separate
    BrokenProcessPool exception on each pending future instead
    of sharing a single instance among them all. Sharing one
    exception produced malformed tracebacks: each
    Future.result() call re-raised the same object, appending
    another copy of the traceback to it.
  - Documentation
  - gh-86726: Greatly expand the tkinter documentation to cover
    the full public API of the package and its submodules. The
    descriptions are oriented towards Python rather than
    Tcl/Tk, with corrected return types and
    versionadded/versionchanged information.
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-150966: Avoid prematurely terminating failing live
    sampling profiler test targets, which made stderr
    assertions flaky on ASAN buildbots.
  - gh-148853: Fix tests failing on FreeBSD in test.support’s
    in_systemd_nspawn_sync_suppressed() due to unreadable /run
    directory.
  - Build
  - gh-151163: Updated Android build to include SQLite version
    3.53.2.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-141510: Add frozendict to the fast paths of
    PyMapping_GetOptionalItem(), PyMapping_Keys(),
    PyMapping_Values(), and PyMapping_Items().
  - gh-123619: PyUnstable_Object_EnableDeferredRefcount() now
    returns 0 if the object is not tracked by the garbage
    collector: if gc.is_tracked() is false. Patch by Victor
    Stinner.
  - gh-149044: Improved error message when specifying non-type
    base classes in Py_tp_bases, Py_tp_base, and bases argument
    to PyType_FromMetaclass() and other PyType_From* functions.
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.

++++ rapidcsv:

  - update to 8.99:
    * fixes #220 - use ptrdiff_t for iterator arithmetic to avoid
    integer overflow

++++ rocksndiamonds:

  - Update to version 4.4.2.3
    * added checkbox to use optional EM/DC style player explosions
    * changed killing player not before, but after digging land mine
    * fixed highlighting player name after editing on names screen
    * fixed a few potential string buffer overflow problems

++++ rocksndiamonds-data:

  - Add Diamond Caves level collection, Diamond_Caves-1.0.0.zip
  - This is a classic collection of level groups from the Amiga
    game Diamond Caves, created by Peter Elzner in 1995 as a
    clone of the Amiga game Emerald Mine.
  - This level collection features 12 level groups that were
    exclusively available for Diamond Caves, and 26 level groups
    converted from the Emerald Mine Club collection to be played
    with Diamond Caves. Most level sets are designed to support
    either one or two players.

++++ rumdl:

  - Update to version 0.2.24:
    * Added
  - MD043: report expected and actual headings at first mismatch
    (#696) (57f0902) - thanks @mkowen1
  - MD013: add semantic-link-understanding to flag long-URL links
    in stern mode (#691) (f17e3f7) - thanks @chandlerc
    * Fixed
  - MD013: extend standalone-link reflow boundary to blockquotes
    (74e79f6)
  - MD013: treat standalone links as paragraph boundaries in
    reflow (#697) (39ea2b2) - thanks @chandlerc
  - MD013: associate paragraph reflow fix with all violating
    lines (#698) (f17be35) - thanks @chandlerc
  - fix-coordinator: honor inline rumdl-configure-file overrides
    when applying fixes (c347ab6)
  - MD013: exempt standalone links with trailing punctuation and
    wrappers (#694) (d7a3c2e) - thanks @chandlerc
  - MD013: keep the space after an inline code span before
    punctuation (#693) (13745db) - thanks @chandlerc
  - lsp: iterate formatting fixes to a fixpoint so one format
    pass converges (#695) (78c42ad) - thanks @chandlerc
  - MD028: make blockquote-merge autofix opt-in by default
    (cffadef)
  - MD036: make emphasis-to-heading autofix opt-in by default
    (9b145a9)
  - MD007: scope fence-opening exception to backtick/tilde fences
    (2a3a554)
  - MD007: keep nested lists nested under a fence-opening list
    item (59f987e) - thanks @chandlerc
  - Update to version 0.2.23:
    * Added
  - rules: add MD082 to require content between headings
    (e5592ae)
    * Fixed
  - lint-context: attach list items whose marker line opens a
    code fence (95898f4)
  - parser: parse reference-definition titles on a continuation
    line (fb02b52)
  - cli: make per-file exclude notice verbose-only (2923e27)

++++ semaphore:

  - update to 2.18.13:
    * Bugfixes
  - Fix token validation

++++ setxkbmap:

  - update to 1.3.5:
    * Man page: update history from XFree86 4.3 to 3.2
    * setxkbmap references appear as far back as 3.2 in the XFree86
    Changelog.
    * manual page: Rewrite in semantic markup
    * Rewrite the reference manual in BSD-style mdoc(7) semantic
    markup, providing greatly enhanced search on all supported manual
    compilers.
    * Improve man page formatting
    * More closely follow common style as described on
    * meson: Add option to build with meson

++++ skaffold:

  - Update to version 2.23.0:
    * Revert "chore: bump actions/checkout from 6 to 7 in the
    github-actions group" (#10123)
    * Revert "chore: bump go.mongodb.org/mongo-driver from 1.8.4 to
    1.17.7 in /integration/examples/multiple-renderers/backend/src"
    (#10122)
    * Revert "chore: bump puma from 5.6.9 to 7.2.1 in
    /integration/examples/ruby/backend" (#10121)
    * Revert "chore: bump the golang group across 1 directory with 19
    updates" (#10120)
    * chore: bump actions/checkout from 6 to 7 in the github-actions
    group (#10115)
    * chore: bump go.mongodb.org/mongo-driver from 1.8.4 to 1.17.7 in
    /examples/multiple-renderers/backend/src (#10113)
    * chore: bump go.mongodb.org/mongo-driver from 1.8.4 to 1.17.7 in
    /integration/examples/multiple-renderers/backend/src (#10112)
    * chore: bump puma from 5.6.9 to 7.2.1 in /examples/ruby/backend
    (#10105)
    * chore: bump puma from 5.6.9 to 7.2.1 in
    /integration/examples/ruby/backend (#10104)
    * chore: bump the golang group across 1 directory with 19 updates
    (#10119)
    * chore: bump github.com/containerd/containerd from 1.7.32 to
    1.7.33 (#10118)

++++ skillspector:

  - Initial package skillspector 2.3.10 (CLI scanner; -mcp subpackage
    for the MCP server)
  - Enable the pytest test suite now that the full langchain/langgraph
    runtime stack is packaged; the offline unit tests run at build time
    (integration/provider markers and four SSRF allowed-host tests that
    require live DNS are deselected)

++++ snd:

  - update to 26.4:
    * s7: nested-define (stuff.scm) -- sometimes called curried-
    define

++++ socat:

  - update to 1.8.1.3 (bsc#1269219, CVE-2026-56123):
    * The new SOCKS5_OVERFL test for CVE-2026-56123 failed on
    platforms with non-bash default shell (false positive).
    * There was a possible heap overflow in the socks5 client code.
    It could be triggered by connecting to a malicious socks5
    server that expected this connection and had knowledge about
    details of the client binary code.

++++ spyder:

  - update to 6.1.5:
    * Add support to use Ruff as code formatter in
    * `Preferences > Completion and linting > Code formatting`.
    * Make the IPython console work for Pixi global environments.
    * Increase max number of plots in the Plots pane to 10,000.
    Also, show message when that number is reached.
    * Correctly show signatures with type annotations in the Help
    pane.
    * Fix hard crash when restarting the kernel of related IPython
    consoles.
    * Several fixes to the update process of the standalone
    installers.

++++ stripe-mock:

  - update to 0.201.0:
    * Fix vulnerable Go version in release workflow (fixes #1637)
  - update to 0.200.0:
    * OpenAPI Update
  - update to 0.199.0:
    * fix tests on Go 1.26
  - update to 0.198.0:
    * Add x-stableId to supported schema fields
    * Add explicit permissions to GitHub workflows
    * OpenAPI Update

++++ syft:

  - Update to version 1.46.0:
    * Added Features
  - Add purl types to cataloger info cmd [PR #4984 @wagoodman]
  - Python cataloger misses uv PEP 723 script lockfiles
    (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu]
  - Add bin classifier for Elastic agen [Issue #4973] [PR #4968
    @rezmoss]
  - SPDX 3 Support [Issue #4250] [PR #4269 @kzantow]
  - Add Deno support [Issue #4417] [PR #4523 @rezmoss]
  - Catalog Elastic Beats binary [Issue #4961] [PR #4969
    @rezmoss]
  - Add binary classifiers for Elastic Beats [Issue #4972] [PR
    [#4969] @rezmoss]
  - Catalog elastic-agent binary [Issue #4962]
  - Add support for Bun lockfile (bun.lock) [Issue #4617] [PR
    [#4625] @hnnynh]
  - Add .bpl file support to the PE / DLL cataloger [Issue #4664]
    [PR #4954 @jfjrh2014]
    * Bug Fixes
  - respect arch qualifier [PR #4987 @willmurphyscode]
  - Preserve dependency edges when a compliance stub changes a
    package ID [PR #4993 @wagoodman]
  - Support envoy binary various versions [Issue #4590] [PR #4605
    @rezmoss]
  - .net deps.json cataloger shows phantom pkgs for reference
    assembly library entries [Issue #4970] [PR #4971 @rezmoss]
  - Syft does not extract package licenses from opkg manager
    [Issue #4940] [PR #4963 @Dashtid]
  - squashfs breaks with godisk-fs 1.8.0 [Issue #4718]
  - requirements.txt cataloger silently drops PEP 440 local
    version identifiers, producing incorrect PURL [Issue #4958]
    [PR #4959 @kzantow]
    * Dependencies
  - 34 dependency changes (31 updated, 3 added). 5
    vulnerabilities remediated.
    * Remediated (5)
  - GHSA-33vj-92qq-66hc (High) —
    github.com/containerd/containerd/v2
  - GHSA-cvxm-645q-p574 (Medium) —
    github.com/containerd/containerd/v2
  - GHSA-jpcc-p29g-p8mq (Medium) —
    github.com/containerd/containerd/v2
  - GHSA-rgh6-rfwx-v388 (High) —
    github.com/containerd/containerd/v2
  - GHSA-xhf5-7wjv-pqxp (High) —
    github.com/containerd/containerd/v2
    * Updated (31 packages)
  - github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
  - github.com/anchore/bubbly v0.2.0 → v0.2.1
  - github.com/anchore/clio v0.1.0 → v0.1.1
  - github.com/anchore/fangs v0.1.0 → v0.1.1
  - github.com/anchore/go-collections v0.1.0 → v0.1.1
  - github.com/anchore/go-homedir v0.1.0 → v0.1.1
  - github.com/anchore/go-logger v0.1.0 → v0.1.1
  - github.com/anchore/go-lzo v0.1.0 → v0.1.1
  - github.com/anchore/go-macholibre v0.1.0 → v0.1.1
  - github.com/anchore/go-make v0.5.0 → v0.8.0
  - github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
  - github.com/anchore/go-sync v0.1.0 → v0.1.1
  - github.com/anchore/stereoscope v0.2.1 → v0.2.2
  - github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
  - github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
  - github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
  - github.com/containerd/containerd/v2 v2.3.1 → v2.3.2
    (remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574,
    GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388,
    GHSA-xhf5-7wjv-pqxp)
  - github.com/docker/cli v29.4.3+incompatible →
    v29.5.3+incompatible
  - github.com/google/go-containerregistry v0.21.6 → v0.21.7
  - github.com/jedib0t/go-pretty/v6 v6.7.10 → v6.8.1
  - github.com/mattn/go-runewidth v0.0.19 → v0.0.21
  - github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
  - github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
  - golang.org/x/crypto v0.52.0 → v0.53.0
  - golang.org/x/mod v0.36.0 → v0.37.0
  - golang.org/x/net v0.55.0 → v0.56.0
  - golang.org/x/sync v0.20.0 → v0.21.0
  - golang.org/x/sys v0.45.0 → v0.46.0
  - golang.org/x/term v0.43.0 → v0.44.0
  - golang.org/x/text v0.37.0 → v0.38.0
  - golang.org/x/tools v0.45.0 → v0.46.0
    * Added (3 packages)
  - github.com/piprate/json-gold v0.7.0
  - github.com/pquerna/cachecontrol v0.0.0-1555304
  - github.com/tailscale/hujson v0.0.0-ecc657c

++++ woodpecker:

  - Update to version 3.16.0:
    * Security
  - Gate Kubernetes serviceAccountName backend step config behind
    agent config [#6792]
  - Harden agent rpc to check agentID on workflow [#6759]
  - Security updates for js dependencies [#6737]
  - bump go.mongodb.org/mongo-driver v1.17.6 => v1.17.7 [#6741]
  - Update joi [#6728]
    * Features
  - Add workflow concurrency limit option [#6671]
  - Support Unix Sockets [#6721]
    * Enhancement
  - Kubernetes: allow custom image when precreating workingDir as
    nonroot [#6771]
  - Server can move pipeline parsing into background on long
    creation times [#6781]
  - Add CI_COMMIT_PULL_REQUEST_DRAFT environment variable [#6778]
  - Make LogEntry Buffer configurable for agent [#6773]
  - Agent treat gRPC Internal error as fatal [#6780]
  - Refactor to inject store and context into server scheduler
    [#6755]
  - Refactor server scheduler collect in new interface [#6753]
  - Add Prometheus metrics for pipeline step duration and
    failures [#6738]
  - Add k8s userns support [#6710]
  - Make cli exec auto detect single workflow test in multi
    workflow setup [#6715]
  - Surface .env load errors [#6707]
  - Group commands followup user preference [#6694]
  - Trim white spaces for cron create/update [#6690]
  - Improve slow user authorization if many orgs/repos [#5665]
  - pipeline: use more explizite error for step dependencies
    filtered out by its conditions [#6680]
  - Add commit timestamp env vars [#6670]
  - Show forge in users list [#6666]
    * Bug Fixes
  - Allow images for secrets to contain SHA256 for image pinning
    [#6784]
  - server should drop stale queue tasks already missing in
    database [#6765]
  - server queue api should ignore missing agent [#6763]
  - docs: deps migrate gray-matter to maintained fork [#6744]
  - local backend: on windows use process tree-walk as workaround
    to kill [#6718]
  - Fix issue with deeply nested k8s backend_options [#6730]
  - cli exec: have uniq prefix for each workflow [#6716]
  - github dont fail on force push [#6697]
  - fix(kubernetes): retry WaitStep when container terminated
    state not yet finalized [#6672]
    * Tests
  - More test coverage of server/api/... [#6712]
  - Add e2e test that assert workflow depends_on enforces
    ordering [#6711]
  - Add more tests in areas not well covered [#6696]
  - Cleanup e2e test setup [#6480]
    * Documentation
  - Update docs npm deps non-major [#6786]
  - Check docs JS files for spelling [#6758]
  - Remove openbao extension [#6757]
  - Update docs npm deps non-major [#6747]
  - adds git-pages plugin [#6736]
  - Update docs npm deps non-major to v1.18.0 [#6731]
  - Update docs npm deps non-major to v3.17.0 [#6726]
  - Update docs npm deps non-major [#6722]
  - Update docs npm deps non-major [#6705]
  - Add Podman plugin [#6701]
  - Update docs npm deps non-major [#6679]
  - Update dependency concurrently to v10 [#6676]
  - Update docs npm deps non-major [#6675]
  - docs: add cli exec examples [#6629]
    * Dependency
  - Update pre-commit hook rbubley/mirrors-prettier to v3.8.5
    [#6791]
  - Update golang-packages [#6782]
  - Update web npm deps non-major [#6761]
  - Update golang-packages [#6767]
  - Lock file maintenance [#6768]
  - Update module github.com/cenkalti/backoff/v5 to v6 [#6752]
  - Update dependency http-proxy-middleware to v4 [#6750]
  - Update pre-commit non-major to v0.49.0 [#6749]
  - Update docker.io/mysql Docker tag to v9.7.1 [#6746]
  - Lock file maintenance [#6733]
  - Update docker.io/alpine Docker tag to v3.24 [#6725]
  - Update pre-commit non-major to v3.8.4 [#6723]
  - Lock file maintenance [#6709]
  - Update golang-lang to v1.26.4 [#6704]
  - bump github.com/quic-go/quic-go to v0.59.1 [#6700]
  - Update docker.io/woodpeckerci/plugin-trivy Docker tag to
    v1.6.0 [#6699]
  - Lock file maintenance [#6686]
  - Update woodpeckerci/plugin-git Docker tag to v2.9.2 [#6674]
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.36.0 [#6668]
  - Migrate gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 [#6651]
    * Misc
  - Rename editorconfig file [#6734]

++++ telemetrygen:

  - Update to version 0.155.0:
    No telemetrygen-related changes
    Dependencies
    * Update github-actions deps (major) (#49290)
    * Update module github.com/jellydator/ttlcache/v3 to v3.4.1
    (#49252)
    * Update testcontainers-go monorepo (#49278)
    * Update dependency js-yaml to v5 (#49281)
    * Update module modernc.org/sqlite to v1.53.0 (#49277)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.40.1
    (#49275)
    * Update module github.com/redis/go-redis/v9 to v9.21.0 (#49273)
    * Update module go.etcd.io/bbolt to v1.5.0 (#49276)
    * Update module github.com/moby/moby/api to v1.55.0 (#49264)
    * Update All golang.org/x packages (#49255)
    * Update module github.com/open-telemetry/otel-arrow/go to
    v0.49.0 (#49271)
    * Update module github.com/prometheus/common to v0.69.0 (#49272)
    * Update All github.com/aws packages (#49254)
    * Update github-actions deps (#49260)
    * Update module github.com/coreos/go-oidc/v3 to v3.19.0 (#49261)
    * Update module github.com/hetznercloud/hcloud-go/v2 to v2.44.0
    (#49263)
    * Update module github.com/moby/moby/client to v0.5.0 (#49265)
    * Update module github.com/huaweicloud/huaweicloud-sdk-go-v3 to
    v0.1.201 (#49251)
    * Update mongo driver v2 to v2.7.0 (#49248)
    * Update All github.com/datadog packages (#49250)
    * Update dockerfile deps (#49249)
    * [chore] Update core dependencies (#49176)
    * Update All github.com/aws packages (#49129)
    * Update module github.com/rabbitmq/amqp091-go to v1.12.0
    (#49122)
    * Update module github.com/apache/cassandra-gocql-driver/v2 to
    v2.1.2 (#49121)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.39.0
    (#49117)
    * Update module github.com/prometheus-community/pro-bing to
    v0.9.0 (#49116)
    * Update module github.com/hetznercloud/hcloud-go/v2 to v2.43.0
    (#49115)
    * Update module github.com/klauspost/compress to v1.18.6 (#49093)
    * Update module github.com/getsentry/sentry-go to v0.47.0
    (#49113)
    * Update module github.com/apache/pulsar-client-go to v0.20.0
    (#49112)
    * Update module github.com/redis/go-redis/v9 to v9.20.1 (#49094)
    * Update module github.com/tg123/go-htpasswd to v1.2.5 (#49100)
    * Update All golang.org/x packages (#49106)
    * Update module github.com/SAP/go-hdb to v1.16.12 (#49095)
    * Update module github.com/huaweicloud/huaweicloud-sdk-go-v3 to
    v0.1.200 (#49092)
    * Update dockerfile deps (#49099)
    * Update module software.sslmate.com/src/go-pkcs12 to v0.7.2
    (#49104)
    * Update All github.com/azure packages (#49105)
    * Update docker-compose deps to v0.154.0 (#49107)
    * Update All github.com/aws packages (#49089)
    * Update dockerfile deps (#49088)
    * [chore] Update core dependencies (#49076)
    * [chore] Update core dependencies (#49033)
    * Updated Oracle README to document wait_sample metrics (#48846)
    * Updated first load time for top query (#48999)
    * Update All github.com/aws packages (#48982)
    * Update dockerfile deps (#48981)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.36.3
    (#48974)
    * Update github-actions deps (#48957)
    * Update All golang.org/x packages (#48952)
    * Update All github.com/twmb/franz-go packages to v1.21.3
    (#48941)
    * Update module github.com/huaweicloud/huaweicloud-sdk-go-v3 to
    v0.1.199 (#48942)
    * Update module github.com/prometheus/common to v0.68.1 (#48943)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.36.2
    (#48944)
    * Update module go.opentelemetry.io/ebpf-profiler to v0.0.202623
    (#48946)
    * Update All github.com/googlecloudplatform packages to v1.33.0
    (#48951)
    * Update dockerfile deps (#48956)
    * Update module github.com/jackc/pgx/v5 to v5.10.0 (#48958)
    * Update module github.com/lib/pq to v1.12.3 (#48959)
    * Update module github.com/snowflakedb/gosnowflake/v2 to v2.1.0
    (#48961)
    * Update module modernc.org/sqlite to v1.52.0 (#48962)
    * Update github-actions deps to v7 (#48963)
    * Update module github.com/open-telemetry/otel-arrow/go to
    v0.48.0 (#48960)
    * Update All github.com/azure packages (#48949)
    * Update All github.com/aws packages (#48948)
  - Update to version 0.154.0:
    telemetrygen-related changes
    * [cmd/telemetrygen] Fix --allow-export-failures ignored in batch
    mode (#48764)
    Dependencies
    * [chore] Update core dependencies (#48939)
    * Update All github.com/datadog packages to v5.0.201 (#48935)
    * Update dockerfile deps (#48934)
    * [chore] Update core dependencies (#48906)
    * Update module github.com/google/go-github/v86 to v88 (#48656)
    * [chore] update opentelemetry-operations-go dependencies
    (#48894)
    * Update module
    github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/monitor/armmonitor
    to v0.12.0 (#48819)
    * [chore] Update core dependencies (#48884)
    * [chore]: update affiliation (#48852)
    * [chore] Update podman receiver documentation with rootless
    podman information (#48825)
    * Update All github.com/aws packages (#48845)
    * Update opentelemetry-go monorepo (#48842)
    * Update github-actions deps to v24 (#48844)
    * Update module modernc.org/sqlite to v1.51.0 (#48841)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.36.0
    (#48836)
    * Update All github.com/aws packages to v1.27.0 (#48829)
    * Update docker-compose deps to v3.12.0 (#48835)
    * Update github-actions deps to v6.0.3 (#48828)
    * Update module github.com/prometheus/common to v0.68.0 (#48822)
    * Update module github.com/redis/go-redis/v9 to v9.20.0 (#48823)
    * Update module github.com/hetznercloud/hcloud-go/v2 to v2.42.0
    (#48820)
    * Update module github.com/parquet-go/parquet-go to v0.30.1
    (#48821)
    * Update github-actions deps (#48818)
    * Update All opentelemetry-go-contrib packages (#48816)
    * Update module github.com/cockroachdb/pebble/v2 to v2.1.6
    (#48801)
    * Update module github.com/knadh/koanf/v2 to v2.3.5 (#48804)
    * Update module github.com/shirou/gopsutil/v4 to v4.26.5 (#48807)
    * Update module github.com/vmware/govmomi to v0.54.1 (#48810)
    * Update module go.opentelemetry.io/ebpf-profiler to v0.0.202622
    (#48811)
    * Update module github.com/SAP/go-hdb to v1.16.11 (#48806)
    * Update dependency js-yaml to v4.2.0 (#48817)
    * Update module github.com/DeRuina/timberjack to v1.4.5 (#48802)
    * Update docker/setup-qemu-action digest to 0611638 (#48795)
    * Update All github.com/aws packages (#48798)
    * Update module github.com/huaweicloud/huaweicloud-sdk-go-v3 to
    v0.1.198 (#48803)
    * Update mcr.microsoft.com/mssql/server:2025-latest Docker digest
    to d975fb1 (#48796)
    * [chore] Update core dependencies (#48756)
    * [chore] more updates from WriteString to fmt.Fprint (#48746)
    * Bump Prometheus to 3.12 (#48747)
    * Update module
    github.com/aws/aws-sdk-go-v2/service/servicediscovery to
    v1.40.0 (#48680)
    * Update module
    github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common
    to v1.3.103 (#48667)
    * Update module github.com/modelcontextprotocol/go-sdk to v1.6.1
    (#48647)
    * Update module github.com/lestrrat-go/strftime to v1.2.0
    (#48652)
    * Update docker-compose deps to v0.153.0 (#48653)
    * Update module
    github.com/Arize-ai/openinference/go/openinference-semantic-conventions
    to v0.1.1 (#48644)
    * Update module
    github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common
    to v1.3.102 (#48649)
    * Update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2
    (#48650)
    * Update module github.com/jaegertracing/jaeger-idl to v0.9.0
    (#48651)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.32.0
    (#48654)
    * Update module golang.org/x/sys to v0.45.0 (#48655)
    * Update github-actions deps (#48637)
    * Update module github.com/elastic/lunes to v0.2.2 (#48646)
    * Update dockerfile deps (#48636)
    * Update module github.com/DataDog/agent-payload/v5 to v5.0.199
    (#48645)
    * Update All github.com/aws packages (#48641)
    * Update docker-compose deps to v0.152.1 (#48642)

++++ tinyssh:

  - update to 20260601:
    * Fixed validation of client-controlled channel parameters.
    * Fixed packet buffer bounds in plain-text and
    chacha20-poly1305 packet handling.
    * Fixed truncated log messages in subprocess_auth.
    * Forced a minimal `maxpacket` value of 32 when opening
    channels.
    * Fixed README.md systemd variable substitution example.

++++ velero:

  - Update to version 1.18.2:
    * Bump golang.org/x/crypto to v0.52.0 for Restic.
    * 1.18.2 change-log
    * Bump depedencies to fix CVEs for v1.18.2 (#9919)
    * Add external-snapshotter version requirement to VGS docs
    (#9909)
    * Fix excluded namespace objects leaking into backup with
    cross-namespace listing
    * Fix backup performance regression with includedNamespaces ["*"]

++++ vnote:

  - Update to 3.20.1. Check the installed changes.md file for the
    full list of changes.
  - Add upstream change:
    * 0001-fix-build-with-cmake-4.patch

++++ zli:

  - Update to version 2.1.18:
    * feat(cli): support default config name (#4143)

++++ zot-registry:

  - Update to version 2.1.18:
    * fix: map HTTP methods to corresponding scope actions in bearer
    authen… (#4161)
    * ci: pull test images from ghcr mirror (#4156)
    * chore: fix dependabot alerts (#4157)
    * feat: add Azure Blob Storage driver (#4142)
    * feat(events): include actor and request metadata in webhook
    payloads (#3959)
    * ci: fix conformance test to before the refactor (#4145)
    * feat(cli): support default config name (#4143)
    * feat: add authz support for GitHub teams (#4139)
    * feat(storage): redirect blob pulls to backend URLs (#4092)
    * refactor(test/blackbox): extract shared push/pull helpers
    (#4132)
    * fix(storage): release global write lock during blob restore I/O
    (#4089)
    * fix(authz): metrics: deny authenticated users not in ACL even
    with anonymous read (#4131)
    * feat: config: validate metrics config (#4130)
    * chore: fix dependabot alerts (#4126)
    * fix(storage): treat dedupe-candidate cache miss as no
    candidates, not an error (#4122)
    * feat(metrics): anonymous access when enabled in accessControl
    config (#4110)
    * metadb: add optional fast restart path that skips storage walk
    when (version + commit + storage config) matches metaDB stamp
    (#4026)
    * ci: Update GH runner labels (#4121)
    * fix: skip DynamoDB table creation when tables exist (#4120)
    * feat: enhance config sanitization to mask sensitive keys in
    storage a… (#4119)
    * fix(cve): prefer cve.org links for AVD references (#4107)
    * chore: fix dependabot alerts (#4113)
    * docs: fix alongside spelling in search docs (#4095)
    * fix: miscellaneous fixes for ai-reported suggestions (#4101)
    * feat: add trivy-based sbom artifact generation support (#4088)
    * chore: fix dependabot alerts (#4091)
    * chore: fix dependabot alerts (#4082)

------------------------------------------------------------------
------------------  2026-6-27  -  Jun 27 2026  -------------------
------------------------------------------------------------------

++++ MozillaFirefox:

  - Mozilla Firefox 152.0.3
    https://www.firefox.com/en-US/firefox/152.0.3/releasenotes/
    * Fix an issue that could cause extreme memory usage and freezing
    on startup for users with language packs installed
    (bmo#2049845, boo#1269477)

++++ QMPlay2:

  - Update to version 26.06.27:
    * AVAudioFilter improvements and compatibility fix for FFmpeg
    8.0,
    * remove Rayman2 audio decoder (FFmpeg is able to play it),
    * add OpenMPT with tracker-like optional visualizations,
    * add option to YouTubeDL to add additional parameters,
    * add gamma correction control for OpenGL and Vulkan,
    * add option to move full screen panel to the right,
    * multi-line text edit for comment in tag editor,
    * fix possible crashes when loading playlist,
    * fix popups on left panel on full screen,
    * MediaBrowser fixes and improvements,
    * add libsidplayfp 3.0 compatibility,
    * Vulkan Video decoder fixes,
    * added HDR metadata,
    * remove Modplug,
    * other minor fixes.
  - Drop 0002-sidplayfp-v3-github-1008-or-f502b11.diff as it is
    merged upstream

++++ cmark-gfm:

  - Initial package (version 0.29.0.gfm.13)
  - Add cmark-gfm-0.29.0.gfm.13-cmake4.patch to build with CMake 4 and
    switch the test suite from the removed FindPythonInterp module to
    FindPython (gh#github/cmark-gfm#390)
  - Ship a cmark-gfm.rpmlintrc accepting upstream's versioned soname
    (libcmark-gfm.so.0.29.0.gfm.13); its alphabetic "gfm" component trips
    a spurious shlib-policy-missing-lib
  - Name the shared-library subpackages after the full soname per the
    shared-library packaging policy: libcmark-gfm0_29_0_gfm_13 and
    libcmark-gfm-extensions0_29_0_gfm_13

++++ cvise:

  - Add cvise-tree-sitter-cpp-aarch64-sign-compare.patch: fix a
  - Werror=sign-compare build failure in the bundled tree-sitter-cpp
    scanner on aarch64, where wchar_t is unsigned and the raw-string
    delimiter is compared against the signed int32_t lookahead.
  - Explicitly name the test_dir_linker_duplicate_2threads.patch added
    by Giuliano Belinassi in the previous changelog entry: it forces the
    test_dir_linker_duplicate_var_error test case to run with two
    threads, working around a hang on single-core build VMs
    (bsc#1268265).

++++ digikam:

  - Update to 9.1.0
    * https://www.digikam.org/news/2026-06-07-9.1.0_release_announcement/
  - Drop digikam-pointer-casting.patch, Leap 15 is EOL

++++ easyeffects:

  - Update to version 8.2.5
    * Now instead of building the pipeline immediately we build it
    after a delay. The application of this delay and its amount
    can be configured in our preferences window.
    * Improved compatibility with the latest LSP releases.
    * Improved level meters.
    * Updated translations.
    * The correct StartupWMClass value is used.

++++ eog:

  - Update to version 50.2:
    + Drop prototypes for functions removed long ago from internal
    headers
    + Updated translations.

++++ fastfetch:

  - Update to version 2.65.1:
    * Codec (Linux): fixes potential memleaks
    * WM (Linux): adds weston detection support
    * Codec (Linux): adds va-x11 method
    * Global: fixes bugs found by CI
    * Display: defaults `disableLinewrap` to `false`
    * Logo (Builtin): adds Zerene OS mainline (#2404)

++++ gexiv2:

  - Update to version 0.16.1:
    + Fix issue with GIR missing correct package name
    + Fix memory leak in regression test
    + Add missing assert in GPS test

++++ gnome-sudoku:

  - Update to version 50.2.1:
    + Fix tag being on the wrong commit
  - Changes from version 50.2:
    + Fix buttons not resetting on new game
    + Update translations.

++++ gpxsee:

  - Update to version 16.10
    * Various map rendering performance improvements.
    * Various minor map loading fixes/improvements.

++++ icingaweb2-module-director:

  -  Update to 1.11.9
    * Internals
  - Fix: Adapt to react/promise v3 and react/event-loop v1.6 (#3043)
  - Fix: Add PromiseUtil shim for react/promise v2/v3 compatibility (#3081)

++++ iosevka-fonts:

  - Update to v34.7.0
    * Changes of version 34.7.0
    = Add et-flat-bottom and flat-top-serifed variants for
    Ampersand (&).
    = Make Make Latin/Cyrillic Iota (Ɩ, ɩ, Ꙇ, ꙇ) follow variants of
    i (cv44).
    ~ Make Greek Lower Iota/Tau (ι, τ) use flat-tailed variants
    under upright.
    = Add Characters:
    ~ LEFT SIDEWAYS U BRACKET (U+2E26).
    ~ RIGHT SIDEWAYS U BRACKET (U+2E27).
    ~ LATIN CAPITAL LETTER TRESILLO (U+A72A) ... LATIN SMALL
    LETTER CUATRILLO WITH COMMA (U+A72F).
    = Refine shape of the following characters:
    ~ LATIN SMALL LETTER EZH REVERSED (U+0189).
    ~ LATIN SMALL LETTER EZH WITH TAIL (U+01BA).
    ~ LATIN SMALL LETTER EZH WITH CARON (U+01EF).
    ~ LATIN SMALL LETTER LEZH (U+026E).
    ~ LATIN SMALL LETTER EZH (U+0292).
    ~ LATIN SMALL LETTER EZH WITH CURL (U+0293).
    ~ LATIN SMALL LETTER DEZH DIGRAPH (U+02A4).
    ~ CYRILLIC SMALL LETTER ABKHASIAN DZE (U+04E1).
    ~ MODIFIER LETTER SMALL EZH (U+1DBE).
    ~ CYRILLIC SMALL LETTER DZWE (U+A683).
    ~ MODIFIER LETTER SMALL DEZH DIGRAPH (U+1078A).
    ~ MODIFIER LETTER SMALL LEZH (U+1079E).
    ~ LATIN SMALL LETTER DEZH DIGRAPH WITH PALATAL HOOK
    (U+1DF12).
    ~ LATIN SMALL LETTER EZH WITH PALATAL HOOK (U+1DF18).
    ~ LATIN SMALL LETTER DEZH DIGRAPH WITH RETROFLEX HOOK
    (U+1DF19).

++++ kernel-default:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-source:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-source-longterm:

  - Linux 6.18.37 (bsc#1258210).
  - mm: do not copy page tables unnecessarily for VM_UFFD_WP
    (bsc#1258210).
  - virtiofs: fix UAF on submount umount (bsc#1258210).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1258210).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1258210).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1258210).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1258210).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
    vcs_write (bsc#1258210).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1258210).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1258210).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1258210).
  - net: net_failover: Fix the deadlock in slave register
    (bsc#1258210).
  - net: export netif_open for self_test usage (bsc#1258210).
  - testing/selftests/mm: add soft-dirty merge self-test
    (bsc#1258210).
  - mm: propagate VM_SOFTDIRTY on merge (bsc#1258210).
  - mm: set the VM_MAYBE_GUARD flag on guard region install
    (bsc#1258210).
  - mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
    (bsc#1258210).
  - mm: implement sticky VMA flags (bsc#1258210).
  - mm: update vma_modify_flags() to handle residual flags, document
    (bsc#1258210).
  - mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
    (bsc#1258210).
  - mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
    (bsc#1258210).
  - sctp: disable BH before calling udp_tunnel_xmit_skb()
    (bsc#1258210).
  - firmware: samsung: acpm: Fix cross-thread RX length corruption
    (bsc#1258210).
  - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on
    Gen2 VMs (bsc#1258210).
  - hv: utils: handle and propagate errors in kvp_register
    (bsc#1258210).
  - regulator: core: fix locking in regulator_resolve_supply()
    error path (bsc#1258210).
  - rose: don't free fd-owned sockets when reaping in the heartbeat
    (bsc#1258210).
  - rose: clear neighbour pointer in rose_kill_by_device()
    (bsc#1258210).
  - rose: cancel neighbour timers in rose_neigh_put() before freeing
    (bsc#1258210).
  - rose: drop CALL_REQUEST in loopback timer when device is not
    running (bsc#1258210).
  - rose: release netdev ref and destroy orphaned incoming sockets
    (bsc#1258210).
  - rose: fix netdev double-hold in rose_make_new() (bsc#1258210).
  - rose: disconnect orphaned STATE_2 sockets when device is gone
    (bsc#1258210).
  - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt
    cleanup (bsc#1258210).
  - rose: fix notifier unregistered too early in rose_exit()
    (bsc#1258210).
  - rose: fix netdev double-hold in rose_rx_call_request()
    (bsc#1258210).
  - rose: guard rose_neigh_put() against NULL in timer expiry
    (bsc#1258210).
  - rose: clear neighbour pointer after rose_neigh_put() in state
    machines (bsc#1258210).
  - rose: fix race between loopback timer and module removal
    (bsc#1258210).
  - rose: hold loopback neighbour reference across timer callback
    (bsc#1258210).
  - rose: fix dev_put() leak in rose_loopback_timer() (bsc#1258210).
  - ACPI: scan: Use async schedule function in
    acpi_scan_clear_dep_fn() (bsc#1258210).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1258210).
  - net: qualcomm: rmnet: fix endpoint use-after-free in
    rmnet_dellink() (bsc#1258210).
  - i2c: stub: Reject I2C block transfers with invalid length
    (bsc#1258210).
  - RDMA/bnxt_re: zero shared page before exposing to userspace
    (bsc#1258210).
  - debugobjects: Dont call fill_pool() in early boot hardirq
    context (bsc#1258210).
  - debugobjects: Do not fill_pool() if pi_blocked_on (bsc#1258210).
  - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
    (bsc#1258210).
  - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
    (bsc#1258210).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1258210).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1258210).
  - net: stmmac: fix stm32 (and potentially others) resume regression
    (bsc#1258210).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1258210).
  - commit ed39cc4

++++ kernel-docs:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-kvmsmall:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-longterm:

  - Linux 6.18.37 (bsc#1258210).
  - mm: do not copy page tables unnecessarily for VM_UFFD_WP
    (bsc#1258210).
  - virtiofs: fix UAF on submount umount (bsc#1258210).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1258210).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1258210).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1258210).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1258210).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
    vcs_write (bsc#1258210).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1258210).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1258210).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1258210).
  - net: net_failover: Fix the deadlock in slave register
    (bsc#1258210).
  - net: export netif_open for self_test usage (bsc#1258210).
  - testing/selftests/mm: add soft-dirty merge self-test
    (bsc#1258210).
  - mm: propagate VM_SOFTDIRTY on merge (bsc#1258210).
  - mm: set the VM_MAYBE_GUARD flag on guard region install
    (bsc#1258210).
  - mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
    (bsc#1258210).
  - mm: implement sticky VMA flags (bsc#1258210).
  - mm: update vma_modify_flags() to handle residual flags, document
    (bsc#1258210).
  - mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
    (bsc#1258210).
  - mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
    (bsc#1258210).
  - sctp: disable BH before calling udp_tunnel_xmit_skb()
    (bsc#1258210).
  - firmware: samsung: acpm: Fix cross-thread RX length corruption
    (bsc#1258210).
  - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on
    Gen2 VMs (bsc#1258210).
  - hv: utils: handle and propagate errors in kvp_register
    (bsc#1258210).
  - regulator: core: fix locking in regulator_resolve_supply()
    error path (bsc#1258210).
  - rose: don't free fd-owned sockets when reaping in the heartbeat
    (bsc#1258210).
  - rose: clear neighbour pointer in rose_kill_by_device()
    (bsc#1258210).
  - rose: cancel neighbour timers in rose_neigh_put() before freeing
    (bsc#1258210).
  - rose: drop CALL_REQUEST in loopback timer when device is not
    running (bsc#1258210).
  - rose: release netdev ref and destroy orphaned incoming sockets
    (bsc#1258210).
  - rose: fix netdev double-hold in rose_make_new() (bsc#1258210).
  - rose: disconnect orphaned STATE_2 sockets when device is gone
    (bsc#1258210).
  - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt
    cleanup (bsc#1258210).
  - rose: fix notifier unregistered too early in rose_exit()
    (bsc#1258210).
  - rose: fix netdev double-hold in rose_rx_call_request()
    (bsc#1258210).
  - rose: guard rose_neigh_put() against NULL in timer expiry
    (bsc#1258210).
  - rose: clear neighbour pointer after rose_neigh_put() in state
    machines (bsc#1258210).
  - rose: fix race between loopback timer and module removal
    (bsc#1258210).
  - rose: hold loopback neighbour reference across timer callback
    (bsc#1258210).
  - rose: fix dev_put() leak in rose_loopback_timer() (bsc#1258210).
  - ACPI: scan: Use async schedule function in
    acpi_scan_clear_dep_fn() (bsc#1258210).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1258210).
  - net: qualcomm: rmnet: fix endpoint use-after-free in
    rmnet_dellink() (bsc#1258210).
  - i2c: stub: Reject I2C block transfers with invalid length
    (bsc#1258210).
  - RDMA/bnxt_re: zero shared page before exposing to userspace
    (bsc#1258210).
  - debugobjects: Dont call fill_pool() in early boot hardirq
    context (bsc#1258210).
  - debugobjects: Do not fill_pool() if pi_blocked_on (bsc#1258210).
  - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
    (bsc#1258210).
  - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
    (bsc#1258210).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1258210).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1258210).
  - net: stmmac: fix stm32 (and potentially others) resume regression
    (bsc#1258210).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1258210).
  - commit ed39cc4

++++ kernel-obs-build:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-obs-qa:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-syms:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ kernel-syms-longterm:

  - Linux 6.18.37 (bsc#1258210).
  - mm: do not copy page tables unnecessarily for VM_UFFD_WP
    (bsc#1258210).
  - virtiofs: fix UAF on submount umount (bsc#1258210).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1258210).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1258210).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1258210).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1258210).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
    vcs_write (bsc#1258210).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1258210).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1258210).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1258210).
  - net: net_failover: Fix the deadlock in slave register
    (bsc#1258210).
  - net: export netif_open for self_test usage (bsc#1258210).
  - testing/selftests/mm: add soft-dirty merge self-test
    (bsc#1258210).
  - mm: propagate VM_SOFTDIRTY on merge (bsc#1258210).
  - mm: set the VM_MAYBE_GUARD flag on guard region install
    (bsc#1258210).
  - mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
    (bsc#1258210).
  - mm: implement sticky VMA flags (bsc#1258210).
  - mm: update vma_modify_flags() to handle residual flags, document
    (bsc#1258210).
  - mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
    (bsc#1258210).
  - mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
    (bsc#1258210).
  - sctp: disable BH before calling udp_tunnel_xmit_skb()
    (bsc#1258210).
  - firmware: samsung: acpm: Fix cross-thread RX length corruption
    (bsc#1258210).
  - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on
    Gen2 VMs (bsc#1258210).
  - hv: utils: handle and propagate errors in kvp_register
    (bsc#1258210).
  - regulator: core: fix locking in regulator_resolve_supply()
    error path (bsc#1258210).
  - rose: don't free fd-owned sockets when reaping in the heartbeat
    (bsc#1258210).
  - rose: clear neighbour pointer in rose_kill_by_device()
    (bsc#1258210).
  - rose: cancel neighbour timers in rose_neigh_put() before freeing
    (bsc#1258210).
  - rose: drop CALL_REQUEST in loopback timer when device is not
    running (bsc#1258210).
  - rose: release netdev ref and destroy orphaned incoming sockets
    (bsc#1258210).
  - rose: fix netdev double-hold in rose_make_new() (bsc#1258210).
  - rose: disconnect orphaned STATE_2 sockets when device is gone
    (bsc#1258210).
  - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt
    cleanup (bsc#1258210).
  - rose: fix notifier unregistered too early in rose_exit()
    (bsc#1258210).
  - rose: fix netdev double-hold in rose_rx_call_request()
    (bsc#1258210).
  - rose: guard rose_neigh_put() against NULL in timer expiry
    (bsc#1258210).
  - rose: clear neighbour pointer after rose_neigh_put() in state
    machines (bsc#1258210).
  - rose: fix race between loopback timer and module removal
    (bsc#1258210).
  - rose: hold loopback neighbour reference across timer callback
    (bsc#1258210).
  - rose: fix dev_put() leak in rose_loopback_timer() (bsc#1258210).
  - ACPI: scan: Use async schedule function in
    acpi_scan_clear_dep_fn() (bsc#1258210).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1258210).
  - net: qualcomm: rmnet: fix endpoint use-after-free in
    rmnet_dellink() (bsc#1258210).
  - i2c: stub: Reject I2C block transfers with invalid length
    (bsc#1258210).
  - RDMA/bnxt_re: zero shared page before exposing to userspace
    (bsc#1258210).
  - debugobjects: Dont call fill_pool() in early boot hardirq
    context (bsc#1258210).
  - debugobjects: Do not fill_pool() if pi_blocked_on (bsc#1258210).
  - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
    (bsc#1258210).
  - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
    (bsc#1258210).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1258210).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1258210).
  - net: stmmac: fix stm32 (and potentially others) resume regression
    (bsc#1258210).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1258210).
  - commit ed39cc4

++++ kernel-vanilla:

  - Update
    patches.kernel.org/7.1.1-001-fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasyn.patch
    (bsc#1012628 CVE-2026-52946 bsc#1269113).
  - commit 9476022
  - Linux 7.1.2 (bsc#1012628).
  - virtiofs: fix UAF on submount umount (bsc#1012628).
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    (bsc#1012628).
  - ksmbd: reject non-VALID session in compound request branch
    (bsc#1012628).
  - drivers/base/memory: set mem->altmap after successful device
    registration (bsc#1012628).
  - serial: 8250_dw: unregister 8250 port if clk_notifier_register()
    fails (bsc#1012628).
  - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is
    zero (bsc#1012628).
  - vc_screen: fix null-ptr-deref in vcs_notifier() during
    concurrent vcs_write (bsc#1012628).
  - crypto: qat - remove unused character device and IOCTLs
    (bsc#1012628).
  - iio: adc: ti-ads1298: add bounds check to pga_settings index
    (bsc#1012628).
  - iio: light: veml6075: add bounds check to veml6075_it_ms index
    (bsc#1012628).
  - agp/amd64: Fix broken error propagation in agp_amd64_probe()
    (bsc#1012628).
  - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    (bsc#1012628).
  - fuse: re-lock request before replacing page cache folio
    (bsc#1012628).
  - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    (bsc#1012628).
  - commit 8d2f9d1

++++ lalsimulation:

  - Add lalsimulation-macro-redefinition.patch to undef macro before
    its redefinition in an included header file and avoid
    `macro-redefinition` error.

++++ libbfio:

  - Update to release 20260623
    * The testsuite scripts were updated

++++ manifold:

  - Update to 3.5.2
  - Addresses
    https://projects.blender.org/blender/blender/issues/158737 by
    removing deferred deallocation.

++++ mupdf:

  - Update to 1.28.0:
    * Markdown document format support.
    * HTML/EPUB rendering improvements: vertical-align for inline
    images and percentage values, support for <u>, <s> and <mark>
    tags, background-color on inline elements, :before/:after
    pseudo-selectors, non-interactive appearance for form input
    elements, and respect for the meta viewport minimum page size.
    * Per-document control of publisher and user CSS.
    * New mutool audit command to analyse PDF structure and generate
    a report; mutool grep now uses regular expressions by default.
    * Improved text extraction: better ActualText replacement
    handling, presentation-form (ligature) decomposition for all
    scripts, improved paragraph and fake-bold detection, and better
    soft/hard hyphen handling.
    * New fz_check_document to scan a document and repair possible
    structural errors before editing.
    * Support linear and radial shadings when converting XPS and
    other formats to PDF.
    * Many bug fixes, optimisations and security hardening fixes.
  - Track the new shared-library SONAME: the rendering library
    subpackage is renamed libmupdf27_2 to libmupdf28_0
    (libmupdf.so.28.0).
  - Keep the bundled cmark-gfm (0.29.0.gfm.13) thirdparty copy, now
    required for the new Markdown support; no system cmark-gfm exists
    in Factory yet.
  - Refresh mupdf-no-strip.patch for the new sources.

++++ mutter:

  - Add ba64e055b5159a3acd5b4e4bc3d381066b26c62c.patch: Fix build
    with new pango

++++ perl-JSON-Schema-Tiny:

  - initial package 0.33.0 (0.033)
    * created by cpanspec 1.84.01

++++ python-langtable-data-src:

  - update to 0.0.71:
    * langtable.py: Fix deprecation warning: `langtable.py:2652:
    UserWarning: pkg_resources is deprecated as an API`
    * Add xdq, sus, mrh, hrx, brh, ary, en_SE.UTF-8
    * Get new translations and translation changes from CLDR
    * setup.py: use open() instead of deprecated codecs.open(),
    declare minimum Python version >= 3.8
    * Add Yangon timezone id part
    * languages.xml: Rename Asia/Rangoon to Asia/Yangon
    * territories.xml: Rename Asia/Rangoon to Asia/Yangon

++++ python-GridDataFormats:

  - update to 1.2.0:
    * Added openVDB format exports (Issue #141, PR #148)
    * new API-level interoperability features (#160)
    * new `Grid.convert_to()` method to create the native object
    (#161, PR #164) `mrc.MRC`, `OpenDX.field`,
    `OpenVDB.OpenVDBField`: new `from_grid()`
    * class method to create the corresponding GridDataFormats
    wrapper from a `Grid`  (#161, PR #164, PR #148)
    * new attribute `native` for GridDataFormat wrappers contains
    the native object (#161, PR #164, PR #148)
    * Ensure that when Grid() or Grid.load() load a datafile with
    the wrong format a ValueError is raised consistently. (PR #165)

++++ python-django-import-export:

  - update to 4.4.1:
    * Refactor lookup value retrieval in Field and
    CachedForeignKeyWidget (2146)
    * Fix CachedForeignKeyWidget type mismatch on non-string lookup
    fields (2159)

++++ python-dulwich:

  - update to 1.2.7 (bsc#1268128, CVE-2026-42305):
    * Verify that an object retrieved by id actually hashes to the
    requested id, raising ``ChecksumMismatch`` otherwise.
    * Check out files whose names contain a colon or backslash. The
    NTFS path validator rejected any element containing
    ``:`` or ````, so such files were silently dropped on clone.
    It now rejects only the ``.git``/``git~1``
    * alternate-data-stream spellings, like git.
    * Abort the checkout when a tree entry has an invalid path
    (e.g. a ``.git`` alias) instead of silently skipping it.
    * Reject pack names containing path separators in the dumb HTTP
    transport, so a malicious server can no longer escape the
    temporary directory.
    * SECURITY: Don't expand config ``include`` directives when
    parsing ``.gitmodules``, so a crafted ``.gitmodules`` in a cloned
    repository can no longer make ``clone --recurse-submodules``
    read arbitrary files.
    * SECURITY: Validate ref names before resolving them to a path,
    so a client-supplied name like ``../../secret`` can no longer read
    a file outside the ref store. This closes a traversal via git-
    upload-archive's ``argument`` and other lookup paths.
    * Add ``porcelain.request_pull`` and a ``dulwich request-pull``
    command that generate a summary of pending changes between
    repositories, suitable for emailing to a maintainer, like
    ``git request- pull``.
    * Add ``porcelain.range_diff`` and a ``dulwich range-diff``
    command that compare two ranges of commits and show how a
    patch series evolved, like ``git range-diff``. Requires the
    ``munkres`` package, installable via the
    ``dulwich[range_diff]`` extra. (Jelmer Vernooij, #1828)
    * Fix ``apply_patch`` writing index entries with mode ``0``,
    which made native git abort with ``unsupported ce_mode: 0``.
    The file mode is now derived from the work-tree file.
    * Fix deepening of a local shallow fetch. Re-fetching with a
    larger ``depth`` moved the shallow boundary but did not
    transfer the newly-uncovered commits, because the parents
    provider still used the old boundary. (Jelmer Vernooij)
    * Fix ``gc``/``repack`` on Windows raising ``PermissionError``
    when removing read-only pack files (as written by git). The read-
    only attribute is now cleared before unlinking. (Jelmer Vernooij)
    * Fix ``repack`` leaking a temporary pack file when the
    consolidated pack was identical to one already on disk.
    The orphaned file accumulated in the pack directory
    * SECURITY: Honor ``core.protectNTFS``/``core.protectHFS`` on
    all work-tree updates. The 1.2.5 path hardening (CVE-2026-42305)
    only reached ``checkout`` and ``reset``; ``update_working_tree``
    (used by ``merge``, ``pull`` and others) fell back to the default
    validator, so a crafted branch could still check out an NTFS-unsafe name
    such as ``git~2`` even with ``core.protectNTFS=true``.
    * SECURITY: Reject patch target paths that escape the work tree
    in ``apply_patches``. Patch headers are untrusted (e.g. ``git
    am`` of a mailbox), so a ``+++``/rename path such as
    ``../../etc/cron.d/x`` or an absolute path was joined onto
    the repo path and written outside the working tree.
    * ``porcelain``: Validate caller-supplied paths in
    ``checkout``, ``restore`` and ``reset_file`` before writing,
    as defense in depth, so a ``.git`` or ``..`` component
    (including NTFS/HFS ``.git`` aliases) cannot escape the work
    tree or write into the control directory.
    * Remove the ``force_remove_untracked`` argument from
    * ``index.update_working_tree``. It had been a no-op since the
    function was rewritten to apply changes from a diff iterator, and
    removing untracked files is not part of ``reset --hard`` semantics.

++++ python-dynaconf:

  - update to 3.3.1:
    * Remove call to deprecated functions on public APIs (#1404).
    * Improve converage of DataList and DataDict (#1403).
    * support Python 3.14 Union type repr and dict iteration
    changes.
    * preserve nested dict key order when object_merge merges old
    into new.
    * prevent RecursionError on dotted set with bracket in first
    segment.

++++ python-fastparquet:

  - update to 2026.5.0:
    * fixes for pandas 2 & 3
    * remove native

++++ python-filelock:

  - update to 3.29.4:
    * verify inode in break_lock_file before unlinking a stale lock
    * keep the read/write heartbeat alive on a transient touch
    error
  - update to 3.29.3:
    * ci(release): publish to PyPI on tag push
    * validate pid range in _parse_lock_holder
    * fix(ci): restore release environment on tag job
    * fix(ci): publish from release.yaml on tag push
    * **Full Changelog**: https://github.com/tox-
    dev/filelock/compare/3.29.2...3.29.3
  - update to 3.29.2:
    * open marker reads non-blocking to refuse attacker-placed fifo
    * fix(soft): harden stale-lock breaking and self-heal
    malformed locks
    * check hostname in is_lock_held_by_us
  - update to 3.29.1:
    * docs: fix API docs of `release()`
    * docs: clarify per-thread scope of FileLock configuration
    * fix(soft): refuse to follow symlinks when reading the lock
    file

++++ python-giturlparse:

  - update to 0.15.0:
    * Fix path and branch extraction removing every /blob/ and
    /tree/ occurrence instead of only the leading marker, which
    corrupted file paths and branch names containing those
    segments.

++++ python-greenlet:

  - update to 3.5.3:
    * Fix a crash on free-threaded builds when multiple greenlets
    were holding a critical section on an object and the GIL for
    the thread was dropped. See issue 513. Thanks to ddorian.

++++ python-grpcio-status:

  - update to 1.81.1:
    * sync with grpcio

++++ python-hishel:

  - update to 1.3.0:
    * remove egg folder from source by @karpetrosyan
    * add readme in pyproject.toml by @karpetrosyan
    * use weak ETag comparison when freshening stored responses

++++ python-hstspreload:

  - update to 2026.6.1:
    * Automated updates to the HSTS preload list on 2026-6-1

++++ python-httptools:

  - update to 0.8.0:
    * Add http-parser and llhttp licenses into the wheels
    * Mark cython module as free-threading compatible
    * Fix all typing issues
    * Bump llhttp to 9.4.1
    * Security: fix URL truncation issue
    * Allow building with latest setuptools

++++ python-khard:

  - update to 0.21.0:
    * Remove support for python 3.9
    * Fix bug skipping config's skip_unparsable setting (#355)
    * Fix special handling for ambiguous date formats (#349)
    * Add failing test for partial date with leap day
    * Remove the autodoc typehints extension in sphinx

++++ python-langtable:

  - update to 0.0.71:
    * langtable.py: Fix deprecation warning: `langtable.py:2652:
    UserWarning: pkg_resources is deprecated as an API`
    * Add xdq, sus, mrh, hrx, brh, ary, en_SE.UTF-8
    * Get new translations and translation changes from CLDR
    * setup.py: use open() instead of deprecated codecs.open(),
    declare minimum Python version >= 3.8
    * Add Yangon timezone id part
    * languages.xml: Rename Asia/Rangoon to Asia/Yangon
    * territories.xml: Rename Asia/Rangoon to Asia/Yangon

++++ python-lfdfiles:

  - update to 2026.6.24:
    * Add VistaTdflim class for reading ISS Vista TDFLIM files.
    * Support Python 3.15.

++++ python-param:

  - update to 2.4.1:
    * Add mypy plugin to handle descriptor __set__ issue
    * Reorder param.List overloads to allow default type inference
    * Fix spelling mistakes and add typos to pre-commit

++++ rusty_v8:

  - Update to version 149.4.0:
    * v149.4.0
    * fix: shared-library-safe V8 TLS on Linux via v8_monolithic_for_shared_library
  - Update to version 149.3.0:
    * v149.3.0
    * fix: pass `flags` to `v8__ObjectTemplate__SetIndexedPropertyHandler` FFI (#1994)
    * Add Isolate::SetIdle and CpuProfiler bindings (#2001)
  - Update to version 149.2.0:
    * v149.2.0 (#1991)
    * Revert "Add bindings for FunctionTemplate c_function_overloads (#1986)" (#1988)
    * fix: keep isolate annex alive during teardown (#1978)
    * v149.1.0 (#1987)
    * Add bindings for FunctionTemplate c_function_overloads (#1986)
  - Update to version 149.0.0:
    * v149.0.0 (#1985)
    * Add bindings for V8 inspector async-task hooks and debug break-on-next-call (#1984)
    * perf: add fused callback info parts (#1983)
    * perf: Reduce Global handle liveness overhead (#1982)
    * bump to 14.9 (#1975)
    * Add bindings for String::Concat (#1973)
    * Add bindings for Object::SetLazyDataProperty (#1972)
  - Update to version 147.4.0:
    * v147.4.0 (#1969)
    * perf: use simdutf for string conversion hot paths (#1967)
    * Store IsolateHandle data in its own allocation (#1891)
    * perf: cache IsolateAnnex pointer in scope structs (#1968)
    * Use CARGO_CFG_TARGET_FEATURE to detect CRT linkage on MSVC (#1915)
    * fix: enable linux shared-library-safe v8 tls mode by default (#1911)
    * Include `build/rust/known-target-triples.txt` in Cargo.toml (#1950)
    * v147.3.0 (#1966)
    * feat: add Module::EvaluateForImportDefer and GetModuleNamespace with phase (#1965)
  - Update to version 147.2.1:
    * v147.2.1 (#1964)
    * fix: correct v8__String__NewExternalOneByte length parameter type (#1962)
    * Rolling to V8 14.7.173.20 (#1963)
    * v147.2.0 (#1961)
    * Rolling to V8 14.7.173.19 (#1951)
    * feat: implement NewEscapableHandleScope for Isolate (#1960)
    * feat: add new_external_twobyte and new_external_twobyte_raw (#1959)
    * v147.1.0 (#1956)
    * Bump temporal_capi from 0.1.2 to 0.2.3 (#1955)
    * Rolling to V8 14.7.173.13 (#1946)
    * Fix memory leak in Function::get_script_origin (#1902)
    * Rolling to V8 14.7.173.9 (#1943)
    * Expose `FunctionTemplate::SetAccessorProperty` (#1942)
  - Update to version 147.0.0:
    * v147.0.0 (#1941)
    * update to v8 v14.7 (#1940)
    * Rolling to V8 14.6.202.26 (#1938)
    * v146.9.0 (#1937)
    * Rolling to V8 14.6.202.24 (#1923)
    * fix: add simdutf builds for Windows targets in CI (#1936)
  - Update to version 146.8.0:
    * v146.8.0 (#1935)
    * feat: transfer foreground task ownership to Rust in PlatformImpl (#1934)
    * feat: expose `total_allocated_bytes` in `HeapStatistics` (#1933)
    * v146.7.0 (#1932)
    * feat: expose simdutf bindings behind cargo feature (#1928)
    * fix: correct ExternalOneByteString destructor memory accounting (#1931)
    * v146.6.0 (#1930)
    * feat: custom Node domains support in Inspector (#1904)
    * v146.5.0 (#1929)
    * feat: zero-copy string access via ValueView and allocation-reuse APIs (#1927)
  - Update to version 146.3.0
  - Update to version 146.1.0
    * Rolling to V8 14.6.202.6 (#1913)
    * Rolling to V8 14.6.202.4 (#1910)
    * add Promise::MarkAsHandled (#1912)
  - Refresh compiler-rt-adjust-paths.patch
  - Add disable-flags-unsupported-by-clang.patch and fix_bindgen_generation.patch

++++ smcroute:

  - Update to versino 2.6.0
    Changes
    * Add JSON output support smcroutectl -j show, issue #198.
    * Drop pre-v2.0 smcroute shell wrapper. Anyone still on
    smcroute -a / smcroute -j / etc. should migrate to
    smcroute.conf or call smcroutectl(8) directly, issue #199.
    Clearer diagnostic messages for unusable phyints (unknown name
    vs.  not multicast capable vs. VIF table exhausted). Promoted
    the "not multicast capable" log line from LOG_INFO to
    LOG_WARNING so it shows at the default log level.
    * mroute and mgroup directives whose inbound or outbound
    interface does not yet exist are queued on a pending list
    instead of being dropped with parse error. See list with
    smcroutectl show pending.
    Fixes
    * Fix #55: on Linux, smcrouted now subscribes to kernel netlink
    link events (RTNLGRP_LINK + IPv4/IPv6 address groups) and
    activates any pending routes/groups automatically when their
    inbound or outbound interface arrives.
    * Fix #71: VIFs and MIFs are now allocated lazily, only for
    interfaces referenced by smcroute.conf or by smcroutectl. The
    old up-front enumeration regularly exhausted the kernel's
    32-slot table on hosts with many unrelated interfaces. The -N
    option is now a no-op.
    * Fix #143: repair kernel MFC on IGMPMSG_WRONGVIF /
    MRT6MSG_WRONGMIF by remapping the (S,G) entry's inbound iif
    when a (*,G) rule covers the upcall's actual iif.

++++ stellarium:

  - Update to 26.2
    * Added new sky culture
    * Added new plugin: Planes
    * Many improvements in plugins
    * Many improvements in Core and GUI
    * Many updates in sky cultures

++++ strawberry:

  - Update to version 1.2.21
    + Re-point playlist items that references duplicated songs before removal (#2168)
    + Preserve user data before deleting duplicate songs (#2168)
    + Check for svg support (#2171)
    + Support custom icons from scalable dir (#2171)
    + Custom icons take precedence over system theme icons (#2171)
    + Add .tak to valid file extensions
    + Optional exponential volume
    + Fixed build without moodbar and waveform

++++ ttl:

  - Update to version 0.20.1:
    * Unify IPv4 send path on IP_HDRINCL (TTL in the IP header) (#12)

------------------------------------------------------------------
------------------  2026-6-26  -  Jun 26 2026  -------------------
------------------------------------------------------------------

++++ QMPlay2:

  - Added 0002-sidplayfp-v3-github-1008-or-f502b11.diff and
    USE_CHIPTUNE_SID set to ON back.

++++ calibre:

  - Update to 9.10.0
    * New Features
  - Content server: A new "modern" interface with a sidebar to ease navigation
  - Content server: When used with HTTPS allow installation as a PWA (Progressive Web App)
  - Edit book: Saved searches: When filtering the list of saved searches match by keywords
  - CSS parsing: Add support for CSS Level 4 selectors
  - Cover grid: When using an image larger than the viewport as a texture scale it to fit the viewport
  - Annotations browser: Allow restricting displayed annotations by custom annotation styles as well
  - Edit book: Compress images: Add option to convert PNG images to JPEG or WEBP
    * Bug Fixes
  - E-book viewer: Fix IME on Windows not working when typing in notes for highlights
  - Conversion: Heuristics: Improve performance in some pathological cases
  - SNB Input: Fix error on some input files
  - Windows: fix rare crash when too many notifications are displayed at once
  - Fix duplicating of books not duplicating value from enumerated columns when the column has a default value defined
  - Fix a regression in 9.8 that caused errors from AI plugin providers to be silently swallowed and not displayed to user
  - Fix CSV export invalid when exporting comments field
  - Disallow Python templates when reading book metadata (CVE-2026-53511)

++++ chromium:

  - Chromium 149.0.7827.200 (boo#1269061):
    * CVE-2026-13281: Integer overflow in Mojo
    * CVE-2026-13282: Use after free in Payments
    * CVE-2026-13283: Use after free in AdFilter

++++ clpeak:

  - Update to 2.0.16:
    * The downstream fix to install the binary into the standard
    bindir is now upstream (PR #178); install the LICENSE file via
    CMake again.
    * Raise the build to C++14 to fix aggregate brace-initialization
    on strict clang.
    * New GPU support: CUDA Blackwell Ultra (B300/GB300), GB10 and
    Jetson Thor.
  - Drop clpeak-install-bindir.patch, merged upstream.

++++ cvise:

  - Use 2 threads in `test_dir_linker_duplicate_var_error`A (bsc#1268265).
  - Update to version 2.12.0+git.20260624.82a22c61:
    * Fix test_dir_linker_duplicate_var_error on non-english locales (#507)
    * CMakeLists.txt: embed unabbreviated git hash to release tarball (#506)

++++ faad2:

  - Update to version 2.11.2.git13:
    * fix out-of-bounds X underflow in SBR low-power QMF assembly
    * fix out-of-bounds Xsbr write in hf_assembly sinusoid addition
    * update to Visual Studio 18
    * prevent length_of_rvlc_sf underflow in rvlc_scale_factor_data
    * fix out-of-bounds iq_table read in iquant for -32768
    * bound sscanf field width in option parsing
    * fix integer overflow in stszin/stscin allocation size checks
    * fix off-by-one frame index check in mp4read_seek
    * SBR: prevent heap overflow in channel-pair reconstruction
    * fix typo
  - Drop patches fixed upstream:
    * bc5de3ac7264f7a232951d06150ec1fcd4a20f6c.patch
    * 2653c918d788c5dc83826c97aaa4de4dd8931a8b.patch

++++ ffmpeg-4:

  - Add pcmbluray-bigendian.patch to address a build failure on s390x
  - Update to release 4.4.8
    * Various bug fixes to codecs
  - Delete ffmpeg-4-CVE-2025-22921.patch (merged)

++++ fontawesome-fonts:

  - Update to 7.3.0:
    * New and updated icons in the Free set.

++++ gi-docgen:

  - Modernize build system.
  - Rename to `gi-docgen` as this is not a Python module, which
    should be used by other modules.

++++ gnome-maps:

  - Update to version 50.2:
    + Avoid focus route start entry when selecting a place (avoids
    show OSK on touch)
    + Updated translations.

++++ gnome-software:

  - Update to version 50.3:
    + Fix a memory leak
    + Updated translations.

++++ goshs:

  - Update to version 2.1.3
    New Features
    * TFTP server (-tftp / --tftp-server) — goshs can now serve
    files over TFTP, the one classic transfer protocol it was
    missing (next to HTTP/WebDAV/FTP/SFTP/SMB). Listens on UDP
    port 69 by default so built-in clients like Windows' tftp.exe
    work out of the box, and supports both downloads (RRQ) and
    uploads (WRQ) with blksize/tsize option negotiation. Honors the
    IP whitelist and --read-only/--upload-only, rejects path
    traversal, and is advertised via mDNS. Hand-rolled with zero
    new dependencies.
    * Reverse-shell payload generator — A new generator tab in both
    the web UI and the --tui dashboard builds reverse-shell
    one-liners from a shared payload database (Bash, nc, Python,
    PHP, PowerShell, Perl, Ruby, and more), with LHOST/LPORT
    substitution and optional URL/Base64 encoding (PowerShell
    payloads as -EncodedCommand).
    Bug Fixes
    * TUI interface display (#187) — In --tui mode without an
    explicit -i, the status line now lists every bound interface IP
    instead of just showing 0.0.0.0.
    * TUI template variables — The status line now reflects every
  - -tpl-var KEY=VALUE entry, not only LHOST/LPORT.
    * TUI status line — Enabled FTP/SFTP and TFTP servers are now
    surfaced in the status bar like the other protocols.
    * Config ldap_jndi — The example config shipped a non-binding
    ldap_jndi_enabled key; the correct, working key is ldap_jndi.
    * Config ldap_wordlist — A ldap_wordlist value set via the
    config file was silently ignored; it is now applied.
    Packaging
    * Shell completions (bash/zsh/fish) updated with the new -tftp /
  - -tftp-server / -tftp-port flags.

++++ gotosocial:

  - Update to version 0.21.3:
    * This is a security release for a vulnerability whereby malformed
    AP messages can cause mischief.
    * [bugfix] stricter property value counts
    * [bugfix] Allow hyphen in usernameRelaxed regex
    * [bugfix] Add support for public:remote stream type
    * [bugfix] Update go-sqlite3 to v0.35.1 to fix out of memory panic
    during migration
    * [bugfix] nowasm: on context cancel hook, check that process is
    non-nil before calling Kill()
    * [bugfix/frontend] Validate domain name for new domain perms
    earlier to avoid confusing err messages
    * [bugfix] Ignore extraneous data streams when processing videos

++++ gspell:

  - Update to version 1.14.4:
    + Updated translations.

++++ gssdp:

  - Update to version 1.6.6:
    + Fix binding to unicast sockets (Regression introduced by 1.6.5)

++++ libcamera:

  - Be explicit about not using libunwind to address a
    s390x build failure.

++++ gupnp-tools:

  - Update to version 0.12.3:
    + Updated translations.

++++ vim:

  - Replace pkgconfig(gtk+-3.0) with pkgconfig(gtk4) and pass
  - -enable-gui=gtk4 instead of --enable-gui=gtk3 to configure.
    Build gvim with gtk4 instead of gtk3.
  - Refresh patches with quilt.
  - Updated to version 9.2.0725, fixes the following problems:
    9.2.0531: tests: Test_cd_completion() fails on MS-Windows with E344
    9.2.0532: GTK: preedit font size is wrong for fractional point sizes
    9.2.0533: '[ mark moved to end of inserted text after CTRL-R CTRL-P paste
    9.2.0534: GTK UI does not support fullscreen mode
    9.2.0535: tests: matchit plugin is not tested
    9.2.0536: tests: Test_invalid_args() fails on GTK4 without xterm_clipboard
    9.2.0537: GTK4: mouse popup menu does not show up at mouse pointer
    9.2.0538: Cannot keep leading whitespace in %{} statusline expr
    9.2.0539: filetype: too many Bitbake include files are recognized
    9.2.0540: tests: Test_mswin_event_mouse is flaky
    9.2.0541: Vim9: endclass/endenum/endinterface can give errors
    9.2.0542: tests: test_codestyle fails
    9.2.0543: Vim9: wrong error when redeclaring a typed variable
    9.2.0544: GTK4: window blank after a resize or drag
    9.2.0545: popup: blending uses hardcoded fallback colors
    9.2.0546: configure: GTK4 build requires GTK >= 4.10
    9.2.0547: "%v" in 'errorformat' is affected by 'tabstop'
    9.2.0548: GTK4: terminal and pty job output is not processed
    9.2.0549: Cursor wrong after autoindent strip is skipped
    9.2.0550: GTK4: 'mousehide' unhides cursor when switching tabs
    9.2.0551: filetype: Tolk files are not recognized
    9.2.0552: GTK4: F10 does nothing when the menubar is hidden
    9.2.0553: runtime(netrw): netrw rejects hostnames containing _
    9.2.0554: GTK4: memory leak in free_menu()
    9.2.0555: too many strlen() in ex_substitute()
    9.2.0556: GTK4: scrollbars not shown and do not respond to clicks
    9.2.0557: filetype: Kawasaki Robots files are not recognized
    9.2.0558: filetype: Popcap Reanimation files are not recognized
    9.2.0559: filetype: Kaitai struct files are not recogonized
    9.2.0560: filetype: busybox shebang lines are not recognized
    9.2.0561: [security]: possible code execution with python3complete
    9.2.0562: filetype: SGF files are not recognized
    9.2.0563: GTK3/Wayland: crash with right mouse-button in tabline
    9.2.0564: GTK4: tabline does not respond to mouse clicks
    9.2.0565: [security]: out-of-bounds read in update_snapshot()
    9.2.0566: <C-w>f duplicates window if do_ecmd() is aborted
    9.2.0567: dict function name allocation failure not handled
    9.2.0568: pythoncomplete: g:pythoncomplete_allow_import had no effect
    9.2.0569: out-of-bounds access in libvterm CSI 8 t resize
    9.2.0570: GTK4: mouse wheel scrolling does not work correctly
    9.2.0571: Vim9: memory leak in compile_nested_function() on failure
    9.2.0572: lines disappear with wrapping virtual text after a double-width char
    9.2.0573: Vim9: missing EX_WHOLE on some block keywords
    9.2.0574: tests: missing test for v9.2.0572
    9.2.0575: tests: filetype test for v9.2.0557 can be improved
    9.2.0576: popup_create() not blocked in secure/sandbox
    9.2.0577: GTK4: window resizing issues
    9.2.0578: GTK4: :unmenu does not remove entries from the menubar
    9.2.0579: :mksession, :mkview and :mkvimrc emit legacy Vim script
    9.2.0580: xxd: binary output is not colored with -R
    9.2.0581: After maximizing and deleting the quickfix buffer, window height is wrong
    9.2.0582: GTK4: compile error when XFONTSET is defined
    9.2.0583: completion: indent not ignored for fuzzy line completion
    9.2.0584: GTK4: missing UI features
    9.2.0585: line number wrong after undoing a deletion in quickfix buffer
    9.2.0586: Crash with TextPut autocmd when pasting in terminal buffer
    9.2.0587: GTK4: left scrollbar overlaps drawarea
    9.2.0588: GTK4: drawing area loses focus after closing a menubar popover
    9.2.0589: filetype: xinitrc files are not recognized
    9.2.0590: GTK4: drawing area loses focus shape on popup menu open
    9.2.0591: 'scrolljump' ignored when scrolling up
    9.2.0592: Error when restoring session with terminal window
    9.2.0593: :wqall ignores term_setkill() on running terminal buffers
    9.2.0594: Use-after-free with ":wqall" and a running terminal job
    9.2.0595: MS-Windows: Wrong buffer size calculation for gvimext
    9.2.0596: cmdline completion popup cannot be scrolled with the mouse
    9.2.0597: [security]: possible code execution with python complete
    9.2.0598: tests: Test_statusline() is flaky
    9.2.0599: popup: title set with popup_setoptions() is not shown
    9.2.0600: clientserver method needs to be given as argument
    9.2.0601: matchfuzzypos() returns garbage positions for long candidates
    9.2.0602: popup: No opacity when background not set for Popup group
    9.2.0603: possible heap-buffer-overflow when resizing the GUI
    9.2.0604: tests: Test_mswin_event_mouse() is still flaky
    9.2.0605: tests: Test_screenpos() is flaky in GUI
    9.2.0606: GTK4: does not support all clipboard formats
    9.2.0607: GTK4: inputdialog() does not work as expected
    9.2.0608: popup_setoptions()/ch_setoptions() does not check secure mode
    9.2.0609: completion info popup cannot be scrolled with the keyboard
    9.2.0610: cindent: closing brace in a comment affects the next line's indent
    9.2.0611: MS-Windows: evim.exe not working with VIMDLL
    9.2.0612: Cannot render images in popup windows
    9.2.0613: tests: test_xxd_color2() checks for dash but uses sh
    9.2.0614: opacity popup leaves stale cells
    9.2.0615: sixel encoder drops pixels on the right edge of shapes
    9.2.0616: GTK4: use-after-free on clipboard read timeout
    9.2.0617: GvimExt: does not support different runtime dirs
    9.2.0618: use-after-free in popup_getoptions() on dict_add() failure
    9.2.0619: integer overflow in popup image size validation
    9.2.0620: runtime(netrw): fix 2match pattern rebuild
    9.2.0621: 'autoindent' not stripped with virtualedit=onemore
    9.2.0622: str2blob() does not work with wide UTF-16 encoding
    9.2.0623: possible integer overflow in spellfile tree bounds check
    9.2.0624: C-N/C-P cannot be mapped in complete() completion
    9.2.0625: GTK4: Link error when Wayland is disabled
    9.2.0626: Vim9: illegal characters allowed in dict key names with dot notation
    9.2.0627: :vim9cmd source handles all scripts as Vim9 script
    9.2.0628: popup image: wrong overlap layering, kitty laggy
    9.2.0629: 0x80 and 0x9b byte not unescaped when check for valid abbr
    9.2.0630: popup images: kitty images output in GUI mode
    9.2.0631: DECRQM and SGR Mouse not supported in foot terminal
    9.2.0632: GTK4: no support for hardware-accelerated rendering
    9.2.0633: MS-Windows: No support for kitty graphics support in terminal
    9.2.0634: GTK4: no minimum resize limit
    9.2.0635: checking the syntax contains/cluster list is slow
    9.2.0636: popup image: stale pixels under RGBA animation frames
    9.2.0637: sixel: anti-aliased RGBA images render with visible outline
    9.2.0638: cannot return matches containing spaces from a custom completion
    9.2.0639: gq with 'formatprg' fails on an empty buffer
    9.2.0640: the "%" command jumps to parens and braces inside comments
    9.2.0641: GTK4: crash in gui_mch_menu_hidden()
    9.2.0642: statusline: buffer overflow with item groups
    9.2.0643: Missing Image ifdefs
    9.2.0644: popup image: duplicate sync-output code
    9.2.0645: Composing chars no longer accepted in end-id abbr
    9.2.0646: GTK3 GUI slow on HiDPI/4K with software rendering
    9.2.0647: matchfuzzypos() false exact match for long equal-length candidates
    9.2.0648: MS-Windows: Compile warnings
    9.2.0649: filetype: tf files sometimes incorrectly recognized
    9.2.0650: Vim aborts at startup when built with the example -O2 CFLAGS
    9.2.0651: completion: 'smartcase' doesn't work with 'longest'
    9.2.0652: popup: stale kitty image after clipwindow scrolls out of view
    9.2.0653: [security]: out-of-bounds write in tree_count_words()
    9.2.0654: GTK4: using uninitialised colors in gui_mch_init()
    9.2.0655: GTK4: missing NULL checks in vim_form_measure()
    9.2.0656: completion: using wrong tolower() in smartcase filtering
    9.2.0657: GTK4: missing menu when right-clicking in tabline
    9.2.0658: xxd: signed integer overflow in huntype()
    9.2.0659: GTK4: no balloon support in GUI
    9.2.0660: Dragging the scrollbar does not trigger WinScrolled
    9.2.0661: unintended wipe of Vim's temp dir, causes errors
    9.2.0662: [security] Stack out-of-bounds write in dump_prefixes()
    9.2.0663: [security]: runtime(netrw): code injection in local file deletion
    9.2.0664: tests: Test_delete_temp_dir() fails on MacOS
    9.2.0665: GTK4: GTK critical error on exit printed
    9.2.0666: Terminal-Normal mode does not color empty lines with a background color
    9.2.0667: patch 9.2.0590 was wrong
    9.2.0668: GTK4: minimum horizontal size is too small
    9.2.0669: GTK4: toolbar can be improved
    9.2.0670: [security]: Out-of-bounds read with text properties
    9.2.0671: [security]: possible out-of-bounds read with sodium encrypted files
    9.2.0672: corrupted text property causes internal error
    9.2.0673: tests: Test_recover_corrupted_swap_file() cannot handle symlinks
    9.2.0674: configure: clears dynamic ruby linker flags
    9.2.0675: tests: Test_cd_from_non_existing_dir() fails on Solaris
    9.2.0676: MS-Windows: cannot switch to a buffer with '%' in its name
    9.2.0677: Cannot clear the alternate file register #
    9.2.0678: [security]: potential powershell code execution in zip.vim
    9.2.0679: [security]: Out-of-bounds read with text property virtual text
    9.2.0680: keytrans() doesn't replace '|' and '\'
    9.2.0681: configure: -lruby added even for a dynamic ruby build
    9.2.0682: Wrong dot-repeat when calling complete() while filtering completion
    9.2.0683: filetype completion mishandles finished sub options
    9.2.0684: :reg # does not display the value of the '#' register
    9.2.0685: clipboard.c does not get the Wayland CFLAGS on GTK2
    9.2.0686: style: strcmp usage is inconsistent
    9.2.0687: popup_image_composites_frames() has improper if block scope
    9.2.0688: Terminal-Normal mode does not show the Visual selection on a colored empty line
    9.2.0689: the "%" command is slow on a long line with many slashes
    9.2.0690: Solaris: swap file names are too long
    9.2.0691: Solaris: Test_terminal_composing_unicode() fails
    9.2.0692: GTK2: build failure, popup images not drawn correctly
    9.2.0693: tests: Test_suspend() may fail because of keyprotocol query
    9.2.0694: Solaris: some tests faiures due to Solaris peculiarities
    9.2.0695: Solaris: test_delete_temp_dir() fails because of missing flock
    9.2.0696: GTK4: A few issues with toolbar support
    9.2.0697: possible overflow when parsing CSI keys
    9.2.0698: [security]: Out-of-bounds write with soundfold()
    9.2.0699: [security]: possible code execution with python complete
    9.2.0700: configure: -lrt requirement for timer_create not detected
    9.2.0701: tests: test_terminal.vim does not wait for job to finish
    9.2.0702: :windo and :tabdo create an extra window with 'winfixbuf'
    9.2.0703: session file does not store relative Vim9 autoload imports
    9.2.0704: GTK4: not handling mouse events
    9.2.0705: :delete # silently fails to update "# and clobbers "0
    9.2.0706: tests: test_terminal3 may fail when $SHELL is zsh
    9.2.0707: completion: popup misplaced when text before it is concealed
    9.2.0708: Leaks in do_autocmd in error case
    9.2.0709: GTK4: a few minor issues
    9.2.0710: GTK4 GUI resize handling can be improved
    9.2.0711: leak in ins_compl_infercase_gettext() in error case
    9.2.0712: GTK4: dialogs not handling mnemonics correctly
    9.2.0713: completion: ruler not updated correctly when the popup menu is visible
    9.2.0714: Coverity warns for NULL deref
    9.2.0715: Coverity warns about copy/paste error in hl_blend_attr()
    9.2.0716: filetype: not all supertux files are recognized
    9.2.0717: tests: strange indent in Test_autocmd_dup_arg()
    9.2.0718: :syn sync without an argument also lists syntax cluster
    9.2.0719: GTK4: default menu is lacking
    9.2.0720: GTK4: no support for browsefilter
    9.2.0721: serverlist() returns strings separated by \n
    9.2.0722: GTK4: find/replace dialog can be improved
    9.2.0723: term_start() does not support "noclose"
    9.2.0724: Use-after-free when freeing exit_cb job on exit
    9.2.0725: [security]: Stack out-of-bounds write in spell_soundfold_sal()
  - Refresh patches:
    * vim-9.1.1732-fix-inc-detection.patch

++++ hawk2:

  - ruby_fix_shebang_path is not yet in sle16 (bsc#1269291)
  - bump gems:
    * action_text-trix-2.1.19.gem
    * bigdecimal-4.1.2.gem
    * concurrent-ruby-1.3.7.gem
    * crass-1.0.7.gem
    * erb-6.0.4.gem
    * gettext_i18n_rails-2.2.0.gem
    * gettext_i18n_rails_js-3.1.5.gem
    * globalid-1.4.0.gem
    * i18n-1.15.2.gem
    * irb-1.18.0.gem
    * json-2.20.0.gem
    * js-routes-2.4.1.gem
    * marcel-1.2.1.gem
    * minitest-6.0.6.gem
    * net-imap-0.6.4.1.gem
    * po_to_json-3.0.5.gem
    * pp-0.6.4.gem
    * psych-5.4.0.gem
    * puma-8.0.2.gem
    * rake-13.4.2.gem
    * sorbet-runtime-0.6.13316.gem
    * websocket-driver-0.8.2.gem
    * zeitwerk-2.8.2.gem

++++ hydra:

  - Update to version 9.7+git8.g9cc84c2:
    * Various vulnerability fixes and improvements
    * Fix vulnerability in NTML encoding [CVE-2026-56766]
    * Full changelog at /usr/share/doc/packages/hydra/CHANGES

++++ python-jupyterlab-templates:

  - Refresh javascript dependencies to update ws
    (bsc#1268933,  CVE-2026-48779)

++++ kbuild:

  - Add ExclusiveArch condition based on existing kHlpAssert.h
    contents and SUSE patches.

++++ kernel-default:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-source:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-docs:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-kvmsmall:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-obs-build:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-obs-qa:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-syms:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kernel-vanilla:

  - Update config files.
    Enable PSI measurement (jsc#PED-15418).
    Align with upstream default and allow simpler usage of PSI data.
  - commit 1f56042
  - Refresh
    patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch.
  - Refresh
    patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch.
  - Refresh
    patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch.
  - Refresh
    patches.suse/ima-return-error-early-if-file-xattr-cannot-be-changed.patch.
    Update upstream status by: ./scripts/series_sort -u
  - commit 594ea34
  - Refresh
    patches.suse/ACPICA-Unbreak-tools-build-after-switching-over-to-s.patch.
    Update upstream status.
  - commit c4d22cc

++++ kompare:

  - add AlignTop-the-text.patch to fix text clipping (kde#481778)

++++ lal:

  - Add lal-ptr-const-qualifier.patch: correctly declare pointers to
    const data to prevent "discarded-qualifier" warnings, which in
    turn cause build errors due to the use of "-Werror".

++++ lalinference:

  - Add lalinference-ptr-const.patch to add const qualifiers to
    pointers where applicable to prevent discarded-qualifiers
    warnings/errors.
  - Add Requires: python-igwn-ligolw needed for updated version
    4.1.9.

++++ lalpulsar:

  - Add lalpulsar-ptr-const.patch: correctly declare pointers to
    const data to prevent "discarded-qualifier" warnings, which in
    turn cause build errors due to the use of "-Werror".
  - Update to version 7.1.1 (no release notes).

++++ libcamera-full:

  - Be explicit about not using libunwind to address a
    s390x build failure.

++++ onnxruntime:

  - Refactor to be less bundled-aware and more patched/upstream (Fedora-style):
    * Unbundle flatbuffers, cpuinfo, boost/mp11 and eigen3; only date, onnx
    (C++) and SafeInt remain bundled (openSUSE ships no package for them).
    * Add system-mp11.patch and system-flatbuffers.patch; rename
    eigen-system.patch to system-eigen3.patch (drop EXPERIMENTAL wording,
    eigen 5.0 builds fine). cpuinfo needs no patch in 1.26 (system CMake
    config provides cpuinfo::cpuinfo).
    * BuildRequires: flatbuffers-devel (also provides flatc), cpuinfo-devel,
    libboost_headers-devel.
    * Regenerate the flatbuffers schemas with the system flatc in %build.
    * Drop CMAKE_DISABLE_FIND_PACKAGE_flatbuffers/mp11 and the
    FETCHCONTENT_SOURCE_DIR overrides for the now-system deps; remove the
    obsolete bundled source zips.
  - Packaging changes accompanying the 1.26.0 update:
    * Build now requires C++20 — BuildRequires bumped to gcc-c++ >= 11 and
    cmake >= 3.28 (upstream enforces GCC >= 11.1 / CMake 3.28).
    * Disable warnings-as-errors (--compile-no-warning-as-error): GCC 15 emits
    false positives (e.g. -Wfree-nonheap-object in skip_layer_norm_fusion.cc)
    that upstream's per-target -Werror would otherwise turn into build failures.
    * Bundled onnx updated 1.20.1 -> 1.21.0 (upstream cmake/deps.txt); sympy is
    now optional upstream but kept as a runtime Requires for shape inference.
    * Unbundle dependencies openSUSE ships at a compatible version, per Factory
    review feedback:
  - protobuf: build against the protobuf21 compat package (21.12, matches
    upstream cmake/deps.txt and ships protoc) instead of the bundled copy.
  - abseil-cpp + re2: build against the system libraries; abseil's CMake
    config is ExactVersion, so abseil-system-version.patch drops ORT's
    "FIND_PACKAGE_ARGS 20250814" gate, letting find_package use Factory's
    abseil (20260107). re2 follows as a matched pair. NixOS and Fedora also
    build onnxruntime against abseil 20260107.
  - nlohmann_json, ms-gsl: use the system header-only libraries.
  - Switch FETCHCONTENT_TRY_FIND_PACKAGE_MODE from NEVER to OPT_IN.
    * Still bundled: flatbuffers (Factory's CMake config exports only the shared
    target, not flatbuffers::flatbuffers), mp11 (no Boost::mp11 target from
    Factory's Boost), eigen (Factory ships 5.0, ORT needs 3.4), onnx (no C++
    package), cpuinfo (devel ships no CMake config), date and SafeInt (not
    packaged).
    * Drop BSD-3-Clause from the License tag (its only carriers, protobuf and
    re2, are now system libraries).
  - Update to version 1.26.0:
    * 1.26.0 - cherry-pick for RC2 (#28347)
    * GridSample: harden float->int64 casts against NaN/Inf/out-of-range coords (#28302)
    * Relax GQA seqlens_k shape validation for backward compat with older models (#28259)
    * Fix DoubleQDQPairsRemover adding spurious dimension to scalar scale/zero-point (#28057)
    * remove weights_are_all_positive_  from TreeEnsemble (#27552)
    * fix(ci): incorrect relative template includes for setup-feeds (#28312)
    * Add QNN Plugin EP repo link to README (#28225)
    * Include license file in built distributions (#27783)
    * Fix CUDA 13 build error in gqa_unfused_attention.cu (#28309)
    * [OVEP] OpenVINO EP 1.26.0 Development Release Updates (#28297)
    * Fix NVTX profiling: restore missing node_compute_range_.Begin() call (#28273)
    * Fix session logger use-after-free during EP teardown under VERBOSE logging (#28274)
    * Implement CUDA EP Plugin profiling API (#28216)
    * Language bindings for Hardware Device and EP Compatibility APIs (#28128)
    * Propagate python authentication to docker contexts (#28295)
    * Use CUDART_VERSION reduction compatibility in GQA attention (#28296)
    * WebGPU plugin EP Python packaging (#28226)
    * [NvTensorRTRTX EP] Fix build breaks with TRT-RTX 1.5+ and 1.6+ (#28263)
    * Fix NPM packaging (#28238)
    * Add RISC-V Vector (RVV) support for CPU Execution Provider (#28261)
    * ICM fixes (6/n) (#28255)
    * [React Native] Add react-native.config.js and Expo plugin MainApplication patch to fix autolinking (#28266)
    * [Cuda] Upgrade cutlass to 4.4.2 (#28276)
    * [WebGPU] Add GridSample operator (#28264)
    * Add update_inplace overload accepting OrtValue for device-to-device copy (#28256)
    * Fix cpuinfo init on Linux without CPU sysfs lists (#28230)
    * [OVEP] Updating OV version to 2026.1.0 (#28170)
    * [WebNN] Rename roundingType to outputShapeRounding for pool2d ops (#28172)
    * webgpu: merge batchA into M dimension when batchB==1 (#28197)
    * Add aarch64 wheel build to CUDA 13 Python packaging pipelines (#27760)
    * WebGPU: Support Split-K with batch size > 1 (#28151)
    * Replace unsafe `reinterpret_cast` with C API calls in `include/onnxruntime/ep/adapter/op_kernel_info.h` (#28081)
    * Add position_ids bounds validation to WebGPU/JS RotaryEmbedding kernels (#28214)
    * Fix universal package version validation comment and add SHA prefix (#28248)
    * fix out of boundary vector per class in SVM (#27952)
    * Improve SparseTensors public API input validation as well as sparse utilities (#28227)
    * [CoreML EP] Add QuickGelu support (#28184)
    * chore(ci): temporarily remove react-native from NPM required publish pkg set (#28254)
    * [CUDA] PagedAttention: add SM<80 fp16 fallback via memory-efficient attention (#28200)
    * security: replace unrestricted setattr with allowlist in Python backend (#28083)
    * [VitisAI] pass base timestamp for vitisai profiling (#27808)
    * Address CI build failure (#28243)
    * ICM fixes (5/n) (#27971)
    * chore(ci): `NIGHTLY_BUILD` env-var is now set via pipeline parameter (#28241)
    * Fix heap OOB read in RNN operator via sequence_lens=0 (#28052)
    * [WebGPU] Fix MHA to ignore past key/value when no present outputs requested (#28027)
    * Add regression test for quantize_static with in-memory ModelProto (#23268) (#28201)
    * GQA unfused attention with FP32 QK accumulation (fixes #28195) (#28198)
    * webgpu: Refactor SubgroupMatrixMatMulNBits to vendor-agnostic config … (#28109)
    * Add LabelEncoder CUDA execution provider for numeric types (#28045)
    * Add packaging pipeline for CUDA plugin EP (#28152)
    * [CI] Remove win gpu doc gen and trt cuda mini CI pipelines (#28218)
    * Fix missing include for SetRawDataInTensorProto in NV TensorRT RTX tests (#28065)
    * [CoreML EP] Add HardSigmoid support (#28182)
    * [Plugin WebGPU EP] Fix API initialization error handling (#28211)
    * Fix heap OOB write in EmbedLayerNormalizationShapeInference (#28176)
    * Add workflow to replace Windows GPU Doc Gen CI Pipeline (#28192)
    * fix: add missing BackendKernelSelectorConfig parameter to QNBitGemmPackQuantBDataSize_Lasx (#28179)
    * Add exponential-backoff option for thread pool spin loop (#28096)
    * [Core] Add correctness tests for SpaceToDepth and MobileClip Attention fusion (#28168)
    * Make sure in memory initialziers are not propagated externally (#28189)
    * [MLAS] Enable FP16 for Gelu (#26815)
    * Update TRT CI to replace Linux_TRT_Minimal_CUDA_Test_CI pipeline (#28194)
    * Address parameter validation across all EPs for Convo kernels (#28142)
    * Removes duplicate macos dylib and fixes packaging for the Microsoft.ML.OnnxRuntime.Foundry package (#28191)
    * Fix overflow in CopyCpuTensor for sub-byte types (#28171)
    * Allow comments in `build.py` argument files (#27624)
    * Refine specification of CMake C/C++ standard version requirement (#28126)
    * Fix string tensor deserialization in ORT format models (#28133)
    * Add MatMul double implementation, inspect optimizers add test coverage (#28145)
    * Test Driver update (#28190)
    * Apply model size limit before converting size_t input to int32_t (#28112)
    * Enable API doc generation builds in PR checks (#28124)
    * Implement GetAvaiableResource() callback  (#28103)
    * [webgpu] support arbitrary input_channel size for im2col (#27038)
    * Fix lack of auth on python packaging (#28118)
    * Fix RemoveDuplicateCastTransformer incorrectly eliminating lossy Cast chains targeting bool (#28102)
    * Add seqlens_k bounds validation in GroupQueryAttention to prevent GEMM OOB (#28031)
    * CoreML: Add support for Pad with 'reflect' for ML Program (#28073)
    * Fix doxygen issues (#28122)
    * ICM fixes (1/n) (#27906)
    * [NvTensorRTRTX EP] Implement GetHardwareDeviceIncompatibilityDetails with driver and compute capability checks (#27577)
    * Fix packaging pipeline TSA Upload warnings  (#28127)
    * Add INT8, INT16, and UINT8 type support for CUDA TopK operator (#27862)
    * Use cuBLAS status APIs for error strings (#27946)
    * WebGPU plugin EP pipeline updates (#28121)
    * Address build failure on ARM (#28120)
    * Disable QDQ related transformers for WebNN EP (#28020)
    * Use weights_only for torch.load checkpoints (#28097)
    * Use SafeInt for size arithmetic in CPU tensor operators to prevent overflow (#28060)
    * Update worker thread pool to use time based wait. (#27916)
    * Fix int32 overflow in CUDA Gather kernel for large tensors (#28108)
    * [CORE]: Improve filesystem error messages during Linux device discovery (#27289)
    * fix(ml): use SafeInt checked arithmetic in ML operator coefficient size validation (#28001)
    * Set SOVERSION 1 for Apple builds to match Linux library versioning (#28101)
    * Fix CoreML EP issue with external weight path handling. (#28062)
    * [CI] fix: use internal feed for NPM on ADO (#28079)
    * Remove old custom EP load infrastructure (#28095)
    * Do not create numpy on top of Tensor non-owning buffer (#28088)
    * Bump vite from 6.4.1 to 6.4.2 in /js/web/test/e2e/exports/testcases/vite-default (#27991)
    * Validate token_id bounds in NGramRepeatBlock to prevent OOB write (#28039)
    * Bump picomatch from 2.3.1 to 2.3.2 in /js/web (#27850)
    * Bump picomatch from 2.3.1 to 2.3.2 in /js/react_native/e2e (#27849)
    * Bump picomatch from 2.3.1 to 2.3.2 in /js/common (#27847)
    * Bump picomatch from 2.3.1 to 2.3.2 in /js (#27846)
    * removes webgpu from onnxruntime-foundry-nuget package (#27929)
    * Added a dimension check in `MatMulComputeHelper` to ensure the inner dimension `K_` (#28053)
    * Update global-agent comments to use version-agnostic GitHub URL (#28061)
    * [WebGPU EP] Reduce forward declaration boilerplate in kernel registration (#27977)
    * Fix heap OOB write in MaxPoolGrad via indices bounds validation (#27903)
    * Fix the python pipeline (#28084)
    * Add more checks and add functional coverage for bifurcation_detector (#28068)
    * Bump follow-redirects from 1.15.6 to 1.16.0 in /js/web (#28056)
    * Fix FlashAttentionDecodeSplitVx indirect dispatch input ordering (#27926)
    * Bump follow-redirects from 1.15.6 to 1.16.0 in /onnxruntime/test/wasm (#28076)
    * Bump electron from 38.1.2 to 39.8.5 in /js/web (#27974)
    * Add tensor size validation for MatMulBnb4 to prevent OOB read via K/N attribute mismatch (#27995)
    * Bump picomatch from 4.0.2 to 4.0.4 in /js/web/test/e2e/exports/testcases/vite-default (#27844)
    * [CI] chore: remove QNN and python DML from release meta-pipeline (#28077)
    * [C] fix: ADO CI spuriously failing format check due to picking up NuGet.config (#28064)
    * Move WASM builds to large VMs (#28069)
    * [CUDA] QuantizeLinear and DequantizeLinear opset 25 (#28046)
    * Bump lodash from 4.17.23 to 4.18.1 in /js/react_native/e2e (#27966)
    * fix: idempotent feed setup (#28034)
    * [CUDA EP Plugin] ResourceAcountant integration (#28028)
    * Handle int overflow in rnn (#28003)
    * [CI] fix: bad relative ref to setup-feeds template (#28050)
    * ICM fixes (2/n) (#27922)
    * [Optimizer] Fix ConstantFolding crash with missing optional outputs (#27620)
    * Bump yaml from 2.7.0 to 2.8.3 in /js/react_native/e2e (#27863)
    * Bump next from 16.1.5 to 16.2.3 in /js/web/test/e2e/exports/testcases/nextjs-default (#28036)
    * Bump fast-xml-parser from 4.5.3 to 4.5.6 in /js/react_native/e2e (#28017)
    * [QNN-EP] Add additional guards for file mapping (#27871)
    * fix a security issue in SVM* (#27950)
    * Bump lodash from 4.17.23 to 4.18.1 in /js/web (#27990)
    * [WebGPU EP] Fuse QMoE 1-token decode path to reduce GPU dispatches (#27998)
    * centralise feed authentication for ADO pipelines (#27997)
    * [VitisAI] fix dangling pointer (#27949)
    * Fix plugin EP profiling timestamp skew on macOS (#27994)
    * Add CUDA Graph support for the CUDA plugin EP (#28002)
    * Modify scale & offset of WhereDummyDq (#27109)
    * [Plugin EP] Port graph capture/replay APIs (#27958)
    * ICM fixes (3/n) (#27925)
    * mlas/arm64: add BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878)
    * webgpu support for qwen3.5 (#27996)
    * Add pre-commit git hook to run lintrunner on staged files (#28013)
    * Add bounds validation for LinearClassifier coefficients (#27989)
    * Validate g_idx values in MatMulNBits to prevent OOB read (#27582)
    * [CPU/CUDA ep] Improve DeformConv op performance (#27824)
    * [webgpu] Set `is_channels_last` to true by default in `ComputeMatMul` (#27674)
    * fix target_ids out of boundary in TreeEnsemble* (#27951)
    * Remove unnecessary model package test (#28015)
    * Model Package Support (#27786)
    * [web] 2 small fixes to JavaScript code (#27985)
    * Add INT8, INT16, and UINT8 type support for CPU TopK operator (#27860)
    * webgpu: Fix buffer overflow in BufferManager::Upload causing data corruption (#27948)
    * Refactor Intel SubgroupMatrix MatMulNBits (#27911)
    * Implement/migrate Arena allocators to cuda plugin ep. (#27931)
    * Fix GatherND zero-dimension index validation bug (#28006)
    * Add AI agent instructions (#27856)
    * Add LinearAttention and CausalConvState ops for Qwen3.5 (#27907)
    * Bump lodash from 4.17.23 to 4.18.1 in /onnxruntime/test/wasm (#27969)
    * CUDA Plugin Cleanup for Shared Kernel Helpers (#27915)
    * Add CUDA plugin EP Sync support for IOBinding (#27919)
    * Fix build failure when both CUDA and MiGraphX execution providers are enabled (#27798)
    * Add CUDA Plugin EP CI and fix Windows plugin build support (#27959)
    * [CORE][NVEP]: add support for Vulkan interop (#27456)
    * Add webgpu plugin EP pipeline (#27841)
    * Add __array__ and DLPack protocols to OrtValue (#27980)
    * Fill CUDA Transpose operator opset gap (23 → 25) (#27740)
    * +rotemb, +rmsnorm, reshape->opset-25, transpose->opset-24 (#27752)
    * Fix heap OOB write in Attention PrepareMask via negative mask_index values (#27789)
    * Fix ADO pools for webgpu & other (#27988)
    * Fix heap OOB read in SVMRegressor via attribute size validation (#27901)
    * linear attention signature (#27842)
    * Bump version to 1.26.0 (#27955)
    * [DOCS ]Add annotated partitioning documentation (#27972)
    * ICM fixes (4/n) (#27957)
    * Fix narrow-to-wide string conversion bugs in dll_load_error.cc (#27777)
    * [webgpu] house keeping after ORT switch to c++20 (#27904)
    * Fix CUDA ONNX Attention: min_bias_align crash on SM<80 and MEA NaN for fully-masked batches (#27831)
    * ONNX 1.21.0 integration (#27601)
    * [Core] MobileClip Attention Fusion (#27883)
    * Cleanup: Consolidate `OpKernel::UseSharePrePackedBuffers_V2` and `OpKernel::UseSharePrePackedBuffers` (#27924)
    * [WebGPU EP] Support Conv3D (#27917)
    * Cleanup for op schema API tests for plugin EPs (#27921)
    * Add ORT_UNIT_TEST_MAIN_DYNAMIC_PLUGIN_EP_CONFIG_JSON_FILE env var (#27945)
    * Fix CPU Attention overflow issue (#27822)
    * [DML EP] Disable 4-D MVN tests for DirectML (#27930)
    * Fix typo in CApiTest.VersionConsistencyWithApiVersion. (#27902)
    * webgpu lpnorm support (#27876)
    * Fix CPU LRN int overflow issues (#27886)
    * [MLAS] Add depthwise with multiplier conv special kernel for NCHW data layout on Avx512 (#27874)
    * Plugin EP event profiling APIs (#27649)
    * [VitisAI] external_ep_library typo fix (#27647)
    * S390x test fixes (#27404)
    * [QNN-EP] Fix use-after-free of logger object (#27804)
    * webgpu: Optimize DP4A SmallM MatMulNBits tiling (#27910)
    * [Plugin EP] Add plugin EP APIs to retrieve ONNX operator schemas (#27713)
    * [CI] fix: missing `branch` specifier in `schedule` directive (#27914)
    * CUDA Plugin EP: Core Implementation (#27816)
    * [Plugin EP] Add plugin EP Sync API (#27538)
    * [CI] chore: bump `actions/cache@v5` (#27866)
    * Fix run-level profiling for subgraph operators (#27870)
    * webgpu: Increase MatMulNBits K-parallelism with tile_size_k_vec=32 (#27834)
    * Add per-session thread pool work callbacks API (#27253)
    * Fix integer modulo by zero crash in CPU EP Mod operator (#27833)
    * fixes to pass webnn DequantizeLinear compliance tests over webgpu ep (#27778)
    * Add cron job to release pipeline (#27864)
    * fix potential out of boundary issue when initializer a SVMClassifier (#27699)
    * Annotation based partitioning along with resource accounting (#27595)
    * Fix overflow in DmlGraphFusionHelper::ProcessInputData (#27815)
    * Fix new-delete mismatch in DML EP's QuantizeLinear operator (#27823)
    * Add MHA fusion for Nemotron speech conformer encoder (#27764)
    * Fix WebGPU buffer segment offset alignment (#27853)
    * update jsvascript dependencies (#27838)
    * Shell injection constant strings (#27840)
    * [CI] feat: use ccache & vcpkg cache for linux workflows (#27623)
    * Disable KleidiAI for older versions of MSVC without Aarch64 SME support. (#27825)
    * Route fp16 HQNBIT_CompInt8 (4-bit and 8-bit) through fp32 MLAS path in MatMulNBits (#27820)
    * Fix --build_wasm_static_lib implicitly enable --build_wasm (#27342)
    * [wasm] fix non-SIMD sgemm implementation (#27819)
    * mlas/arm64: Add AArch64 assembly path for NCHWc float kernel and wire into build (#27788)
    * Only validate REACT_NATIVE if required (#27827)
    * webgpu: Fix multi-session GPU profiling event attribution (#27689)
    * Fill CUDA EP opset gap for Shape operator (23→25) (#27734)
    * Update CUDA TopK kernel registration to opset 24 with BFloat16 support (#27735)
    * [CPU] Handle ONNX domain Gelu and HardSigmoid activations in the NCHWc transformer suite (#27821)
    * Fix WebGPU device destroyed on session release, breaking session recreation (#27634)
    * [WebGPU] Einsum fixes for 5D tensors (#27779)
    * Make WebGPU EP compatible with EP API (#26907)
    * [MLAS] Add fused Silu and Gelu kernels for AVX512 (#27690)
    * Bump flatted from 3.3.3 to 3.4.2 in /js (#27799)
    * Bump flatted from 3.3.3 to 3.4.2 in /js/react_native/e2e (#27785)
    * Bump rollup from 4.35.0 to 4.59.0 in /js/web/test/e2e/exports/testcases/vite-default (#27463)
    * Extend DQ→MatMulNBits fusion to support Gemm + per-tensor/per-channel quantization (#27769)
    * fix webnn test case for webgpu ep: 'transpose float32 1D constant tensor default op… (#27773)
    * fix webnn/where complicance tests for webgpu (#27776)
    * Fix NeonFp16DequantB8Bit reference to match kernel fp16 precision (#27812)
    * Fix QNN SDK version propagation in Linux ort-qnn wheel build (#27800)
    * [CUDA] Extend Pad support through opset 25 with wrap mode (#27774)
    * [CUDA] RoiAlign for opset versions 16 and 22 (#27646)
    * Fix non-ASCII Unicode model path crash across session and provider code (#27724)
    * [CPU/CUDA EP] Add DeformConv op support (#27393)
    * Fix tf.function retracing in TensorFlow benchmark (#27665)
    * [CPU] Update the NCHWc transformer to handle more patterns (#27691)
    * [Core] Add SpaceToDepth fusion pattern (#27747)
    * Add opset 21/23 CUDA kernel registrations for Flatten, Identity, If, Loop, Scan, ConstantOfShape, Size (#27728)
    * Bump flatted from 3.2.7 to 3.4.2 in /onnxruntime/test/wasm (#27787)
    * Fix out of bounds read issue in cross.entropy.cc (#27568)
    * Fill CUDA EP opset gap for GRU operator (14 → 22) (#27738)
    * [React Native] Fix float16 tensor crash by mapping to Uint16Array (#27549)
    * Dev/erscor/2026/3/19 make react native optional (#27772)
    * [WebGPU] DequantizeLinear op fixes (#27706)
    * Fill GlobalAveragePool and GlobalMaxPool opset gap in CUDA provider (1→22) (#27733)
    * Add SkipLayerNorm fusion with bias Add (#27765)
    * [CUDA] Refactor CUDA helpers or ops for plugin EP (#27719)
    * Enable KleidiAI for asymmetric 4-bit MatMulNBits on ARM64 (#27751)
    * Support softcap and softmax_precision in Attention(CUDA) (#27714)
    * Java: avoid provider resource extraction when library already exists in onnxruntime.native.path (#27668)
    * Fix integer division by zero crash in CPU EP Div operator (#27693)
    * Fill Squeeze and Unsqueeze CUDA opset gaps to opset 25 (#27739)
    * Improve checks in concat_slice_elimination against optional attrs and unsqueeze_elimination against invalid model (#27638)
    * Add optional router_weights input to QMoE for separate selection/aggregation routing (#27687)
    * Fix onnxruntime-qnn python wheel build on WSL (#27730)
    * Add ORT_ENFORCE for swiglu_fusion==1 in QMoECPU to prevent out-of-bounds read (#27748)
    * Fix large model check in Intel's Neural Compressor (#27746)
    * [MLAS][KleidiAI]Catlaw01/sgemm epilogue neon opt (#27609)
    * Fix WebGPU ConvTranspose shader bugs for non-vectorizable input channels (#27749)
    * Offload H100 issues to A10 pools (#27711)
    * [MLAS] Enable BF16 KAI SBGemm on NCHWc ARM builds (#27703)
    * [QNN-EP] Disable file mapping for embedded cache (#27627)
    * Release Packaging Pipeline Orchestration (#27611)
    * fix: invalid ccache args when running with old ccache version (#27698)
    * [CANN] Fix test errors during onnxruntime-cann build and compilation (#27091)
    * Add fp16 support for 8-bit MatMulNBits on ARM64 and fix pre-existing bugs (#27692)
    * CUDA Resize: add optimized 3D nearest resize kernel for 5D up/down sa… (#27578)
    * Address Pad Reflect vulnerability (#27652)
    * [Build] Fix clang build issues for CPU and CUDA builds (#27669)
    * Fix MLAS qgemm dispatch and kernel regressions in quantized conv tests (#27671)
    * [CUDA] DecoderMaskedMultiHeadAttention files consolidation (#27688)
    * [webgpu] fix condition of DAWN_ENABLE_VULKAN and DAWN_ENABLE_D3D12 (#27694)
    * Upgrade minimatch 3.1.2 to 3.1.4 (CVE-2026-27904) (#27667)
    * [MLAS] Integrate KleidiAI BF16 SME2 Kernel Through Mlas SBGEMM Path (#26773)
    * [Build] Fix debug build (#27659)
    * Fix NvTensorRTRTXExecutionProvider capability claims (#27631)
    * [web] Fix 2 bugs in emdawnwebgpu (patches dawn) (#27641)
    * Plugin EP: Fix bug that incorrectly assigned duplicate MetDef IDs to fused nodes in different GraphViews (#27666)
    * [Plugin EP] Check for nullptr before dereferencing (#27644)
    * Add RotaryEmbedding fusion for Qwen3 on-the-fly RoPE patterns (#27590)
    * [VitisAI] Fix unused warnings (#27630)
    * Add C# and Python language bindings for GetCompatibilityInfoFromModel / GetCompatibilityInfoFromModelBytes (#27565)
    * Cleanup external data path validation (#27539)
    * Revert "[QNN EP] Fix error messages being logged as VERBOSE instead o… (#27650)
    * Fix DQ→MatMulNBits fusion for FP16 models on CPU EP (#27640)
    * Skip building custom_op_library if CUDA_MINIMAL is enabled  (#27520)
    * Add PE version info to onnxruntime_providers_vitisai.dll (#27626)
    * [Cuda Plugin] Refactor CUDA ops — Move more shared CPU/CUDA helper code from .cc to headers (Part 2) (#27628)
    * Fix build errors of GridSample and test failures in test_attention_fusion.py (#27642)
    * [TensorRT RTX] Fix compiler warnings on Linux and Windows (#27602)
    * [js/rn] Add 16KB page size alignment for Android (#27523)
    * Accept legacy WebGPU/WebNN memory info names for backward compatibility (#27637)
    * Optimize ONNX Attention KV cache with ConcatNewToPast and add release-build kernel safety (#27613)
    * [CUDA] Support volumetric (3-D) grid sampling in the CUDA GridSample operator (#27201)
    * Add Qwen3 model type support to Python transformer optimizer (#27556)
    * Use SafeInt in implementation of Col2Im (#27625)
    * Update to C++20 (#27178)
    * MLAS/POWER10: Optimize Sgemm PackA kernel using VSX intrinsics and assembly. (#27575)
    * [Cuda Plugin] Refactor CUDA ops — Move shared CPU/CUDA helper code from .cc to headers (#27617)
    * Fix WebGPU EP crash on exit (#27569)
    * Add PCI bus fallback for Linux GPU device discovery in containerized environments (#27591)
    * Fix Potential Integer Truncation Leading to Heap Out-of-Bounds Read/Write (#27544)
    * Use `_tpause` instead of `__builtin_ia32_tpause` (#27607)
    * Expose Python `OrtDeviceVendorId` enum and use it for vendor-aware `OrtDevice` aliases (#27594)
    * [CUDA] Add Validation of batch_indices in RoiAlign (#27603)
    * chore: tooling shouldn't ignore forge hidden folders (#27580)
    * Add validation of position_ids in RotaryEmbedding operators (#27597)
    * Update .NET action version  (#27618)
    * Extend DQ→MatMulNBits fusion to support 2/8-bit weights and Cast(fp16→fp32) patterns (#27614)
    * Add KernelInfo string-array attribute APIs to the ORT C and C++ APIs (#27599)
    * Remove some dead YML code (#27530)
    * [EP Plugin Adapter] support LoggingManager::HasDefaultLogger() (#27587)
    * Bump tar from 7.5.9 to 7.5.11 in /js/node (#27616)
    * [CUDA Plugin] Refactoring Einsum (#27606)
    * Add validation and unit tests AffineGrid (#27572)
    * Address Tile kernel dim overflow and generate tests (#27566)
    * Add cherry_pick.py script for ORT release (#27333)
    * Add validation for negative position_ids in EmbedLayerNorm (#27573)
    * Add WebGPU support for TopK (#27560)
    * Support Attention(24)-CUDA and disjoint from contrib op (#27542)
    * Add fix for double allocation MiGraphX EP (#27551)
    * Session config to create weightless EPContext models during compilation (#27197)
    * [QNN EP] Enable offline x64 compilation with memhandle IO type (#27479)
    * Adding CIG context creation in OrtFactory (#27267)
    * Update CUDA minimum required version to 12.0 (#27570)
    * Add missing attribute array validation for TreeEnsembleClassifier (#27571)
    * webgpu: support bool for Expand, Flatten, Gather and Unsqueeze (#27561)
    * webgpu: Split `MatMulWriteFnSource()` into smaller functions (#27448)
    * [ARMNN EP] Remove ArmNN Execution Provider (#27447)
    * security fix for transpose optimizer (#27555)
    * Add validation of onnx::TensorProto data size before allocation (#27547)
    * Fix GPT-2 no-past attention fusion for transformers >= 4.27 (#27449)
    * DQ→MatMulNBits fusion transformer for NvTensorRtRtx ep  (#27466)
    * Remove tools/ci_build/github/azure-pipelines/build-perf-test-binaries-pipeline.yml (#27517)
    * Fix RoiAlign heap out-of-bounds read via unchecked batch_indices (#27543)
    * [WebNN] Support DepthToSpace op (#27508)
    * Add/Update telemetry events (#27356)
    * [EP Plugin] use ORT_EP_API_ADAPTER instead of BUILD_WEBGPU_EP_STATIC_LIB (#27540)
    * Merge ConstantOfShape and Cast in clean_graph optimization (#27482)
    * Add OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict (#27535)
    * [WebNN] Improve MultiHeadAttention op implementation (#27494)
    * [EP API] support OpKernelInfo::GetConfigOptions for adapter (#27541)
    * increase kMaxValueLength to 8192 (#27521)
    * Account for ORT_NO_EXCEPTIONS builds in Lora test (#27537)
    * Remove some dead code. (#27320)
    * Fix incorrect warning suppression in projects using precompiled headers on Windows (#27039)
    * Add "library_path" metadata entry to OrtEpDevice instances for plugin and provider bridge EPs (#27522)
    * [NvTensorRTRTX EP]: Add missing override specifiers to suppress warnings (#27288)
    * [CXX Lora] Prevent heap OOB from maliciously crafted Lora Adapters. (#27518)
    * Support broadcasting skip shapes in SkipLayerNorm fusion (#27489)
    * Fix for Cuda Graph in pre-compiled path (#27477)
    * [Build] Fix pybind11 vcpkg configuration (#27514)
    * Fix -Warray-bounds build error in MLAS on clang 17+ (#27499)
    * Fix double-free in TRT EP custom op domain Release functions (#27471)
    * Suppress spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds (#27454)
    * Split out Linux CUDA Python package builds into separate stages (#27490)
    * Add pre-layer normalization support to attention fusion (#27418)
    * Fix O(n²) model load time for TreeEnsemble with categorical feature chains (#27391)
    * Remove s_kernel_registry_vitisaiep.reset() in deinitialize_vitisai_ep() (#27295)
    * Reduce allocation size in test Gather_oveflow_check from 4GiB to >2GiB (#27483)
    * [CPU] GridSample operator performance improvement on bilinear interpolation… (#27359)
    * [EP API] header-only adapter for EP API (#26919)
    * [MLAS/CPU EP]: Introduce a backend kernel selector config in MLAS (#27136)
    * Remove cudaStreamSynchronize from CUDA LLM ops for CUDA graph capture compatibility (#27484)
    * Improve error message when EPContext node is not assigned to an EP (#27474)
    * webgpu: support int64 for Unsqueeze and Expand operators (#27478)
    * Move JAR testing pipelines to canonical pipeline template (#27480)
    * Fix WebGPU static destruction crash by heap-allocating contexts map (#27470)
    * Support boolean attention mask in Attention(23) CUDA - MHA case (#27428)
    * Fix BART attention fusion for SDPA pattern from transformers >= 4.49 (#27458)
    * Fix Cast node naming collisions and opset 10 Resize in float16 conversion (#27469)
    * Build Windows ARM64X binaries as part of packaging pipeline (#27316)
    * softplus support for webgpu (#27457)
    * Remove unused cusparse library dependency (#27467)
    * upgrade dawn to ec7b457e5bb1fcec6f59733c4f3dd84d2f885a38 (#27427)
    * [web] remove the unhelpful "Unknown CPU vendor" warning. (#27399)
    * [web] fix usage of wasmBinary together with a blob URL for .mjs (#27411)
    * [MLAS] Add kleidiai pad ptr invalidation test case (#27465)
    * Avoid repetitive creation of fp4/fp8 native-custom-op domains for NvTensorRtRtx EP (#27192)
    * Support TensorScatter (24) - CUDA (#27446)
    * Add optional dependency for quantization utilities (ml_dtypes) (#27435)
    * Fix 3d attention mask broadcasting in MHA (#27464)
    * Fix GatherCopyData Integer Truncation Leading to Heap Out-of-Bounds Read/Write  (#27444)
    * Update python_requires (#27354)
    * Fix SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D (#27459)
    * optimized qmoe code path for 1 token (#27383)
    * [wasm] add flags for WebGPU build to reduce binary size (#27371)
    * WebGPU: Optimize GraphCacheManager by removing pending_buffers (#27453)
    * [MLAS] ukernel interface logging changes (#27439)
    * Fix VersionNumber usage in React Native Android build with major version validation (#27385)
    * Add OrtModel input support for Compile API (#27332)
    * fix: OrtValue.from_dlpack rejects zero-size tensors as non-contiguous (#27451)
    * webgpu: support head_sink in flash attention (#27410)
    * Improve Pre Packing for 2 bit LUT kernels (#27131)
    * fix: out of bounds access for resize operation (#27419)
    * Add validity check on MaxUnpool indicies. (#27432)
    * webgpu: Add configurable multi rotary cache concat offset parameter (#27434)
    * Enable Python 3.14 CI and Upgrade Dependencies (#27401)
    * Fix validation for external data paths for models loaded from bytes (#27430)
    * [CUDA EP] Add resize op version 19 support for CUDA (#27415)
    * [Build] Fix nuget pipelines to pass IsReleaseBuild to validate-package (#27387)
    * MatmulNBits prepacking scales fix (#27412)
    * Normalize Release/Non Release DML packaging pipelines (#27395)
    * Move QNN publishing to release pipeline solely (#27420)
    * Fix build issues in winml_adapter (#27423)
    * Fix DllImportResolver (#27397)
    * TensorScatter-24 (CPU) (#27389)
    * Fix error where bytes is not assigned for dynamic qgemm pack b size (#27421)
    * Fix refcount bug in map input conversion that caused shutdown segfault (#27413)
    * Support nonpad kv seqlen within opset 24 Attention (CPU) (#27384)
    * chore: increase parallelism for win CI (#27376)
    * QMoE CPU Performance Update (Up to 4x on 4-bit) (#27364)
    * [js/web] Use embedded WASM module in Blob URL workers when wasmBinary is provided (#27318)
    * add option to disable generation contrib ops (#27369)
    * [MLAS] Adding DynamicQGemm function pointers and ukernel interface (#27403)
    * Prevent cross-EP Cast fusion in RemoveDuplicateCastTransformer (#27363)
    * [build] Fix building with torch nightly (#27398)
    * [EP API] extract common code for EP API adapter (#26879)
    * Log filesystem path instead of string for C++20 compliance (#26745)
    * allow a build that disable string type (#27348)
    * Fix incorrect pad indices in AveragePool count_include_pad computation (#27375)
    * [MLAS] Avoid default parameters in MLAS function signatures (#27128)
    * [Node.js] Fix float16 tensor input support (#27327)
    * build: Make sympy an optional dependency (#27200)
    * Exclude ONNX docstrings in WebAssembly build (#27370)
    * Fix QMoE CPU Operator (#27360)
    * Fix GatherND division by zero when batch dimensions mismatch (#27090)
    * Enable Robust Symlink Support for External Data (HF Cache Support) (#27374)
    * Add zero point support to dp4a 2-bit dequantization in the WebGPU MatMulNbits (#27325)
    * [CUDA] Support FP8 (E4M3) KV Cache for Group Query Attention (#27321)
    * Bump qs from 6.14.1 to 6.14.2 in /onnxruntime/test/wasm (#27345)
    * Bump tar from 7.5.7 to 7.5.9 in /js/node (#27372)
    * Bump qs from 6.14.1 to 6.14.2 in /js/web (#27344)
    * [MLAS] Removed memcpy step by storing result in C if possible (#27367)
    * [DNNL] Fix DNNL build (#27334)
    * [Build] Fix DML Nuget Pipeline for Release (#27349)
    * [Build] Fix python packaging pipeline (#27350)
    * Fix misaligned addresses while reading tensor attributes from raw data buffers (#27312)
    * Doc fixes (#27228)
    * Remove AzurePowerShell pwsh parameter in tools/ci_build/github/azure-pipelines/templates/publish-symbolrequestprod-api.yml (#27339)
    * Add boundary checks and add tests for SparseTensorProtoToDenseTensorProto (#27323)
    * mlas/arm64: add NEON conv asm kernels and tune NCHWC kernel selection (#27099)
    * Update ORT_API_VERSION (#27280)
    * BaseTester: support plugin EPs with compiled nodes and registered kernels (#27176)
    * Fix NuGet DLL Loading on Linux and macOS (#27266)
    * Fix CUDA minimal build requiring CUDNN_HOME (#27308)
    * [CUDA] Fix build errors (#27319)
    * Fix ConfigEps execution provider ordering in test files (#27014)
    * Update Microsoft.ML.OnnxRuntime.Foundry Package (#27294)
    * Sync optimizer opset versions with CPU kernel registrations (#27270)
    * Check NodeArg has name in ORT formal model load (#27297)
    * Fix WebGPU Conv auto_pad=SAME_UPPER padding calculation (#27249)
    * win arm64 python packages (#27299)
    * Speed up iOS/macOS CocoaPods packaging pipeline (#27279)
    * Improve encapsulation of weight_data_type_freq_ (#27292)
    * [CUDA] GroupQueryAttention with XQA and Quantized KV Cache Support (#27246)
    * [onnxruntime_perf_test] Fix Mac peak working set size value (#27302)
    * Support group query attention in Attention(23) CUDA (#27082)
    * [Build] Fix java macos (#27271)
    * [Build] Adjust nvcc_threads for CI (#27296)
    * [MLAS] Fix Lut GEMM Flakiness and Accuracy (#27216)
    * [Shape Inference] Fix GQA shape inference for present outputs (#27250)
    * [CI] Build NCHWc code on Windows/Linux ARM64 CIs (#27273)
    * Improve WebGPU MatMulNBits to support zero pointer for 2bits (#27285)
    * Add Contributor Compilation Tool for Release Notes (#27284)
    * [BUILD]  Fix Build Errors and Warnings in CUDA Providers (#27276)
    * Fix out-of-bounds read vulnerability in ArrayFeatureExtractor (#27275)
    * Add support for CUDA architecture family codes (#27278)
    * Log Framework name to more Windows ML relevant events (#27256)
    * [WebNN] Support more features for GQA (#27234)
    * [TRT RTX EP] Add support for D3D12 external resource import (#26948)
    * Implement compiled model compatibility APIs in example plugin EP and add tests  (#27088)
    * [Kernel] Fix bug in Einsum implementation when a lone operand had a reduction operation (#27225)
    * Fix WebGPU ConvTranspose bias validation in TypeScript and C++ implementations (#27213)
    * Record service in telemetry events (#27252)
    * [Kernel] Fix einsum operator for empty inputs  (#27226)
    * Add notes for bumping version as part of a release (#27080)
    * Remove test folder from dawn source tree (#27247)
    * [webgpu] Enable profiling for graph capture (#27058)
    * Optimize for VSCode C++ extension file scan (#27245)
    * [webgpu] support auto pad for im2col-matmul (#26771)
    * Bump protobuf from 6.33.0 to 6.33.5 in /tools/ci_build/github/linux/python (#27240)
    * [WebGPU EP] Disable `Split-K` when `use_deterministic_compute` is true (#27086)
    * Update xnnpack.cmake for WASM build (#24860)
    * [OVEP] ORT 1.24 Release Patch (#27238)
    * Bump next from 15.4.10 to 16.1.5 in /js/web/test/e2e/exports/testcases/nextjs-default (#27194)
    * Fix regression in agents for Windows ARM64 (#27235)
    * [webgpu] Optimize string stream used in WebGPU EP (#27223)
    * [CPU/CUDA] Add bias input validations for ConvTranspose (#27209)
    * [CUDA] Run FlashAttention regression test only when FlashAttention is available (#27206)
    * Specify attention-23 kernel and relax assertion in prepare qkv (#27217)
    * Fix for #25145 (#26994)
    * Fix WebGPU MoE swiglu_limit (default to infinity) (#27221)
    * Fix Conv LHS packing padding/uninitialized ptrs V2 (#27215)
    * [QNN EP] Enablement of 64bit Udma mode (#26677)
    * [web] use shorter memory info name for WebGPU buffer and WebNN tensor (#27207)
    * [MLAS] Fix rotary interleaved NEON kernel (#26390)
    * POWER : Fix build failure due to unsupported cpuinfo on ppc64le (#27120)
    * [MLAS] Fix Flaky LuT GEMM Tests by Replacing Gather with Shuffle (#27174)
    * Fix API doc comment for OrtApi::RunOptionsEnableProfiling (#27195)
    * Bump lodash from 4.17.21 to 4.17.23 in /onnxruntime/test/wasm (#27106)
    * Bump lodash from 4.17.21 to 4.17.23 in /js/web (#27105)
    * Fix: Replace pkg_resources with importlib.metadata in machine_info.py (#27157)
    * Add API GetTensorElementTypeAndShapeDataReference (#27175)
    * Bump tar and cmake-js in /js/node (#27193)
    * remove coloredlogs (#27135)
    * [MLAS] Fix Data Race in MlasLutGemm by Serializing LUT Generation (#27179)
    * [WebGPU EP] Reduce duplicated code in `MatMulReadFnSource()` (#27151)
    * Add LpNormalization-22 and update the implementation to respect ONNX spec (#27164)
    * [QNN-EP] Implement file mapped weights feature (#26952)
    * webgpu: optimize Gemm and MatMul using subgroup feature (#26433)
    * Bump lodash from 4.17.21 to 4.17.23 in /js/react_native/e2e (#27134)
    * Deprecate transformers model examples (#27156)
    * Apply absl cuda warning patch to othe OS (#27126)
    * Engine compatibility validity API implementation (#26774)
    * [CPU] Fix arithmetic overflow and legacy TODO in Det operator (#27070)
    * perftest: support plugin eps for compile_ep_context (#27121)
    * Remove x86 from nuget (#27124)
    * [webgpu] Support int64 for range (#26673)
    * [webgpu] fix broadcast for SkipLayerNorm (#27107)
    * [webgpu] Use LazyRelease for prepack allocator (#27077)
    * [QNN EP] Fix error messages being logged as VERBOSE instead of ERROR (#24931)
    * Fix GQA Parity (#27108)
    * Add enable_profiling in runoptions (#26846)
    * [webgpu] Support Identity (#27067)
    * Add absl cuda warnings patch (#27096)
    * Linux device discovery for TRT-RTX Ep (#26210)
    * Fix OrtApi static_assert violation, add instructions for updating additional API structs. (#27100)
    * [test] refactor common test target settings (#27013)
    * Move model compatibility checks ahead of session initialization (#27037)
    * Add dedicated API to support extracting compatibility string from model metadata (#27015)
    * Fix failing mainline build on Arm64 linux (#27101)
    * [webgpu] Optimize generic 4D Transpose using OIHW2OHWI Program (#26942)
    * Bump version to 1.25.0 (#27048)
    * Fix GPU JAR testing on Linux (#27011)
    * [test] move IO binding test to onnxruntime_provider_tests (#27055)
    * Print tensor for new packed type of 2 bits (#27064)
    * Fix Doxygen documentation build error in onnxruntime_c_api.h (#27083)
    * Disable Float32_2Bits_Asymmetric_256x256 test (#27046)
    * [QNN EP] Add FusedMatMul operator support (#27044)
    * [NV TRT RTX EP] Add dimension override for TopK model in TestSessionOutputs unittest (#26975)
    * [webgpu] Fix a bug for im2col (#27069)
    * [EP ABI] Update Graph_GetGraphView() implementation (#26711)
    * Add a new pipeline for CUDA 13 nuget builds (#27023)
    * [Reland] Attention(23) CUDA (#27030)
    * [EP ABI] Add CreateCustomOpDomains() API for plugin EP to register custom ops (#27050)
    * upgrade emsdk to 4.0.23 (#27029)
    * Fix some issues when building with the latest CUDA and cuDNN versions (#27049)
    * Introducing BF16 Pointwise NCHWc Convolution for Arm64 (#26838)
    * Add INT2 and UINT2 support for QDQ, transpose and cast ops (#27022)
    * [QNN EP] Add QuickGELU operator support for QNN provider (#27034)
    * Tweak external resource importer handle structs (#27040)
    * Added support for QMX kernels in MLAS (#26849)
    * [CXX] Enable users to specify custom OrtSyncStream via RunOptions (#26988)
    * Raise the timeout for the ios simulator job (#27045)
    * Implement multithreading in qgemm_kleidi (#26301)
    * [QNN-EP] Support alternate Layernorm fusion pattern in QNN preprocess (#26060)
    * [MLAS/NEON] Add dedicated kernel for depthwise convolution for ARM64 using NEON intrinsics (#26688)
    * [QNN-EP] Add MatMulNBits translation for GPU (#26340)
    * Fix warning around ununsed code in QNN Android Emulator builds by clang (#27026)
    * [OVEP] OpenVINO EP Features and bug-fixes for ORT-1.24 - Follow up (#27007)
    * Add API to get ep graph partitioning info (#26781)
    * [QNN EP] Support quantized BatchNorm with per-channel DQ params on QNN HTP (#26959)
    * Disable matmul 1d tests on DML (#27021)
    * Fix ClipQuantFusion crash when Clip has multiple input edges (#27016)
    * [QNN EP] Add support for handling 0-dimension for Concat Op (#27000)
    * Revert "Attention(23) CUDA" (#27020)
    * [MLAS/CPU EP] Improve performance of Silu activation path within the QuickGelu CPU kernel (#26753)
    * [NV TensorRT RTX EP] Fix external tensorrt_plugins load path (#26814)
    * Implement new experimental lookup-based matrix multiplication method(TMAC) (#26695)
    * [QNN EP] Add BFloat16 dtype support in QNN EP (#26987)
    * Add type definitions, registration, utilities for INT2/UINT2 support (#26824)
    * Add check that tensor sizes match in DataTransferManager::CopyTensors (#27008)
    * Attention(23) CUDA (#26466)

++++ pango:

  - Update to version 1.58.0:
    + PangoFontDescription has a new width attribute, which is like
    stretch, but allows intermediate values
    + PangoRenderer has gained the ability to render only certain
    components of a layout (such overlines, underlines, text,...)

++++ libshumate:

  - Update to version 1.6.2:
    + Avoid spurious drag events following pinch zoom and rotate
    gestures on touch.

++++ logback:

  - Upgrade to upstream version 1.5.36
    * Changes of 1.5.36
    + The 'condition' attribute in <if> elements now reject certain
    references that are associated with ACE attacks
    (bsc#1269222, CVE-2026-13006).
    * Changes of 1.5.35
    + The 'condition' attribute in <if> elements now rejects unicode
    escape sequences (\u and \U). This closes a bypass of the
    existing prohibition on the new operator in Janino-evaluated
    conditions (bsc#1269222, CVE-2026-13006). Please note that the
    version 1.5.36 provides the full fix to this vulnerability.
    + Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest
    configurator rank, for certified/authenticating configurators
    discovered via the ServiceLoader mechanism. ContextInitializer
    now requires that at most one such configurator exist on the
    classpath; if more than one is found, initialization aborts
    with an error.
    + ConsoleCharsetPropertyDefiner is no longer shipped. The Java
    21 multi-release compilation of logback-core has been
    disabled, which removes this class from the published
    artifact. Configurations that referenced
    ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner
    will need an alternative approach for console charset
    detection.
    + The logback-examples module is now included in the set of
    artifacts published to Maven Central.
    + JoranConfigurator.makeAnotherInstance() and
    DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()
    are now protected, allowing derived configurators to override
    these methods.

++++ noctalia-shell:

  - _service and .spec files changes
  - Update to version 4.7.7 (commit f816591afc2f2f606d1f0cf70b51e95c04a7a8aa):
    * chore: updated repo names in workflows
    * chore(flake): update flake.lock
    * chore(flake): update flake.lock
    * fix(ci): stop issue metadata workflow from removing unrelated labels
    * chore(flake): update flake.lock
    * chore(workflow): update label workflow
    * chore(flake): update flake.lock
    * chore(flake): update flake.lock
    * chore(flake): update flake.lock

++++ perl-HTTP-Date:

  - updated to 6.70.0 (6.07)
    see /usr/share/doc/packages/perl-HTTP-Date/Changes
    6.07      2026-06-25 15:12:09Z
  - Add test with Time::Zone (GH#25) (Michal Josef Špaček)
  - Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček)
  - Add tests with negative time (GH#26) (Michal Josef Špaček)
  - Replace all instances of \d with [0-9] in regular expressions to
    reject non-ASCII Unicode digits, with a regression test (GH#27)
    (Robert Rothenberg)
  - Reject malformed ISO 8601 timezones with a doubled colon (GH#31)
    (Olaf Alders)
  - Document day/month/year ordering for numeric dates (GH#32) (Olaf
    Alders)

++++ procs:

  - Update to version 0.14.12:
    * [Added] Add fancy regex fallback for advanced filters.
    * [Added] Add regex filtering support (Fixes #554).
    * [Added] Add shell completion kind values and man page generation.

++++ python-onionshare:

  - version 2.6.4 (bsc#1269693, CVE-2026-54707,
    bsc#1269698, CVE-2026-54706):
    * updated dependencies
    * Security fix: Prevent symlink traversal
    * Security fix: Prevent upload of files when file upload mode is disabled. Prevent creation of empty folder on empty POST request payload
    * Dependencies: Updates tor dependencies and other python and web dependencies. Also updates flatpak runtime.
    * Bug fix: Show indeterminate progress and warn user during Tor traversal

++++ python-Flask-Mail:

  - Update to python-Flask-Mail 0.10.0
    * Drop support for Python < 3.8
    * Use pyproject.toml for packaging metadata.
    * Use flit_core as build backend.
    * Apply code formatting and linting tools.
    * Add static type annotations.
    * Deprecate the __version__ attribute. Use feature detection or
    importlib.metadata.version("flask-mail") instead.
    * Indicate that the deprecated is_bad_headers will be removed in
    the next version.
    * Fix the email_dispatched signal to pass the current app as the
    sender and message as an argument, rather than the other way
    around.
    * Attachment.data may not be None.
    * Attachment.content_type will be detected based on filename and
    data and will not be None.
  - Drop patch that is not needed anymore:
    * python-Flask-Mail-no-mock.patch

++++ python-Flask-Security:

  - Update to 5.8.1:
    [#]# Fixes
    * 1222: Fix for GHSA-w2j7-f3c6-g8cw - Possible open-redirect
    with ALLOW_SUBDOMAIN option.
    * 1215: Fix for GHSA-97r5-pg8x-p63p - possible oauth bypass in
    /verify
  - Update to 5.8.0:
    [#]# Features & Improvements
    * 1170: Add API :py:meth:`.UserMixin.check_tf_required` to allow
    applications to control which users require two-factor
    authentication.
    * 1178: Add Cache-Control headers.
    * 1165: Add support for using Social Login (OAuth) for
    verification.
    * 1188: Add tracking of failed authentication attempts via
    :py:meth:`.UserMixin.track_failed_authn` and signal
    :py:data:`user_failed_authn`
    * 1192: Add API for application to decide if a particular user
    account is locked.
    [#]# Fixes
    * 1179: Fix verify_password for bcrypt 5.0 (mephi42)
    * 1200: Fix username_recovery w.r.t. inactive and non-confirmed
    users
    * 1189: Return additional fields for JSON responses with QR codes
    [#]# Docs and Chores
    * 1150: Update de_DE translations (swaeberle)
    * 1151: Update ca_ES translations (arielvb)
    * 1152: Update es_ES translations (arielvb)
    * 1196: Update arabic translations (samialfattani)
    * 1199: Update it_IT translations (gissimo)
    * 1185: Change external facing terminology from 'Social OAuth' to
    'Social Login'.
  - Update to 5.7.1:
    [#]# Fixes
    * #1147: Regression when updating hash algorithm from bcrypt
    (willcroft)
  - Update to 5.7.0:
    * This release contains a set of small backward incompatible
    changes. Please read these notes carefully.
    [#]# Features & Improvements
    * #1132: Add Arabic translations (samialfattani)
    * #1123: Enable forgot-password workflow for authenticated users.
    [#]# Fixes
    * #1115: Fix broken link in docs and improve docstrings/typing
    for util classes.
    * #1127: Add nonce to script tags if configured to support
    nonce-based Content-Security-Policy (ahanak).
    * #1133: Remove unnecessary (optional) dependency on
    sqlalchemy_utils.
    * #1140: Fix localization of tf_select choices.
    * #1143: Support bcrypt 5.0 - See below for important
    compatibility concerns.  This also replaces passlib with
    libpass for all versions.
    [#]# Docs and Chores
    * #1144: Update ES and IT translations (gissimo)
    * #1106: Drop support for Python 3.9. This removes the dependency
    on importlib_resources, updates pypy to 3.10, and uses 3.12 as
    base python for tests/tox.
    * #1112: Flip :py:data:`SECURITY_USE_REGISTER_V2` default to
    True.
    * #1117: Flip default mail package back to Flask-Mail (from
    Flask-Mailman).
    * #1139: Change external facing terminology from 'WebAuthn
    Credential' to 'passkey'.
    * #1142: Setting of xx_util_cls from kwargs which was deprecated
    in 5.6.1 has been removed. The BACKWARDS_COMPAT_UNAUTHN option
    (code) which has been deprecated since 5.4 has been removed.
    [#]# Backwards Compatibility Concerns
    * Flask-Security now depends on libpass
    (https://pypi.org/project/libpass/) for all versions. Be sure
    to UNINSTALL passlib, ensure the passlib directory is empty and
    then install libpass - we have seen reports when both are
    installed - it doesn't work!
    * In bcrypt 5.0 they started throwing a ValueError for
    passwords/secrets longer than 72 bytes. It is important to know
    that by default Flask-Security performs a double hash - taking
    the secret, using HMAC(SHA512) then b64encodng the result. This
    means that ANY password will be longer than 72 bytes (86 to be
    exact). In the past bcrypt would silently truncate the input -
    now we have to do that explicitly. OWASP says truncation
    concerns are negligible:
    https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#input-limits-of-bcrypt
    * The default RegisterForm is now the new RegisterFormV2 - Please
    read :ref:`register_form_migration`. Flask-Security will emit a
    DeprecationWarning if the :py:data:`SECURITY_USE_REGISTER_V2`
    is set to False.
    * In 5.0 we changed the default mailer package to Flask-Mailman
    since Flask-Mail was no longer supported. Flask-Mail is again
    supported and is part of Pallets-Eco. Both packages are still
    supported based on which one an application initializes. The
    only backwards compatibility concern is that if you use the
    setup extras 'common', it will install Flask-Mail rather than
    Flask-Mailman.
    * In the optional dependencies 'fsqla' we removed
    sqlalchemy_utils - while many applications might want these
    useful add-ons - they aren't required for standard SQLAlchemy
    use.
  - Update to 5.6.2:
    [#]# Fixes
    * #1032 and #1096: Use libpass for python >= 3.12
    * #1086: Fix FR translation test for Change Password (nickcuenca)
    * #1090: Properly document context variables available in email
    templates.
    * #1093: Add confirmation link/token and reset link/token to
    welcome_existing email template.
    [#]# Notes
    * Since Python 3.12 no longer contains setuptools - the old
    passlib failed to import. Rather than require setuptools,
    for Python >=3.12 we now depend on the fork libpass
    (https://pypi.org/project/libpass/) This is a very new package
    and rather than possibly cause backwards compat issues for
    projects not using Python >=3.12 - Flask-Security maintains the
    dependency on passlib for Python <3.12.
    * Note: you can still use passlib for 3.12 and 3.13 - you have to
    manually add setuptools.
  - Rebase ignore-resourcewarning.patch

++++ RBTools:

  - Update to version 6.0:
    * Major rewrite of the command, API client and diff tooling
    since the 1.0 series; requires Python >= 3.10
  - Modernize the packaging:
    * Build with the modern Python singlespec macros
    (%pyproject_wheel/%pyproject_install) and ship for all
    configured Python flavours
    * Manage the rbt command via update-alternatives
    * Obsolete/provide the old non-flavoured RBTools package so
    the renamed flavours supersede it (resolves the /usr/bin/rbt
    and rbtools/api file conflict that blocked the update)
    * Refresh the runtime dependencies for 6.0 (new appdirs,
    certifi, housekeeping, packaging, puremagic, pydiffx,
    typelets, typing_extensions, importlib-metadata and
    importlib-resources requirements; drop the obsolete six and
    setuptools runtime deps)

++++ python-azure-appconfiguration:

  - New upstream release
    + Version 1.9.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-monitorworkspaces:

  - Initial build
    + Version 1.0.0

++++ python-boto3:

  - Update to 1.43.36
    * api-change:``kafka``: Amazon MSK Replicator now supports mTLS authentication when connecting to
    external Apache Kafka clusters, enabling customers to replicate data from clusters that require
    mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK
    Express brokers.
  - from version 1.43.35
    * api-change:``application-signals``: Application Signals now supports dynamic instrumentation and
    Service Events telemetry. Add instrumentation at runtime without restarts, and use fine-grained
    profiling data to quickly pinpoint latency and error root causes.
    * api-change:``bedrock-agentcore``: Adds an optional extractionMode field to CreateEvent. SKIP
    retains the event in short-term memory but excludes it from long-term memory extraction.
    * api-change:``directconnect``: Added VIF rate limiting support for AWS Direct Connect, allowing
    customers to set bandwidth allocations on virtual interfaces to manage traffic on dedicated
    connections.
    * api-change:``ec2``: This release adds support for AMI Watermark and Allowed AMIs integration
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``guardduty``: Added AI-powered investigations that automatically analyze security
    findings, correlate related activity, and produce structured summaries with risk assessment,
    confidence scoring, MITRE technique classification, and actionable next steps.
    * api-change:``kafka``: Amazon MSK Replicator now supports mTLS authentication when connecting to
    external Apache Kafka clusters, enabling customers to replicate data from clusters that require
    mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK
    Express brokers.
    * api-change:``lambda``: Add support for tagging Network Connector resources in AWS Lambda.
    * api-change:``lambda-core``: Initial release of the AWS Lambda Core SDK with APIs to create,
    manage, and tag network connectors that enable Lambda compute resources to access private resources
    in your Amazon VPC.
    * api-change:``lambda-microvms``: Lambda MicroVMs GA launch. Lambda MicroVMs enable isolated and
    highly responsive execution of user-supplied or LLM-generated code.
    * api-change:``logs``: CloudWatch Logs Updates - New APIs introduced to support syslog ingestion to
    a log group. For more information, see CloudWatch Logs API documentation.
    * api-change:``mediaconnect``: AWS MediaConnect now supports Content Quality Analysis for Router
    Inputs, enabling detection of black frames, frozen frames, and silent audio with configurable
    thresholds.
    * api-change:``omics``: Adds support for scratch ephemeral storage mounted at tmp
    * api-change:``quicksight``: Updated the Amazon Quick Spaces API to remove unsupported SPACE and
    ARTIFACT values from the SpaceQuickSightResourceType enum.
  - from version 1.43.34
    * api-change:``appstream``: Amazon WorkSpaces Agent Access now supports domain-joined fleets for
    enterprise identity integration, real-time agent observation with instant stop controls, and MCP
    tool forwarding for lower-latency, cost-effective desktop tool access.
    * api-change:``bedrock-agent``: Add support for metadata-only retrieval on GetFlow, GetFlowVersion,
    and GetPrompt APIs.
    * api-change:``connect``: This is the release for point based scoring system and the evaluation
    form validation project
    * api-change:``glue``: Adds the SearchAssets operation for discovering assets in the AWS Glue Data
    Catalog using full-text search and filters. Minor naming refinements across the Glossary Terms and
    Attachment APIs for consistency.
    * api-change:``opensearch``: This release introduces data source attachment APIs, enabling users to
    attach and detach Amazon OpenSearch Service domains and Amazon OpenSearch Serverless collections to
    an OpenSearch application.
  - from version 1.43.33
    * api-change:``application-autoscaling``: Adds support for ECS high-resolution predefined scaling
    metrics (ECSServiceAverageCPUUtilizationHighResolution,
    ECSServiceAverageMemoryUtilizationHighResolution) enabling 20-second metric periods for faster
    scaling
    * api-change:``batch``: Adds Support for ordered allocation strategies-
    BEST-FIT-PROGRESSIVE-ORDERED or SPOT-CAPACITY-OPTIMIZED-PRIORITIZED
    * api-change:``cognito-idp``: In order to support the new TLS Self-Service feature, this change
    adds SecurityPolicyType to CustomDomainConfigType. During CreateUserPoolDomain and
    UpdateUserPoolDomain this is used to select a custom domain's TLS enforcement, and for
    DescribeUserPoolDomain it informs users about the current TLS.
    * api-change:``compute-optimizer``: This release surfaces two new metrics Volume IOPS Exceeded and
    Volume Throughput Exceeded into EBS volume rightsizing recommendations.
    * api-change:``ec2``: Documentation updates clarifying CancelCapacityReservation cancellable states
    * api-change:``ecs``: Amazon ECS services now support high resolution (20 second) CloudWatch
    metrics for CPUUtilization and MemoryUtilization. Use these metrics for faster service auto scaling.
    * api-change:``eks``: Adds support for configurable control plane egress routing in Amazon EKS,
    allowing you to route control plane egress traffic through your VPC and control how the control
    plane reaches resources in your network such as webhook servers and OIDC providers.
    * api-change:``gamelift``: Amazon GameLift Servers has launched support for customizing Linux
    capabilities in container fleets. You can now specify additional Linux capabilities for containers
    in a container group definition, giving you finer control over the default Docker capabilities
    available to your containers.
    * api-change:``healthlake``: Adding New Configurations to the FHIR Create Datastore. The new
    configurations include NLP Configuration, AnalyticsConfiguration, ProfileConfiguration
    * api-change:``lambda``: Converging and fixing existing documentation gaps in Lambda SDK
    * api-change:``logs``: Added optional startFromHead parameter to FilterLogEvents enabling
    descending timestamp order (newest first) when set to false. Default true preserves existing
    ascending order. Reverse sorting requires a startTime on or after Jan 1, 2024.
    * api-change:``sagemaker``: Adds support for automatic AMI patching on HyperPod clusters. Customers
    can configure patching strategies to automatically apply security patch with zero job termination.
    Customers can also specify an AMI version at instance group level and update cluster software to a
    certain AMI version.
    * api-change:``synthetics``: CloudWatch Synthetics adds support for multi-location canaries.
    Customers can now monitor their endpoints from multiple locations with centralized management from
    a primary location. The SDK includes new parameters for configuring multiple locations and tracking
    their state.
  - from version 1.43.32
    * api-change:``bedrock-agent``: Launching Bedrock Managed Knowledge Bases. Added support for
    resource-based policies on Knowledge Base resources, enabling cross-account access for Managed
    Knowledge Bases.
    * api-change:``bedrock-agentcore``: AgentCore Harness service will be Generally Available at NYS
    2026 with this Treb release. Harness will support invoking specific endpoints via the qualifier
    parameter, AWS Skills for pre-built agent capabilities, and improved validation for skill git
    source URLs.
    * api-change:``bedrock-agentcore-control``: AgentCore Gateway now supports inference targets to LLM
    providers (direct config or built-in connectors), HTTP passthrough targets with session stickiness,
    runtime target API schemas, AWS WAF web ACL association with configurable fail-open or fail-close
    modes, and interceptor payload filtering.
    * api-change:``bedrock-agent-runtime``: Adds new AgenticRetrieveStream API for managed knowledge
    bases to use conversation history and autonomously plan for multi-hop multi-KB reasoning with
    built-in evaluation and access-control. Updates Retrieve API for access-control-based filtering for
    managed knowledge bases.
    * api-change:``compute-optimizer-automation``: This launch adds IfExists comparison operators to
    Compute Optimizer Automation rule criteria, so a rule can include recommended actions whose
    specified attribute isn't present.
    * api-change:``devops-agent``: Adds support for Remote A2A (Agent-to-Agent) agent registration and
    management. Adds new Release Readiness Review and Release Testing capabilities. Adds support for
    Git managed skills in AWS DevOps Agent.
    * api-change:``ecs``: Releasing the ability to bring-your-own task-definition for
    CreateExpressGatewayService and UpdateGatewayExpressService
    * api-change:``glue``: This release adds support for Search and Discovery in AWS Glue, letting you
    and your applications search Data Catalog assets such as table and enrich them with business
    context and glossary terms.
    * api-change:``mq``: This release adds private networking support for Amazon MQ for RabbitMQ. You
    can now associate AWS RAM resource shares with your broker and retrieve shared resource details
    using the new DescribeSharedResources API.
    * api-change:``opensearch``: Adds support for configuring IAM Identity Center options on existing
    OpenSearch applications via the UpdateApplication API.
    * api-change:``partnercentral-selling``: Cosell Resonate AND Prospecing API Launch with ARN
    correction
    * api-change:``securityagent``: Updated AWS Security Agent SDK model with new APIs for threat
    modeling, code review, security requirements, and additional integration providers.
  - from version 1.43.31
    * api-change:``directconnect``: Added VIF rate limiting support for AWS Direct Connect, allowing
    customers to set bandwidth allocations on virtual interfaces to manage traffic on dedicated
    connections.
    * api-change:``outposts``: Adds support for creating an order from quotes.
    * api-change:``partnercentral-selling``: Added Prospecting APIs to convert engagements into
    AI-enriched leads with scoring insights. Extended Engagement APIs with ProspectingResult and Lead
    contexts. Added CoSell Scoring to GetAwsOpportunitySummary- quality score, trend, agent-driven
    recommendations, and engagement classification.
    * api-change:``route53resolver``: Adds supports for PartnerManagedRules
    * api-change:``s3``: Added support for annotations. You can now attach up to 1000 annotations (up
    to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation
    APIs. Also added support for configuring an annotation table in S3 Metadata.
    * api-change:``s3vectors``: Amazon S3 Vectors now supports paginated QueryVectors requests,
    returning up to 10,000 results per query.
    * api-change:``sagemaker``: Add EnableDetailedObservability to Endpoint MetricsConfig. Publishes
    GPU, host, and framework-native inference metrics to CloudWatch with per-inference-component,
    availability-zone, and instance dimensions. Adds Inference Component provisioning lifecycle and
    multi-AZ placement metrics.
  - from version 1.43.30
    * api-change:``bedrock-runtime``: InvokeGuardrailChecks API evaluates prompts and responses against
    safety checks (content filters, prompt attacks, sensitive info) without creating guardrail
    resources. It's a detect-only API, returning numeric scores so you can build adaptive logic as per
    your application.
    * api-change:``datazone``: Adds support for deleting lineage events in Amazon DataZone.
    * api-change:``logs``: Added endTimeOffset parameter to Scheduled Queries APIs (Create, Update,
    Get) enabling bounded time window configuration. Introduced scheduleType filter (CUSTOMER MANAGED,
    AWS MANAGED) for ListScheduledQueries and exposed it in Get and Update responses.
    * api-change:``mgn``: AWS Transform for VMware now supports Amazon FSx for NetApp ONTAP as a target
    storage. Customers can migrate source server disks directly to FSx for NetApp ONTAP iSCSI LUNs.
    Target storage is configurable per source server, and compute, network, and storage migrate
    together in coordinated waves.
    * api-change:``rds``: Adding support for RDS SQL Server BYOM and DB2 Community Edition
    * api-change:``wafv2``: AWS WAF now supports AI traffic monetization for CloudFront. Configure
    payment networks and pricing on your web ACL, use the new Monetize rule action to charge AI agents
    via x402, and monitor revenue with new GetRevenueStatisticsSummary, GetRevenueStatistics, and
    ListSettlementRecords APIs.
    * api-change:``workspaces``: Added a validation for null check for ImageIds in
    DescribeWorkspaceImages API request parameters.
  - from version 1.43.29
    * api-change:``acm``: Certificate transparency logging opt-out is no longer available. Per
    compliance requirements, all public ACM certificates are automatically recorded in certificate
    transparency logs. The CertificateTransparencyLoggingPreference option is deprecated.
    * api-change:``bedrock-agentcore``: Added tagging and CMK support across optimization, an
    explanation field in recommendation output, and an insights feature to identify failure patterns,
    extract user intents, and summarize execution behavior
    * api-change:``bedrock-agentcore-control``: Added tagging and CMK support for optimizations and an
    insights feature to identify failure patterns, extract user intents, and summarize execution
    behavior
    * api-change:``devops-agent``: Adds support for Trigger CRUD APIs (CreateTrigger, GetTrigger,
    UpdateTrigger, DeleteTrigger, ListTriggers) for managing schedule-based automation triggers in
    DevOps Agent agent spaces.
    * api-change:``eks``: Patches missing enum values for EKS updates
    * api-change:``firehose``: Update KeyARN in DeliveryStreamEncryptionConfigurationInput to accept
    KMS key ARNs only (not alias ARNs), matching service behavior.
    * api-change:``glue``: Adds support for retrieving Apache Iceberg table metadata via GetTable. Use
    the new AttributesToGet parameter with LATEST ICEBERG METADATA to receive schema, partition specs,
    sort orders, and table properties in the response.
    * api-change:``iam``: Updating documentation for select service-specific credential APIs
    * api-change:``sagemaker-runtime``: Added support for inline request payloads to the
    InvokeEndpointAsync operation to allow users to provide the inference payload directly in the
    request Body (up to 128,000 bytes) as an alternative to uploading the payload to Amazon S3 and
    passing InputLocation.
  - from version 1.43.28
    * api-change:``bedrock-agentcore``: Adds support to perform cross account data plane actions on an
    AgentCore Memory resource
    * api-change:``bedrock-agentcore-control``: Supports deterministic metadata for AgentCore Memory
    * api-change:``eks``: Introduce new CreateCluster parameters for Amazon EKS local clusters on AWS
    Outposts. Added etcdInstanceType for configuring the EC2 instance type for dedicated etcd
    instances, and spreadLevel for configuring the placement group spread level for Kubernetes control
    plane and etcd instances.
    * api-change:``healthlake``: Adds the UpdateFHIRDatastore API and adds analytics, NLP, and profile
    configuration support to CreateFHIRDatastore and DescribeFHIRDatastore.
    * api-change:``neptune``: Amazon Neptune now supports IPv6 dual-stack networking. You can create
    and manage Neptune DB clusters accessible over both IPv4 and IPv6 by specifying NetworkType as DUAL
    in CreateDBCluster, ModifyDBCluster, RestoreDBClusterFromSnapshot, and
    RestoreDBClusterToPointInTime API operations
    * api-change:``omics``: Adds support for workflowName in the ListRuns API response.
    * api-change:``support``: Adding new BDD representation of endpoint ruleset
  - from version 1.43.27
    * api-change:``amp``: Adds supports for out-of-order sample ingestion (default 1-minute window) and
    a configurable rule query offset to reduce data loss and improve alerting accuracy.
    * api-change:``connecthealth``: Add support for MedicalScribeBinaryAudioEvent in the Medical Scribe
    streaming input. This new event type lets you send audio as a raw binary payload instead of a
    base64-encoded value
    * api-change:``ec2``: This release adds support for AMI Watermark which a structured identifier
    that helps in tracking AMI provenance
    * api-change:``ecs``: Amazon ECS Managed Daemon task definitions now support pidMode and ipcMode
    parameters. Set shared to allow daemons to share PID or IPC namespaces with co-located tasks on
    Managed Instances, enabling process tracing and shared memory communication.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``lightsail``: This release adds support for Asia Pacific (Hong Kong) (ap-east-1),
    Europe (Spain) (eu-south-2) and South America (Sao Paulo) (sa-east-1) Regions.
    * api-change:``medialive``: Adding premixer settings to pid and track audio inputs in MediaLIve to
    allow greater control over mixing audio from multiple source streams including support for
    AudioPidSelectors made up of multiple audio PIDs.
    * api-change:``sagemaker``: Add support for G6e instances (ml.g6e.xlarge through ml.g6e.48xlarge)
    on Amazon SageMaker Notebook Instances.
    * api-change:``signin``: AWS Sign-In now allows customers to control access to the AWS Management
    Console using resource-based policies. With this release customers can restrict console access
    based on network perimeters such as VPC IDs, VPC endpoints, and IP addresses.
  - from version 1.43.26
    * api-change:``bedrock``: Adds support for the Amazon Bedrock account-level data retention APIs
    PutAccountDataRetention and GetAccountDataRetention.
    * api-change:``bedrock-agentcore``: Add RetryableConflictException (HTTP 409) to
    InvokeAgentRuntimeCommand and GetAgentCard to prevent orphaned VMs during concurrent session
    access. The SDK automatically retries this exception with backoff. Enforcement is not yet active
    and will be enabled in a future service update.
    * api-change:``cloudwatch``: This release adds the APIs (AssociateDatasetKmsKey,
    DisassociateDatasetKmsKey, GetDataset) to manage encryption at rest for OpenTelemetry metrics in
    CloudWatch using AWS KMS customer managed keys.
    * api-change:``ec2``: Added TagFieldSpecifications to CreateFlowLogs and DescribeFlowLogs APIs.
    Customers can now specify tag keys in their Flow Logs subscriptions to capture associated EC2
    resource tag values in their logs, enabling tag-based visibility.
    * api-change:``odb``: Releases Autonomous Database Serverless APIs,
    autonomousDatabaseOciIntegrationIamRoles, linkedOciTenancyId, linkedOciCompartmentId, and
    subscriptionErrors fields in GetOciOnboardingStatus API response.
    * api-change:``outposts``: Added AWS Outposts APIs for self-service Outposts quoting and ordering.
    New operations include CreateQuote, GetQuote, UpdateQuote, DeleteQuote, ListQuotes, and
    ListOrderableInstanceTypes.
  - from version 1.43.25
    * api-change:``compute-optimizer``: Adds new Idle Recommendation Resource types in the AWS Compute
    Optimizer API
    * api-change:``cost-optimization-hub``: Adds new Idle Recommendation types in the Cost Optimization
    Hub API
    * api-change:``deadline``: Added optional identityCenterRegion parameter to AssociateMember APIs to
    allow managing memberships for users and groups in other regions.
    * api-change:``devops-agent``: Add Asset APIs for managing versioned assets and asset files in AWS
    DevOps Agent agent spaces.
    * api-change:``mediapackagev2``: Adds support for DASH Audio Timeline Patternization. This enables
    your DASH manifests to templatize the repeating patterns that emerge in audio segment timelines.
    This compacts the total timeline length, utilizing the repeat notation, such that manifests don't
    grow indefinitely long.
    * api-change:``mgn``: AWS Transform discovery tool now supported as network migration input source.
    You can now use the AWS Transform Discovery tool as a source for network migration alongside
    modelizeIT, enabling hybrid network migrations for environments running both VMware and non-VMware
    workloads.
    * api-change:``observabilityadmin``: CloudWatch Observability Admin extends
    CentralizationRuleForOrganization APIs to support metrics, enabling centralization of metrics
    across accounts and Regions alongside logs.
    * api-change:``omics``: StartRunBatch API - Add EngineSettings
    * api-change:``taxsettings``: Adds support for additional tax information fields for Philippines,
    Belgium, Chile, France, Poland, and Italy in the Tax Settings API.
  - from version 1.43.24
    * api-change:``emr-serverless``: Adds support for updating max capacity and custom fields while
    application is started
    * api-change:``mediaconvert``: Adds support for configurable number of Clear Lead segments at the
    beginning of encrypted output. Adds support for multiple trickplay variants.
    * api-change:``payment-cryptography``: Adds CloudFormation support for resource-based policies on
    AWS Payment Cryptography keys.
    * api-change:``quicksight``: Adds support for Knowledge Base APIs and Index Capacity API
    * api-change:``sagemaker``: This release adds support for MLflow experiment tracking in SageMaker
    inference optimization. CreateAIRecommendationJob and CreateAIBenchmarkJob now accept an optional
    OutputConfig.MlflowConfig (MLflow App ARN, experiment, run name) to stream benchmark metrics and
    artifacts to your own MLflow App.
  - from version 1.43.23
    * api-change:``appflow``: Adding new BDD representation of endpoint ruleset
    * api-change:``appintegrations``: Adding new BDD representation of endpoint ruleset
    * api-change:``auditmanager``: Adding new BDD representation of endpoint ruleset
    * api-change:``chime-sdk-voice``: Adding new BDD representation of endpoint ruleset
    * api-change:``cloudformation``: Adding new BDD representation of endpoint ruleset
    * api-change:``config``: AWS Config now supports internal service-linked rules, allowing AWS
    service partners to deploy Config rules for customers and use the evaluation results to build
    enhanced features.
    * api-change:``connectparticipant``: Adding new BDD representation of endpoint ruleset
    * api-change:``efs``: Adding new BDD representation of endpoint ruleset
    * api-change:``emr``: Added support for Spark Connect interactive sessions on Amazon EMR on EC2
    with new APIs - StartSession, GetSession, GetSessionEndpoint, ListSessions, and TerminateSession.
    Added sessionEnabled field in RunJobFlow and DescribeCluster to enable Spark Connect endpoints on
    EMR clusters.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``glue``: AWS Glue Interactive Sessions now supports Apache Spark Connect, enabling
    remote Spark execution over gRPC with minimal client-side dependencies. Adds GetSessionEndpoint and
    GetDashboardUrl APIs. Modifies CreateSession now accepts SPARK CONNECT session type.
    * api-change:``guardduty``: Remove unsupported RDS field for filter
    * api-change:``ivs``: adds UpdateAdConfiguration operation to AWS IVS low-latency APIs
    * api-change:``kendra``: Adding new BDD representation of endpoint ruleset
    * api-change:``sagemaker``: Adds the IncludedData parameter to DescribeModelCard and
    DescribeModelPackage. Set it to MetadataOnly to retrieve a model card without decrypt permission on
    the customer managed AWS KMS key (default AllData returns full content). Adds support for the MTRL
    Job resource in SageMaker Search.
    * api-change:``sns``: Adding new BDD representation of endpoint ruleset
    * api-change:``wickr``: AWS Wickr now allows network administrators to configure a maximum session
    duration for non-SSO users in security groups, and display customizable consent popups to users at
    login for terms of use or compliance acknowledgements.
    * api-change:``workdocs``: Adding new BDD representation of endpoint ruleset
    * api-change:``workspaces``: Adding new BDD representation of endpoint ruleset
  - from version 1.43.22
    * api-change:``arc-region-switch``: ARC Region Switch now supports three new execution blocks for
    multi-Region database workloads-Amazon Aurora Serverless scaling, Amazon Aurora Provisioned
    scaling, and Amazon Neptune Global Database failover.
    * api-change:``ce``: Added support for target-coverage-based Savings Plans purchase analysis. The
    StartCommitmentPurchaseAnalysis API now accepts a new TARGET AVERAGE COVERAGE value for
    AnalysisType, as well as an optional SavingsPlansTargetCoverage field in
    SavingsPlansPurchaseAnalysisConfiguration
    * api-change:``compute-optimizer``: This release lets customers extend the lookback period for
    Amazon EBS volume and Amazon ECS rightsizing recommendations to 32 days.
    * api-change:``connect``: SearchContacts Connect API now supports filtering contacts by the AI
    Agents involved in handling them
    * api-change:``inspector2``: Inspector support for enhanced scanning
    * api-change:``socialmessaging``: Adding support for WhatsApp flow APIs and adding
    AccessDeniedByMetaException for Template APIs
  - from version 1.43.21
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``geo-routes``: Add "standardRegionalEndpoints" back to fix 'Could not connect to the
    endpoint URL'
  - from version 1.43.20
    * api-change:``ec2``: Amazon EC2 now supports self-service cancellation of future-dated Capacity
    Reservations. A cancellation charge applies based on remaining commitment. Customers can generate a
    cancellation quote to review charges before confirming.
    * api-change:``elasticache``: Amazon ElastiCache for Valkey now supports durability. This new
    capability is enabled through a Multi-AZ transactional log, enabling fast recovery and restart
    during failures.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``geo-routes``: Added Transit and Intermodal travel modes to CalculateRoutes. Plan
    routes using public transit (bus, subway, train, ferry) or combine transit with driving, taxi, and
    rental car segments in a single multi-modal route.
    * api-change:``guardduty``: Amazon GuardDuty Runtime Monitoring now supports 3 new
    SensitiveFileModified finding types (Persistence, PrivilegeEscalation, DefenseEvasion) that detect
    when security-sensitive system files are modified on EC2 instances or containers, indicating
    potential compromise through file tampering.
    * api-change:``iot``: Fleet indexing documentation update
    * api-change:``keyspacesstreams``: Added iterator description to the GetRecords API response for
    Amazon Keyspaces Change Data Capture (CDC) streams, enabling consumers to track their current
    position within the stream.
    * api-change:``lambda``: Adds configuration for tag propagation to Lambda-managed resources.
    * api-change:``sagemaker``: Amazon SageMaker Job is a new service to help you manage various
    workloads related to model fine tuning, evaluation etc. Two job categories are supported today,
    AgentRFT for multi-turn agentic reinforcement fine tuning, and AgentRFTEvaluation for evaluating
    base model or trained model from AgentRFT.
    * api-change:``sagemakerjobruntime``: Amazon SageMaker Job Runtime is a new service for managing
    trajectory data during multi-turn customization jobs. It provides APIs to send inference requests
    to models during job execution, mark rollouts as complete, and submit reward values for training
    trajectories.
    * api-change:``transcribe``: Release new Language locales including am-ET, es-MX, fa-AF, ht-HT,
    jv-ID, km-KH, my-MM, sq-AL, ne-NP. The commit shows past locales that have already been release
    which include cy-gb, ga-ie, gd-gb.
  - from version 1.43.19
    * api-change:``cognito-idp``: Add support for multi-region replication, enabling synchronization of
    user data and configurations to a secondary user pool in a standby Region. Add support for customer
    managed keys (CMK) in AWS KMS for encrypting user pool data at rest.
    * api-change:``marketplace-agreement``: Adding Entitlements in SearchAgreements Response
    * api-change:``quicksight``: This release adds public APIs for Amazon QuickSight Spaces, Agents,
    and Flows. Spaces APIs enable management of curated resource collections. Agents APIs provide
    lifecycle control over AI-powered agents that leverage Spaces. Flows APIs add CRUDL APIs for
    automated workflows.
  - from version 1.43.18
    * api-change:``bedrock``: Automated Reasoning checks - Added two build workflows for policies.
    Iterative Refine Policy uses AI to update policy definitions based on test results and feedback.
    Resolve Policy Ambiguities consolidates ambiguous variables in Automated Reasoning policies, a
    common source of ambiguous validation.
    * api-change:``bedrock-agentcore-control``: Reference your own AWS Secrets Manager secrets when
    configuring credential providers, giving you control over encryption, rotation, and access policies
    instead of using service-managed secrets.
    * api-change:``groundstation``: Adds support for Alpha-5 satellite number encoding in the Two-Line
    Element ephemeris format.
    * api-change:``omics``: Add engineSettings to StartRun and GetRun. Add profiles and
    profileParameterTemplates to GetWorkflow and GetWorkflowVersion.
    * api-change:``quicksight``: Adds support for creating, updating, describing, listing, and deleting
    an OAuthClientApplication resource, a new quicksight resource that allows customers to store OAuth
    configurations to connect to their databases via 3 Legged OAuth.
    * api-change:``rds-data``: RDS Data API arrays (longValues, doubleValues, stringValues,
    booleanValues) in ExecuteStatement responses now correctly support null elements. Runtime change
    for JS v3 and .NET. Compile-time change for C plus plus, .NET, Kotlin, Rust. No impact for Java,
    Python, Ruby, PHP, Go.
    * api-change:``route53resolver``: Added BatchCreateFirewallRule, BatchUpdateFirewallRule,
    BatchDeleteFirewallRule, and ListFirewallRuleTypes APIs. Added FirewallRuleType support to Firewall
    Rule APIs.
    * api-change:``sesv2``: This release introduces support for Tenant Suppression Lists
  - from version 1.43.17
    * api-change:``appstream``: Amazon WorkSpaces Applications now supports BYOL (Bring Your Own
    License). This enables customers to import their own WorkSpaces images and use them in WorkSpaces
    Applications.
    * api-change:``bedrock``: Add support for ModelPackageArn in Bedrock's CreateCustomModel API
    * api-change:``bedrock-agentcore``: Added Harness support for LiteLLM model configuration for
    third-party model providers. Added S3 and Git skill source types. Added Responses API format for
    OpenAI and Bedrock models. Added runtimeUserId and runtimeClientError to InvokeHarness.
    * api-change:``bedrock-agentcore-control``: Added Harness support for LiteLLM model configuration
    for third-party model providers. Added S3 and Git skill source types. Added Responses API format
    for OpenAI and Bedrock models. Added runtimeUserId parameter to InvokeHarness for end-user
    identification.
    * api-change:``bedrock-runtime``: Support system role in message
    * api-change:``controlcatalog``: AWS Control Catalog - Added GovernedProviders response field and
    inclusion filter to GetControl and ListControls APIs to identify and filter by cloud provider.
    Added ParameterRequirementSummary response field indicating parameter requirements.
    * api-change:``customer-profiles``: BatchPutProfileObject API adds multiple profile objects to a
    domain of a given ObjectType in a single API call.
    * api-change:``deadline``: Added support for persistent storage on Service-Managed Fleets, allowing
    customers to configure persistent storage that preserves data across worker sessions which reduces
    job startup times for workloads with large software installations or asset caches.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``iot``: Adds new connectivity-related fields to Fleet Indexing API requests and
    responses.
    * api-change:``iot-data``: Adding GetConnection, ListSubscriptions, and SendDirectMessage APIs to
    IoT Data Plane
    * api-change:``opensearchserverless``: Adds support for deletion protection on collections, ability
    to create NEXTGEN collection groups and autoscaling visibility for NEXTGEN collection groups
    * api-change:``pcs``: This release adds support for configuring scaleDownIdleTimeInSeconds at the
    compute node group level, allowing customers to set different idle timeouts per node group.
    Previously this setting was only available at the cluster level.
    * api-change:``resiliencehubv2``: This is the initial SDK release for the next generation of
    Resilience Hub.
    * api-change:``s3control``: Update the minimum value of MinStorageBytesPercentage in
    StorageLensPrefixLevel.SelectionCriteria from 0.1 to 1, aligning the model with the documented
    contract.
  - from version 1.43.16
    * api-change:``bedrock-data-automation``: Matcher Fallback extends the CustomOutputConfiguration
    for the Document modality in DataAutomationProjects, enabling a fallback blueprint when no match is
    found. A FALLBACK match status is returned, improving the matching experience and guaranteeing
    customers always receive CustomOutputResults.
    * api-change:``ecs``: Add support for Neuron device resource requirements for Amazon ECS
    * api-change:``elementalinference``: Added support for smart subtitles in Elemental Inference,
    enabling automatic generation of subtitles for media content. Available in English, Spanish,
    French, German, Italian, and Portuguese.
    * api-change:``medialive``: AWS Elemental MediaLive now supports Smart Subtitles, a new caption
    source that uses AWS Elemental Inference to automatically generate WebVTT and TTML captions from
    source audio. Available in English, Spanish, French, German, Italian, and Portuguese.
    * api-change:``opensearch``: OpenSearch will now support multi-segment paths in JWKS URLs.
    * api-change:``organizations``: AWS Organizations now emits CloudTrail events
    (AccountJoinedOrganization, AccountDepartedOrganization) to the management account for membership
    changes, including join and departure method and timestamp.
    * api-change:``sagemaker``: Adds shared environment support for Restricted Instance Groups (RIGs)
    on SageMaker HyperPod, enabling cross-RIG workload scheduling and FSx sharing. This unlocks shared
    CPU-GPU environments needed for cost-efficient RL training (e.g., Nova Forge). Adds p6 instance
    support for recommendation jobs
  - Update BuildRequires and Requires from setup.py

++++ python-botocore:

  - Update to 1.43.36
    * api-change:``kafka``: Amazon MSK Replicator now supports mTLS authentication when connecting to
    external Apache Kafka clusters, enabling customers to replicate data from clusters that require
    mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK
    Express brokers.
  - from version 1.43.35
    * api-change:``application-signals``: Application Signals now supports dynamic instrumentation and
    Service Events telemetry. Add instrumentation at runtime without restarts, and use fine-grained
    profiling data to quickly pinpoint latency and error root causes.
    * api-change:``bedrock-agentcore``: Adds an optional extractionMode field to CreateEvent. SKIP
    retains the event in short-term memory but excludes it from long-term memory extraction.
    * api-change:``directconnect``: Added VIF rate limiting support for AWS Direct Connect, allowing
    customers to set bandwidth allocations on virtual interfaces to manage traffic on dedicated
    connections.
    * api-change:``ec2``: This release adds support for AMI Watermark and Allowed AMIs integration
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``guardduty``: Added AI-powered investigations that automatically analyze security
    findings, correlate related activity, and produce structured summaries with risk assessment,
    confidence scoring, MITRE technique classification, and actionable next steps.
    * api-change:``kafka``: Amazon MSK Replicator now supports mTLS authentication when connecting to
    external Apache Kafka clusters, enabling customers to replicate data from clusters that require
    mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK
    Express brokers.
    * api-change:``lambda``: Add support for tagging Network Connector resources in AWS Lambda.
    * api-change:``lambda-core``: Initial release of the AWS Lambda Core SDK with APIs to create,
    manage, and tag network connectors that enable Lambda compute resources to access private resources
    in your Amazon VPC.
    * api-change:``lambda-microvms``: Lambda MicroVMs GA launch. Lambda MicroVMs enable isolated and
    highly responsive execution of user-supplied or LLM-generated code.
    * api-change:``logs``: CloudWatch Logs Updates - New APIs introduced to support syslog ingestion to
    a log group. For more information, see CloudWatch Logs API documentation.
    * api-change:``mediaconnect``: AWS MediaConnect now supports Content Quality Analysis for Router
    Inputs, enabling detection of black frames, frozen frames, and silent audio with configurable
    thresholds.
    * api-change:``omics``: Adds support for scratch ephemeral storage mounted at tmp
    * api-change:``quicksight``: Updated the Amazon Quick Spaces API to remove unsupported SPACE and
    ARTIFACT values from the SpaceQuickSightResourceType enum.
  - from version 1.43.34
    * api-change:``appstream``: Amazon WorkSpaces Agent Access now supports domain-joined fleets for
    enterprise identity integration, real-time agent observation with instant stop controls, and MCP
    tool forwarding for lower-latency, cost-effective desktop tool access.
    * api-change:``bedrock-agent``: Add support for metadata-only retrieval on GetFlow, GetFlowVersion,
    and GetPrompt APIs.
    * api-change:``connect``: This is the release for point based scoring system and the evaluation
    form validation project
    * api-change:``glue``: Adds the SearchAssets operation for discovering assets in the AWS Glue Data
    Catalog using full-text search and filters. Minor naming refinements across the Glossary Terms and
    Attachment APIs for consistency.
    * api-change:``opensearch``: This release introduces data source attachment APIs, enabling users to
    attach and detach Amazon OpenSearch Service domains and Amazon OpenSearch Serverless collections to
    an OpenSearch application.
  - from version 1.43.33
    * api-change:``application-autoscaling``: Adds support for ECS high-resolution predefined scaling
    metrics (ECSServiceAverageCPUUtilizationHighResolution,
    ECSServiceAverageMemoryUtilizationHighResolution) enabling 20-second metric periods for faster
    scaling
    * api-change:``batch``: Adds Support for ordered allocation strategies-
    BEST-FIT-PROGRESSIVE-ORDERED or SPOT-CAPACITY-OPTIMIZED-PRIORITIZED
    * api-change:``cognito-idp``: In order to support the new TLS Self-Service feature, this change
    adds SecurityPolicyType to CustomDomainConfigType. During CreateUserPoolDomain and
    UpdateUserPoolDomain this is used to select a custom domain's TLS enforcement, and for
    DescribeUserPoolDomain it informs users about the current TLS.
    * api-change:``compute-optimizer``: This release surfaces two new metrics Volume IOPS Exceeded and
    Volume Throughput Exceeded into EBS volume rightsizing recommendations.
    * api-change:``ec2``: Documentation updates clarifying CancelCapacityReservation cancellable states
    * api-change:``ecs``: Amazon ECS services now support high resolution (20 second) CloudWatch
    metrics for CPUUtilization and MemoryUtilization. Use these metrics for faster service auto scaling.
    * api-change:``eks``: Adds support for configurable control plane egress routing in Amazon EKS,
    allowing you to route control plane egress traffic through your VPC and control how the control
    plane reaches resources in your network such as webhook servers and OIDC providers.
    * api-change:``gamelift``: Amazon GameLift Servers has launched support for customizing Linux
    capabilities in container fleets. You can now specify additional Linux capabilities for containers
    in a container group definition, giving you finer control over the default Docker capabilities
    available to your containers.
    * api-change:``healthlake``: Adding New Configurations to the FHIR Create Datastore. The new
    configurations include NLP Configuration, AnalyticsConfiguration, ProfileConfiguration
    * api-change:``lambda``: Converging and fixing existing documentation gaps in Lambda SDK
    * api-change:``logs``: Added optional startFromHead parameter to FilterLogEvents enabling
    descending timestamp order (newest first) when set to false. Default true preserves existing
    ascending order. Reverse sorting requires a startTime on or after Jan 1, 2024.
    * api-change:``sagemaker``: Adds support for automatic AMI patching on HyperPod clusters. Customers
    can configure patching strategies to automatically apply security patch with zero job termination.
    Customers can also specify an AMI version at instance group level and update cluster software to a
    certain AMI version.
    * api-change:``synthetics``: CloudWatch Synthetics adds support for multi-location canaries.
    Customers can now monitor their endpoints from multiple locations with centralized management from
    a primary location. The SDK includes new parameters for configuring multiple locations and tracking
    their state.
  - from version 1.43.32
    * api-change:``bedrock-agent``: Launching Bedrock Managed Knowledge Bases. Added support for
    resource-based policies on Knowledge Base resources, enabling cross-account access for Managed
    Knowledge Bases.
    * api-change:``bedrock-agentcore``: AgentCore Harness service will be Generally Available at NYS
    2026 with this Treb release. Harness will support invoking specific endpoints via the qualifier
    parameter, AWS Skills for pre-built agent capabilities, and improved validation for skill git
    source URLs.
    * api-change:``bedrock-agentcore-control``: AgentCore Gateway now supports inference targets to LLM
    providers (direct config or built-in connectors), HTTP passthrough targets with session stickiness,
    runtime target API schemas, AWS WAF web ACL association with configurable fail-open or fail-close
    modes, and interceptor payload filtering.
    * api-change:``bedrock-agent-runtime``: Adds new AgenticRetrieveStream API for managed knowledge
    bases to use conversation history and autonomously plan for multi-hop multi-KB reasoning with
    built-in evaluation and access-control. Updates Retrieve API for access-control-based filtering for
    managed knowledge bases.
    * api-change:``compute-optimizer-automation``: This launch adds IfExists comparison operators to
    Compute Optimizer Automation rule criteria, so a rule can include recommended actions whose
    specified attribute isn't present.
    * api-change:``devops-agent``: Adds support for Remote A2A (Agent-to-Agent) agent registration and
    management. Adds new Release Readiness Review and Release Testing capabilities. Adds support for
    Git managed skills in AWS DevOps Agent.
    * api-change:``ecs``: Releasing the ability to bring-your-own task-definition for
    CreateExpressGatewayService and UpdateGatewayExpressService
    * api-change:``glue``: This release adds support for Search and Discovery in AWS Glue, letting you
    and your applications search Data Catalog assets such as table and enrich them with business
    context and glossary terms.
    * api-change:``mq``: This release adds private networking support for Amazon MQ for RabbitMQ. You
    can now associate AWS RAM resource shares with your broker and retrieve shared resource details
    using the new DescribeSharedResources API.
    * api-change:``opensearch``: Adds support for configuring IAM Identity Center options on existing
    OpenSearch applications via the UpdateApplication API.
    * api-change:``partnercentral-selling``: Cosell Resonate AND Prospecing API Launch with ARN
    correction
    * api-change:``securityagent``: Updated AWS Security Agent SDK model with new APIs for threat
    modeling, code review, security requirements, and additional integration providers.
  - from version 1.43.31
    * api-change:``directconnect``: Added VIF rate limiting support for AWS Direct Connect, allowing
    customers to set bandwidth allocations on virtual interfaces to manage traffic on dedicated
    connections.
    * api-change:``outposts``: Adds support for creating an order from quotes.
    * api-change:``partnercentral-selling``: Added Prospecting APIs to convert engagements into
    AI-enriched leads with scoring insights. Extended Engagement APIs with ProspectingResult and Lead
    contexts. Added CoSell Scoring to GetAwsOpportunitySummary- quality score, trend, agent-driven
    recommendations, and engagement classification.
    * api-change:``route53resolver``: Adds supports for PartnerManagedRules
    * api-change:``s3``: Added support for annotations. You can now attach up to 1000 annotations (up
    to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation
    APIs. Also added support for configuring an annotation table in S3 Metadata.
    * api-change:``s3vectors``: Amazon S3 Vectors now supports paginated QueryVectors requests,
    returning up to 10,000 results per query.
    * api-change:``sagemaker``: Add EnableDetailedObservability to Endpoint MetricsConfig. Publishes
    GPU, host, and framework-native inference metrics to CloudWatch with per-inference-component,
    availability-zone, and instance dimensions. Adds Inference Component provisioning lifecycle and
    multi-AZ placement metrics.
  - from version 1.43.30
    * api-change:``bedrock-runtime``: InvokeGuardrailChecks API evaluates prompts and responses against
    safety checks (content filters, prompt attacks, sensitive info) without creating guardrail
    resources. It's a detect-only API, returning numeric scores so you can build adaptive logic as per
    your application.
    * api-change:``datazone``: Adds support for deleting lineage events in Amazon DataZone.
    * api-change:``logs``: Added endTimeOffset parameter to Scheduled Queries APIs (Create, Update,
    Get) enabling bounded time window configuration. Introduced scheduleType filter (CUSTOMER MANAGED,
    AWS MANAGED) for ListScheduledQueries and exposed it in Get and Update responses.
    * api-change:``mgn``: AWS Transform for VMware now supports Amazon FSx for NetApp ONTAP as a target
    storage. Customers can migrate source server disks directly to FSx for NetApp ONTAP iSCSI LUNs.
    Target storage is configurable per source server, and compute, network, and storage migrate
    together in coordinated waves.
    * api-change:``rds``: Adding support for RDS SQL Server BYOM and DB2 Community Edition
    * api-change:``wafv2``: AWS WAF now supports AI traffic monetization for CloudFront. Configure
    payment networks and pricing on your web ACL, use the new Monetize rule action to charge AI agents
    via x402, and monitor revenue with new GetRevenueStatisticsSummary, GetRevenueStatistics, and
    ListSettlementRecords APIs.
    * api-change:``workspaces``: Added a validation for null check for ImageIds in
    DescribeWorkspaceImages API request parameters.
  - from version 1.43.29
    * api-change:``acm``: Certificate transparency logging opt-out is no longer available. Per
    compliance requirements, all public ACM certificates are automatically recorded in certificate
    transparency logs. The CertificateTransparencyLoggingPreference option is deprecated.
    * api-change:``bedrock-agentcore``: Added tagging and CMK support across optimization, an
    explanation field in recommendation output, and an insights feature to identify failure patterns,
    extract user intents, and summarize execution behavior
    * api-change:``bedrock-agentcore-control``: Added tagging and CMK support for optimizations and an
    insights feature to identify failure patterns, extract user intents, and summarize execution
    behavior
    * api-change:``devops-agent``: Adds support for Trigger CRUD APIs (CreateTrigger, GetTrigger,
    UpdateTrigger, DeleteTrigger, ListTriggers) for managing schedule-based automation triggers in
    DevOps Agent agent spaces.
    * api-change:``eks``: Patches missing enum values for EKS updates
    * api-change:``firehose``: Update KeyARN in DeliveryStreamEncryptionConfigurationInput to accept
    KMS key ARNs only (not alias ARNs), matching service behavior.
    * api-change:``glue``: Adds support for retrieving Apache Iceberg table metadata via GetTable. Use
    the new AttributesToGet parameter with LATEST ICEBERG METADATA to receive schema, partition specs,
    sort orders, and table properties in the response.
    * api-change:``iam``: Updating documentation for select service-specific credential APIs
    * api-change:``sagemaker-runtime``: Added support for inline request payloads to the
    InvokeEndpointAsync operation to allow users to provide the inference payload directly in the
    request Body (up to 128,000 bytes) as an alternative to uploading the payload to Amazon S3 and
    passing InputLocation.
  - from version 1.43.28
    * api-change:``bedrock-agentcore``: Adds support to perform cross account data plane actions on an
    AgentCore Memory resource
    * api-change:``bedrock-agentcore-control``: Supports deterministic metadata for AgentCore Memory
    * api-change:``eks``: Introduce new CreateCluster parameters for Amazon EKS local clusters on AWS
    Outposts. Added etcdInstanceType for configuring the EC2 instance type for dedicated etcd
    instances, and spreadLevel for configuring the placement group spread level for Kubernetes control
    plane and etcd instances.
    * api-change:``healthlake``: Adds the UpdateFHIRDatastore API and adds analytics, NLP, and profile
    configuration support to CreateFHIRDatastore and DescribeFHIRDatastore.
    * api-change:``neptune``: Amazon Neptune now supports IPv6 dual-stack networking. You can create
    and manage Neptune DB clusters accessible over both IPv4 and IPv6 by specifying NetworkType as DUAL
    in CreateDBCluster, ModifyDBCluster, RestoreDBClusterFromSnapshot, and
    RestoreDBClusterToPointInTime API operations
    * api-change:``omics``: Adds support for workflowName in the ListRuns API response.
    * api-change:``support``: Adding new BDD representation of endpoint ruleset
  - from version 1.43.27
    * api-change:``amp``: Adds supports for out-of-order sample ingestion (default 1-minute window) and
    a configurable rule query offset to reduce data loss and improve alerting accuracy.
    * api-change:``connecthealth``: Add support for MedicalScribeBinaryAudioEvent in the Medical Scribe
    streaming input. This new event type lets you send audio as a raw binary payload instead of a
    base64-encoded value
    * api-change:``ec2``: This release adds support for AMI Watermark which a structured identifier
    that helps in tracking AMI provenance
    * api-change:``ecs``: Amazon ECS Managed Daemon task definitions now support pidMode and ipcMode
    parameters. Set shared to allow daemons to share PID or IPC namespaces with co-located tasks on
    Managed Instances, enabling process tracing and shared memory communication.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``lightsail``: This release adds support for Asia Pacific (Hong Kong) (ap-east-1),
    Europe (Spain) (eu-south-2) and South America (Sao Paulo) (sa-east-1) Regions.
    * api-change:``medialive``: Adding premixer settings to pid and track audio inputs in MediaLIve to
    allow greater control over mixing audio from multiple source streams including support for
    AudioPidSelectors made up of multiple audio PIDs.
    * api-change:``sagemaker``: Add support for G6e instances (ml.g6e.xlarge through ml.g6e.48xlarge)
    on Amazon SageMaker Notebook Instances.
    * api-change:``signin``: AWS Sign-In now allows customers to control access to the AWS Management
    Console using resource-based policies. With this release customers can restrict console access
    based on network perimeters such as VPC IDs, VPC endpoints, and IP addresses.
  - from version 1.43.26
    * api-change:``bedrock``: Adds support for the Amazon Bedrock account-level data retention APIs
    PutAccountDataRetention and GetAccountDataRetention.
    * api-change:``bedrock-agentcore``: Add RetryableConflictException (HTTP 409) to
    InvokeAgentRuntimeCommand and GetAgentCard to prevent orphaned VMs during concurrent session
    access. The SDK automatically retries this exception with backoff. Enforcement is not yet active
    and will be enabled in a future service update.
    * api-change:``cloudwatch``: This release adds the APIs (AssociateDatasetKmsKey,
    DisassociateDatasetKmsKey, GetDataset) to manage encryption at rest for OpenTelemetry metrics in
    CloudWatch using AWS KMS customer managed keys.
    * api-change:``ec2``: Added TagFieldSpecifications to CreateFlowLogs and DescribeFlowLogs APIs.
    Customers can now specify tag keys in their Flow Logs subscriptions to capture associated EC2
    resource tag values in their logs, enabling tag-based visibility.
    * api-change:``odb``: Releases Autonomous Database Serverless APIs,
    autonomousDatabaseOciIntegrationIamRoles, linkedOciTenancyId, linkedOciCompartmentId, and
    subscriptionErrors fields in GetOciOnboardingStatus API response.
    * api-change:``outposts``: Added AWS Outposts APIs for self-service Outposts quoting and ordering.
    New operations include CreateQuote, GetQuote, UpdateQuote, DeleteQuote, ListQuotes, and
    ListOrderableInstanceTypes.
  - from version 1.43.25
    * api-change:``compute-optimizer``: Adds new Idle Recommendation Resource types in the AWS Compute
    Optimizer API
    * api-change:``cost-optimization-hub``: Adds new Idle Recommendation types in the Cost Optimization
    Hub API
    * api-change:``deadline``: Added optional identityCenterRegion parameter to AssociateMember APIs to
    allow managing memberships for users and groups in other regions.
    * api-change:``devops-agent``: Add Asset APIs for managing versioned assets and asset files in AWS
    DevOps Agent agent spaces.
    * api-change:``mediapackagev2``: Adds support for DASH Audio Timeline Patternization. This enables
    your DASH manifests to templatize the repeating patterns that emerge in audio segment timelines.
    This compacts the total timeline length, utilizing the repeat notation, such that manifests don't
    grow indefinitely long.
    * api-change:``mgn``: AWS Transform discovery tool now supported as network migration input source.
    You can now use the AWS Transform Discovery tool as a source for network migration alongside
    modelizeIT, enabling hybrid network migrations for environments running both VMware and non-VMware
    workloads.
    * api-change:``observabilityadmin``: CloudWatch Observability Admin extends
    CentralizationRuleForOrganization APIs to support metrics, enabling centralization of metrics
    across accounts and Regions alongside logs.
    * api-change:``omics``: StartRunBatch API - Add EngineSettings
    * api-change:``taxsettings``: Adds support for additional tax information fields for Philippines,
    Belgium, Chile, France, Poland, and Italy in the Tax Settings API.
  - from version 1.43.24
    * api-change:``emr-serverless``: Adds support for updating max capacity and custom fields while
    application is started
    * api-change:``mediaconvert``: Adds support for configurable number of Clear Lead segments at the
    beginning of encrypted output. Adds support for multiple trickplay variants.
    * api-change:``payment-cryptography``: Adds CloudFormation support for resource-based policies on
    AWS Payment Cryptography keys.
    * api-change:``quicksight``: Adds support for Knowledge Base APIs and Index Capacity API
    * api-change:``sagemaker``: This release adds support for MLflow experiment tracking in SageMaker
    inference optimization. CreateAIRecommendationJob and CreateAIBenchmarkJob now accept an optional
    OutputConfig.MlflowConfig (MLflow App ARN, experiment, run name) to stream benchmark metrics and
    artifacts to your own MLflow App.
  - from version 1.43.23
    * api-change:``appflow``: Adding new BDD representation of endpoint ruleset
    * api-change:``appintegrations``: Adding new BDD representation of endpoint ruleset
    * api-change:``auditmanager``: Adding new BDD representation of endpoint ruleset
    * api-change:``chime-sdk-voice``: Adding new BDD representation of endpoint ruleset
    * api-change:``cloudformation``: Adding new BDD representation of endpoint ruleset
    * api-change:``config``: AWS Config now supports internal service-linked rules, allowing AWS
    service partners to deploy Config rules for customers and use the evaluation results to build
    enhanced features.
    * api-change:``connectparticipant``: Adding new BDD representation of endpoint ruleset
    * api-change:``efs``: Adding new BDD representation of endpoint ruleset
    * api-change:``emr``: Added support for Spark Connect interactive sessions on Amazon EMR on EC2
    with new APIs - StartSession, GetSession, GetSessionEndpoint, ListSessions, and TerminateSession.
    Added sessionEnabled field in RunJobFlow and DescribeCluster to enable Spark Connect endpoints on
    EMR clusters.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``glue``: AWS Glue Interactive Sessions now supports Apache Spark Connect, enabling
    remote Spark execution over gRPC with minimal client-side dependencies. Adds GetSessionEndpoint and
    GetDashboardUrl APIs. Modifies CreateSession now accepts SPARK CONNECT session type.
    * api-change:``guardduty``: Remove unsupported RDS field for filter
    * api-change:``ivs``: adds UpdateAdConfiguration operation to AWS IVS low-latency APIs
    * api-change:``kendra``: Adding new BDD representation of endpoint ruleset
    * api-change:``sagemaker``: Adds the IncludedData parameter to DescribeModelCard and
    DescribeModelPackage. Set it to MetadataOnly to retrieve a model card without decrypt permission on
    the customer managed AWS KMS key (default AllData returns full content). Adds support for the MTRL
    Job resource in SageMaker Search.
    * api-change:``sns``: Adding new BDD representation of endpoint ruleset
    * api-change:``wickr``: AWS Wickr now allows network administrators to configure a maximum session
    duration for non-SSO users in security groups, and display customizable consent popups to users at
    login for terms of use or compliance acknowledgements.
    * api-change:``workdocs``: Adding new BDD representation of endpoint ruleset
    * api-change:``workspaces``: Adding new BDD representation of endpoint ruleset
  - from version 1.43.22
    * api-change:``arc-region-switch``: ARC Region Switch now supports three new execution blocks for
    multi-Region database workloads-Amazon Aurora Serverless scaling, Amazon Aurora Provisioned
    scaling, and Amazon Neptune Global Database failover.
    * api-change:``ce``: Added support for target-coverage-based Savings Plans purchase analysis. The
    StartCommitmentPurchaseAnalysis API now accepts a new TARGET AVERAGE COVERAGE value for
    AnalysisType, as well as an optional SavingsPlansTargetCoverage field in
    SavingsPlansPurchaseAnalysisConfiguration
    * api-change:``compute-optimizer``: This release lets customers extend the lookback period for
    Amazon EBS volume and Amazon ECS rightsizing recommendations to 32 days.
    * api-change:``connect``: SearchContacts Connect API now supports filtering contacts by the AI
    Agents involved in handling them
    * api-change:``inspector2``: Inspector support for enhanced scanning
    * api-change:``socialmessaging``: Adding support for WhatsApp flow APIs and adding
    AccessDeniedByMetaException for Template APIs
  - from version 1.43.21
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``geo-routes``: Add "standardRegionalEndpoints" back to fix 'Could not connect to the
    endpoint URL'
  - from version 1.43.20
    * api-change:``ec2``: Amazon EC2 now supports self-service cancellation of future-dated Capacity
    Reservations. A cancellation charge applies based on remaining commitment. Customers can generate a
    cancellation quote to review charges before confirming.
    * api-change:``elasticache``: Amazon ElastiCache for Valkey now supports durability. This new
    capability is enabled through a Multi-AZ transactional log, enabling fast recovery and restart
    during failures.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``geo-routes``: Added Transit and Intermodal travel modes to CalculateRoutes. Plan
    routes using public transit (bus, subway, train, ferry) or combine transit with driving, taxi, and
    rental car segments in a single multi-modal route.
    * api-change:``guardduty``: Amazon GuardDuty Runtime Monitoring now supports 3 new
    SensitiveFileModified finding types (Persistence, PrivilegeEscalation, DefenseEvasion) that detect
    when security-sensitive system files are modified on EC2 instances or containers, indicating
    potential compromise through file tampering.
    * api-change:``iot``: Fleet indexing documentation update
    * api-change:``keyspacesstreams``: Added iterator description to the GetRecords API response for
    Amazon Keyspaces Change Data Capture (CDC) streams, enabling consumers to track their current
    position within the stream.
    * api-change:``lambda``: Adds configuration for tag propagation to Lambda-managed resources.
    * api-change:``sagemaker``: Amazon SageMaker Job is a new service to help you manage various
    workloads related to model fine tuning, evaluation etc. Two job categories are supported today,
    AgentRFT for multi-turn agentic reinforcement fine tuning, and AgentRFTEvaluation for evaluating
    base model or trained model from AgentRFT.
    * api-change:``sagemakerjobruntime``: Amazon SageMaker Job Runtime is a new service for managing
    trajectory data during multi-turn customization jobs. It provides APIs to send inference requests
    to models during job execution, mark rollouts as complete, and submit reward values for training
    trajectories.
    * api-change:``transcribe``: Release new Language locales including am-ET, es-MX, fa-AF, ht-HT,
    jv-ID, km-KH, my-MM, sq-AL, ne-NP. The commit shows past locales that have already been release
    which include cy-gb, ga-ie, gd-gb.
  - from version 1.43.19
    * api-change:``cognito-idp``: Add support for multi-region replication, enabling synchronization of
    user data and configurations to a secondary user pool in a standby Region. Add support for customer
    managed keys (CMK) in AWS KMS for encrypting user pool data at rest.
    * api-change:``marketplace-agreement``: Adding Entitlements in SearchAgreements Response
    * api-change:``quicksight``: This release adds public APIs for Amazon QuickSight Spaces, Agents,
    and Flows. Spaces APIs enable management of curated resource collections. Agents APIs provide
    lifecycle control over AI-powered agents that leverage Spaces. Flows APIs add CRUDL APIs for
    automated workflows.
  - from version 1.43.18
    * api-change:``bedrock``: Automated Reasoning checks - Added two build workflows for policies.
    Iterative Refine Policy uses AI to update policy definitions based on test results and feedback.
    Resolve Policy Ambiguities consolidates ambiguous variables in Automated Reasoning policies, a
    common source of ambiguous validation.
    * api-change:``bedrock-agentcore-control``: Reference your own AWS Secrets Manager secrets when
    configuring credential providers, giving you control over encryption, rotation, and access policies
    instead of using service-managed secrets.
    * api-change:``groundstation``: Adds support for Alpha-5 satellite number encoding in the Two-Line
    Element ephemeris format.
    * api-change:``omics``: Add engineSettings to StartRun and GetRun. Add profiles and
    profileParameterTemplates to GetWorkflow and GetWorkflowVersion.
    * api-change:``quicksight``: Adds support for creating, updating, describing, listing, and deleting
    an OAuthClientApplication resource, a new quicksight resource that allows customers to store OAuth
    configurations to connect to their databases via 3 Legged OAuth.
    * api-change:``rds-data``: RDS Data API arrays (longValues, doubleValues, stringValues,
    booleanValues) in ExecuteStatement responses now correctly support null elements. Runtime change
    for JS v3 and .NET. Compile-time change for C plus plus, .NET, Kotlin, Rust. No impact for Java,
    Python, Ruby, PHP, Go.
    * api-change:``route53resolver``: Added BatchCreateFirewallRule, BatchUpdateFirewallRule,
    BatchDeleteFirewallRule, and ListFirewallRuleTypes APIs. Added FirewallRuleType support to Firewall
    Rule APIs.
    * api-change:``sesv2``: This release introduces support for Tenant Suppression Lists
  - from version 1.43.17
    * api-change:``appstream``: Amazon WorkSpaces Applications now supports BYOL (Bring Your Own
    License). This enables customers to import their own WorkSpaces images and use them in WorkSpaces
    Applications.
    * api-change:``bedrock``: Add support for ModelPackageArn in Bedrock's CreateCustomModel API
    * api-change:``bedrock-agentcore``: Added Harness support for LiteLLM model configuration for
    third-party model providers. Added S3 and Git skill source types. Added Responses API format for
    OpenAI and Bedrock models. Added runtimeUserId and runtimeClientError to InvokeHarness.
    * api-change:``bedrock-agentcore-control``: Added Harness support for LiteLLM model configuration
    for third-party model providers. Added S3 and Git skill source types. Added Responses API format
    for OpenAI and Bedrock models. Added runtimeUserId parameter to InvokeHarness for end-user
    identification.
    * api-change:``bedrock-runtime``: Support system role in message
    * api-change:``controlcatalog``: AWS Control Catalog - Added GovernedProviders response field and
    inclusion filter to GetControl and ListControls APIs to identify and filter by cloud provider.
    Added ParameterRequirementSummary response field indicating parameter requirements.
    * api-change:``customer-profiles``: BatchPutProfileObject API adds multiple profile objects to a
    domain of a given ObjectType in a single API call.
    * api-change:``deadline``: Added support for persistent storage on Service-Managed Fleets, allowing
    customers to configure persistent storage that preserves data across worker sessions which reduces
    job startup times for workloads with large software installations or asset caches.
    * api-change:``endpoint-rules``: Update endpoint-rules client to latest version
    * api-change:``iot``: Adds new connectivity-related fields to Fleet Indexing API requests and
    responses.
    * api-change:``iot-data``: Adding GetConnection, ListSubscriptions, and SendDirectMessage APIs to
    IoT Data Plane
    * api-change:``opensearchserverless``: Adds support for deletion protection on collections, ability
    to create NEXTGEN collection groups and autoscaling visibility for NEXTGEN collection groups
    * api-change:``pcs``: This release adds support for configuring scaleDownIdleTimeInSeconds at the
    compute node group level, allowing customers to set different idle timeouts per node group.
    Previously this setting was only available at the cluster level.
    * api-change:``resiliencehubv2``: This is the initial SDK release for the next generation of
    Resilience Hub.
    * api-change:``s3control``: Update the minimum value of MinStorageBytesPercentage in
    StorageLensPrefixLevel.SelectionCriteria from 0.1 to 1, aligning the model with the documented
    contract.
  - from version 1.43.16
    * api-change:``bedrock-data-automation``: Matcher Fallback extends the CustomOutputConfiguration
    for the Document modality in DataAutomationProjects, enabling a fallback blueprint when no match is
    found. A FALLBACK match status is returned, improving the matching experience and guaranteeing
    customers always receive CustomOutputResults.
    * api-change:``ecs``: Add support for Neuron device resource requirements for Amazon ECS
    * api-change:``elementalinference``: Added support for smart subtitles in Elemental Inference,
    enabling automatic generation of subtitles for media content. Available in English, Spanish,
    French, German, Italian, and Portuguese.
    * api-change:``medialive``: AWS Elemental MediaLive now supports Smart Subtitles, a new caption
    source that uses AWS Elemental Inference to automatically generate WebVTT and TTML captions from
    source audio. Available in English, Spanish, French, German, Italian, and Portuguese.
    * api-change:``opensearch``: OpenSearch will now support multi-segment paths in JWKS URLs.
    * api-change:``organizations``: AWS Organizations now emits CloudTrail events
    (AccountJoinedOrganization, AccountDepartedOrganization) to the management account for membership
    changes, including join and departure method and timestamp.
    * api-change:``sagemaker``: Adds shared environment support for Restricted Instance Groups (RIGs)
    on SageMaker HyperPod, enabling cross-RIG workload scheduling and FSx sharing. This unlocks shared
    CPU-GPU environments needed for cost-efficient RL training (e.g., Nova Forge). Adds p6 instance
    support for recommendation jobs

++++ python-fastnumbers:

  - Add opensuse-build.patch fix build failure with Python 3.14 by
    linking libstdc++. Explicitly set 'language="c++"' and add
    '-lstdc++' to the linker arguments in setup.py via
    opensuse-build.patch. This ensures that the compiled extension
    module is properly linked against the standard C++ library on
    Python 3.14, where the compiler toolchain incorrectly defaults
    to gcc for linking, avoiding "undefined symbol" ImportError
    failures during %check.

++++ python-greenlet:

  - Update to 3.5.2
    * The minimum supported version of Python 3.15 is now 3.15b2.
    * Fix some garbage-collection related crashes on free-threaded
    Python 3.15. Thanks to Kumar Aditya in PR #511.
    * Improve garbage collection of greenlets. This mostly applies
    to Python 3.15. Thanks to Kumar Aditya in PR #512.

++++ python-jupyter-ydoc:

  - Update to 3.5.0:
    [#] Maintenance and upkeep improvements
    * Bump pycrdt v0.13.0 #412 (@davidbrochart)
  - refresh node modules (bsc#1268933, CVE-2026-48779)
  - replace patch update-brace-expansion.patch with
    update-js-deps.patch, to override js dependencies in node_modules
    resolution

++++ python-libpass:

  - Initial release of python-libpass 1.9.3

++++ python-rebulk:

  - Update to version 4.1.0
    Chores:
    * Sync uv.lock with released version 4.0.0
    Features:
    * typing: Precise return types for query methods via @overload
  - Update to version 4.0.0
    Bug Fixes
    * introspector: Reflect pattern value= in introspected
    properties
    Build System:
    * Migrate to uv, drop EOL Python, add full type checking
    Chores:
    * Remove dead pylint directive comments
    * Remove obsolete runtests.py genscript blob
    Code Style:
    * Expand ruff ruleset, run README doctests, add pre-commit
    Refactoring:
    * types: Cut type: ignore comments from 60 to 24
    Breaking Changes:
    * Minimum supported Python is now 3.10 (dropped 3.7, 3.8,
    3.9).

++++ python-s3transfer:

  - Update to version 0.19.0
    * feature:``s3``: Update multi-part copy logic to match single-part
    behavior for TaggingDirective and AnnotationDirective
    * enhancement:``s3``: Warn when Metadata or Tagging is supplied to
    a copy without the corresponding directive set to REPLACE, in
    which case the supplied value is silently ignored. This matches
    the CopyObject behavior.
  - from version 0.18.0
    * feature:Copy: By default, preserve source object metadata during
    multipart copies to match single CopyObject behavior.

++++ sisu:

  - Update to upstream release 1.0.1
    * Changes
    + Slight dependency updates
    + Addition of automatic module names

++++ sisu-extenders:

  - Update to upstream release 1.0.1
    * Changes
    + Slight dependency updates
    + Addition of automatic module names

++++ sisu-mojos:

  - Update to upstream release 1.0.1
    * Changes
    + Slight dependency updates
    + Addition of automatic module names

++++ stgit:

  - Update to version 2.6.1:
    * chore: update changelog for 2.6.1
    * chore: update transitive deps
    * chore: update gix to 0.84
    * chore: update tar to 0.4.46
    * chore: update serde_json to 1.0.150
    * chore: update jiff to 0.2.29
    * chore: update curl to 0.4.50
    * stgit.el: Fix Index/Work Tree incremental refresh
    * fix(rebase): Run --exec commands also if the stack base does not change

++++ systemd-repart-dracut:

  - Update to version 1+git20260626.ecafb3f:
    * Save fstab on MicroOS and fix CopyFiles

------------------------------------------------------------------
------------------  2026-6-25  -  Jun 25 2026  -------------------
------------------------------------------------------------------

++++ MozillaFirefox:

  - Add mozilla-bmo2048250.patch, fix input method candidate window tracking by
    explicitly committing Wayland surface after setting cursor location.
    (boo#1268447 and bmo#2048250)

++++ aliyun-cli:

  - Update to version 3.4.1
    * [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
    * {cliext} Add aliyun spark-submit by @AllyW in (#1358)
  - from version 3.4.0
    * feat(acrutil): extract shared binary manager and add diagnosis
    subcommand by @copyrightpoiiiii in (#1349)
    * [feature] add rostran sub command by @xiao201208 in (#1350)
    * {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
    * {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
    * Feature/support anonymous by @yuexiu94 in (#1354)
    * feat: support retry-after policy for throttling error by @yndu13
    in (#1355)

++++ amazon-ssm-agent:

  - Update to version 3.3.4793.0
    * Add multicloud support enabling SSM Agent registration with
    Azure cloud providers
    * Add support for the upcoming public key in the agent code

++++ assimp:

  - added patches
    CVE-2026-10232: heap use-after-free in aiNode::~aiNode due to invalid node tree when processing malformed ASE files [bsc#1267037]
    * assimp-CVE-2026-10232.patch

++++ blender-4.5:

  - Update to 4.5.11
  - 75634782a32 Fix #159131: Python error when converting rotation
    mode on FCurves without group
  - ac561220199 Fix #145891: Crash scrubbing VSE using Shift-RMB in
    scene with no channels
  - f41ae2de10c Fix: Grease Pencil: `Join` operator connects wrong
    ends and crashes
  - 09e3fe90145 Fix: GL Compilation Subprocess file locking
  - c33544abe9d Fix: GPU: Shader cache clearing on subprocess crash
  - 50137781e4e Release: Bump to 4.5.11 candidate
  - 0f397514219 Fix #159842: Removing a liboverride fails to mark
    all sub-data as local.
  - ed347df1e17 Anim: Backport Camera Marker Selection Logic Fix to
    4.5

++++ blktests:

  - Use %autosetup -p1 instead of explicit %setup + %patch

++++ blog:

  - Update to version 2.43
    Make sure that if blog is running it is identified as plymouth Latest
    also add conflicts to systemd-ask-password-console units in the
    systemd-ask-password-blog units. This should avoid conflicting password
    agents asking the same question in s390x.

++++ cantata:

  - Update to version 3.5.0:
    * Update to FontAwesome 7.
    * Add Turkish translation.
    * Use bundled FontAwesome by default.
    * Fix dynamic playlists with the Flatpak build.
    * Fix unreadable first run wizard on Windows 11 dark mode.
    * Fix Nix build.
    * Fix CMake COMPILE_WARNING_AS_ERROR not being marked as a cache variable.
    * Fix ignored nodiscard function return value.
    * Update GitHub workflows
    * Enable bundled FontAwesome by default, regardless of platform by @maxmitti in #120
    * fix: Add workaround for unreadable first run wizard on Windows 11 with dark mode by @maxmitti in #121
    * Fix: dynamic playlists with flatpak build by @maxmitti in #123
    * support/QtAwesome: Update to Font Awesome 7 by @tgurr in #129
    * Add kdePackages.karchive to flake.nix dependencies by @arximboldi in #133
    * build: Turn COMPILE_WARNING_AS_ERROR into a cache variable by @PPN-SD in #142
    * fix: #141 [[nodiscard]] ignored by @nullobsi in #143
    * git: update workflows by @nullobsi in #148
    * feat(i18n): add Turkish translation by @G-grbz in #147
    * rc: v3.5.0 by @nullobsi in #151

++++ capstone:

  - Modernize packaging to use wheel as an intermediate project
    (`%python_build` is not supported anymore). Make building
    working with the rewritten python interpretors changes.

++++ coolercontrol:

  - Fix connection error.
    Repaired the unusable and defective coolercontrold.

++++ crmsh:

  - Update to version 5.1.0+20260625.11a77666:
    * Dev: unittests: Add dedicated unit tests for storage_utils

++++ dlib:

  - Use build/pyproject macros to build and install the module.
  - Actually run the numpy tests.
  - Add patch support-python-3.14.patch:
    * Support Python 3.14 refcount changes.

++++ firefox-esr:

  - Add mozilla-bmo2048250.patch, fix input method candidate window tracking by
    explicitly committing Wayland surface after setting cursor location.
    (boo#1268447 and bmo#2048250)

++++ ghc-psqueues:

  - Update psqueues to version 0.2.8.3 revision 2.
    Upstream has revised the Cabal build instructions on Hackage.

++++ glib2:

  - Update to version 2.88.2:
    + gnulib: Fix unused flags variable warning
    + CI: set msys2-clang64 as default job for merges
    + Updated translations.

++++ git-annex:

  - Update git-annex to version 10.20260624.
    git-annex (10.20260624) upstream; urgency=medium
    * Added Botan build flag, which speeds up checksumming significantly
    for most existing hash backends.
    * Added Blake3 build flag, which is the fastest available
    cryptographically secure hash.
    Thanks to edef for implementing this.
    * When b3sum is in PATH, use it for faster blake3 hashing.
    * Added XXH3 build flag, which is the fastest available
    non-cryptographically secure hash, and is a smaller hash
    than MD5 or SHA1.
    * Improve handling of synced/master and similar branches, by
    only creating such branches when necessary to push to a non-bare
    remote, and by removing the local synced branch once its changes
    are merged.
    * put: New command.
    * move: Fix bug where an interrupted command other than move could
    be treated as an interrupted move, resulting in dropping content
    when not allowed by numcopies.
    * Fix build with http-types-0.12.5
    * merge, post-receive: Fix bug that prevented merging any synced/
    branches into the current branch.
    (Reversion introduced in 10.20260601)
    * git-annex.cabal: Remove unused dependency on old-locale.
    * Remove dependencies on securemem and byteable.
  - - Joey Hess <id@joeyh.name>  Thu, 25 Jun 2026 12:28:43 -0400

++++ glassfish-transaction-api:

  - Generate and adapt ant build system in order to reduce the
    dependencies and allow build on SLFO

++++ glib2-doc:

  - Update to version 2.88.2:
    + gnulib: Fix unused flags variable warning
    + CI: set msys2-clang64 as default job for merges
    + Updated translations.

++++ glib2-stage1-devel:

  - Update to version 2.88.2:
    + gnulib: Fix unused flags variable warning
    + CI: set msys2-clang64 as default job for merges
    + Updated translations.

++++ glycin-loaders:

  - Update to version 2.1.5:
    + Fixed: image-rs/jpeg: Support RGB for editing. There are
    actually images that don't use ycbcr.

++++ go1.21:

  - Packaging improvements:
    * Drop subpackage go1.x-libstd std library .so refs jsc#PED-1962
    * Use of Go standard library as .so and -buildmode=shared is not
    recommended or supported by upstream Go
    * Subpackage go1.x-libstd was only ever built for Factory and
    removal does not affect SLE
    * No Go application packages in Factory use go1.x-libstd

++++ go1.22:

  - Packaging improvements:
    * Drop subpackage go1.x-libstd std library .so refs jsc#PED-1962
    * Use of Go standard library as .so and -buildmode=shared is not
    recommended or supported by upstream Go
    * Subpackage go1.x-libstd was only ever built for Factory and
    removal does not affect SLE
    * No Go application packages in Factory use go1.x-libstd

++++ go1.23:

  - Packaging improvements:
    * Drop subpackage go1.x-libstd std library .so refs jsc#PED-1962
    * Use of Go standard library as .so and -buildmode=shared is not
    recommended or supported by upstream Go
    * Subpackage go1.x-libstd was only ever built for Factory and
    removal does not affect SLE
    * No Go application packages in Factory use go1.x-libstd

++++ go1.24:

  - Packaging improvements:
    * Drop subpackage go1.x-libstd std library .so refs jsc#PED-1962
    * Use of Go standard library as .so and -buildmode=shared is not
    recommended or supported by upstream Go
    * Subpackage go1.x-libstd was only ever built for Factory and
    removal does not affect SLE
    * No Go application packages in Factory use go1.x-libstd

++++ go1.25:

  - Packaging improvements:
    * Drop subpackage go1.x-libstd std library .so refs jsc#PED-1962
    * Use of Go standard library as .so and -buildmode=shared is not
    recommended or supported by upstream Go
    * Subpackage go1.x-libstd was only ever built for Factory and
    removal does not affect SLE
    * No Go application packages in Factory use go1.x-libstd

++++ go1.26:

  - Packaging improvements:
    * Drop subpackage go1.x-libstd std library .so refs jsc#PED-1962
    * Use of Go standard library as .so and -buildmode=shared is not
    recommended or supported by upstream Go
    * Subpackage go1.x-libstd was only ever built for Factory and
    removal does not affect SLE
    * No Go application packages in Factory use go1.x-libstd

++++ google-osconfig-agent:

  - Update to version 20260624.01
    * Add unit tests for agentendpoint/agentendpoint_beta.go (#983)
  - from version 20260624.00
    * Replace yum install with yum update (#1009)
  - from version 20260623.02
    * Bump github.com/containerd/containerd (#1013)
  - from version 20260623.01
    * Add unit tests for policies/apt.go PART 2 (#957)
  - from version 20260623.00
    * Add test cases for agentendpoint/task_state.go (#984)
  - from version 20260618.00
    * Remove deprecated rhel-sap images and add new ones (#1007)
  - from version 20260616.00
    * Add test cases for clog/clog.go (#986)

++++ govulncheck-vulndb:

  - Update to version 0.0.20260625T223441 2026-06-25T22:34:41Z.
    Refs jsc#PED-11136
    Go CVE Numbering Authority IDs added or updated with aliases:
    * GO-2026-4961 CVE-2026-33813
    * GO-2026-5003 CVE-2026-8275 GHSA-322p-rrj6-j44g
    * GO-2026-5004 CVE-2026-41889 GHSA-j88v-2chj-qfwx
    * GO-2026-5052 GHSA-mpwr-8vm7-h73f
    * GO-2026-5058 CVE-2026-4660 GHSA-92mm-2pjq-r785
    * GO-2026-5059 CVE-2026-55671 GHSA-29jh-8cfq-rr8x
    * GO-2026-5060 CVE-2026-55229 GHSA-2mrg-35hw-x3x9
    * GO-2026-5061 CVE-2026-46601
    * GO-2026-5062 CVE-2026-46602
    * GO-2026-5063 GHSA-2h46-9x5w-4wf7
    * GO-2026-5064 CVE-2026-53492 GHSA-33vj-92qq-66hc
    * GO-2026-5065 CVE-2026-52808 GHSA-268j-37xf-pp52
    * GO-2026-5067 CVE-2026-3108 GHSA-3439-vqgj-2gcf
    * GO-2026-5068 CVE-2026-25996 GHSA-34r5-6j7w-235f
    * GO-2026-5070 CVE-2026-45088 GHSA-35wr-x7v6-9fv2
    * GO-2026-5071 CVE-2026-44593 GHSA-3636-h3vx-6465
    * GO-2026-5072 CVE-2026-42296 GHSA-3775-99mw-8rp4
    * GO-2026-5076 CVE-2026-6959 GHSA-3934-423w-4jq3
    * GO-2026-5077 CVE-2026-45047 GHSA-39qr-rc93-vhqm
    * GO-2026-5078 CVE-2026-7573 GHSA-3c93-g9g6-p5j4
    * GO-2026-5079 CVE-2026-45224 GHSA-3cjv-h753-qf7h
    * GO-2026-5080 CVE-2026-42593 GHSA-3cv5-q585-h563
    * GO-2026-5081 CVE-2026-27783 GHSA-3fwp-p5rj-2pxf
    * GO-2026-5082 CVE-2026-46614 GHSA-3g33-6vg6-27m8
    * GO-2026-5083 CVE-2026-54761 GHSA-3g6v-2r68-prfc
    * GO-2026-5084 CVE-2026-45062 GHSA-3g8v-8r37-cgjm
    * GO-2026-5085 CVE-2026-41572 GHSA-3gr9-485j-v4xf
    * GO-2026-5086 CVE-2026-46415 GHSA-3h23-rrpc-3p87
    * GO-2026-5087 CVE-2026-8349 GHSA-3h63-fx68-x5fm
    * GO-2026-5088 CVE-2026-39429 GHSA-3j3q-wp9x-585p
    * GO-2026-5089 CVE-2026-46410 GHSA-3jmg-p96m-m328
    * GO-2026-5090 CVE-2026-40304 GHSA-3jpj-v3xr-5h6g
    * GO-2026-5091 GHSA-3m6q-h5gj-7mrw
    * GO-2026-5092 CVE-2026-3112 GHSA-3mw5-466q-295q
    * GO-2026-5093 CVE-2026-44326 GHSA-3p28-73q7-45xp
    * GO-2026-5094 CVE-2026-33540 GHSA-3p65-76g6-3w7r
    * GO-2026-5095 CVE-2026-27877 GHSA-3q27-7qjq-p9c5
    * GO-2026-5096 CVE-2026-54096 GHSA-3q2p-72cj-682c
    * GO-2026-5097 CVE-2026-42274 GHSA-3q34-rx83-r6mq
    * GO-2026-5098 CVE-2025-64719 GHSA-3qq3-668m-v9mj
    * GO-2026-5099 CVE-2026-42880 GHSA-3v3m-wc6v-x4x3
    * GO-2026-5100 GHSA-3v85-fqvh-7rxf
    * GO-2026-5101 CVE-2026-45298 GHSA-3v9w-6365-9w54
    * GO-2026-5103 CVE-2026-52816 GHSA-3w28-36p9-w929
    * GO-2026-5104 CVE-2026-8780 GHSA-3x4g-259h-5p7c
    * GO-2026-5106 CVE-2026-44477 GHSA-423p-g724-fr39
    * GO-2026-5107 CVE-2026-45686 GHSA-43g7-cwr8-q3jh
    * GO-2026-5108 CVE-2026-42272 GHSA-43jv-5j4x-qv67
    * GO-2026-5109 CVE-2026-44321 GHSA-44qj-cghf-9p97
    * GO-2026-5110 CVE-2026-52804 GHSA-4565-r4x7-hg8j
    * GO-2026-5111 CVE-2026-35600 GHSA-45q4-x4r9-8fqj
    * GO-2026-5112 CVE-2026-3113 GHSA-4765-v66x-rqx7
    * GO-2026-5113 CVE-2026-44425 GHSA-47r2-v3x6-wff9
    * GO-2026-5114 CVE-2026-35598 GHSA-48ch-p4gq-x46x
    * GO-2026-5115 CVE-2026-21726 GHSA-497x-rrr9-68jp
    * GO-2026-5117 CVE-2026-47190 GHSA-49pm-43hf-6xfq
    * GO-2026-5118 CVE-2026-40302 GHSA-4fxq-2x3x-6xqx
    * GO-2026-5120 CVE-2026-8621 GHSA-4g9m-rffv-h6wq
    * GO-2026-5121 GHSA-4gph-2hhr-5mwg
    * GO-2026-5123 GHSA-4h9q-p5j4-xvvh
    * GO-2026-5124 CVE-2026-52796 GHSA-4j89-2c4f-44c6
    * GO-2026-5125 GHSA-4jgr-pg2m-m988
    * GO-2026-5126 CVE-2026-47256 GHSA-4jvg-4jfx-fmhc
    * GO-2026-5127 CVE-2026-40251 GHSA-4m88-wxj4-9qj6
    * GO-2026-5128 CVE-2026-54762 GHSA-4mr2-fg2p-w63c
    * GO-2026-5129 CVE-2026-42238 GHSA-4pvg-prr3-9cxr
    * GO-2026-5130 CVE-2026-8781 GHSA-4qf2-p32m-7hmf
    * GO-2026-5131 CVE-2026-44323 GHSA-4rqf-grm6-vf75
    * GO-2026-5132 CVE-2026-42596 GHSA-4vmc-gm8v-m35h
    * GO-2026-5133 CVE-2026-55866 GHSA-4vrg-r928-h5vv
    * GO-2026-5134 CVE-2026-42572 GHSA-55gc-6fmc-fpx9
    * GO-2026-5136 CVE-2026-41131 GHSA-57j5-qwp2-vqp6
    * GO-2026-5137 CVE-2026-40193 GHSA-5835-4gvc-32pc
    * GO-2026-5138 CVE-2026-42459 GHSA-585v-hcgf-jhfr
    * GO-2026-5139 CVE-2026-47724 GHSA-598g-h2vc-h5vg
    * GO-2026-5140 CVE-2026-52809 GHSA-5c3f-6486-3g7g
    * GO-2026-5141 CVE-2026-40077 GHSA-5f5r-95pg-xrpm
    * GO-2026-5142 CVE-2026-44315 GHSA-5f62-53r8-qrqf
    * GO-2026-5143 CVE-2026-44849 GHSA-5fxq-qcf3-244w
    * GO-2026-5144 CVE-2026-11719 GHSA-5gf6-gc35-xjpc
    * GO-2026-5145 CVE-2026-40943 GHSA-5gqc-qhrj-9xw8
    * GO-2026-5146 CVE-2026-40876 GHSA-5h6h-7rc9-3824
    * GO-2026-5147 CVE-2026-34457 GHSA-5hvv-m4w4-gf6v
    * GO-2026-5148 CVE-2026-40886 GHSA-5jv8-h7qh-rf5p
    * GO-2026-5149 CVE-2026-39858 GHSA-5m6w-wvh7-57vm
    * GO-2026-5150 CVE-2026-35605 GHSA-5q48-q4fm-g3m6
    * GO-2026-5151 CVE-2026-40280 GHSA-5q7p-7jgv-ww56
    * GO-2026-5153 CVE-2026-24661 GHSA-5rfv-h47g-xj42
    * GO-2026-5154 CVE-2026-25705 GHSA-5v3h-x4wf-5c35
    * GO-2026-5155 CVE-2026-39383 GHSA-5vh4-rgv7-p9g4
    * GO-2026-5156 CVE-2026-34529 GHSA-5vpr-4fgw-f69h
    * GO-2026-5157 CVE-2023-34620 GHSA-5wfc-hjrc-gq87
    * GO-2026-5159 CVE-2026-54097 GHSA-5ww9-jg6q-38r7
    * GO-2026-5160 CVE-2026-45720 GHSA-5x9f-6vg5-qg4m
    * GO-2026-5161 CVE-2025-2842 GHSA-5xf3-gmx4-529v
    * GO-2026-5162 CVE-2026-40893 GHSA-62p3-hvxx-fxg4
    * GO-2026-5163 CVE-2026-35051 GHSA-6384-m2mw-rf54
    * GO-2026-5164 CVE-2026-32936 GHSA-63cw-r7xf-jmwr
    * GO-2026-5165 GHSA-6447-269v-g68m
    * GO-2026-5166 CVE-2026-47671 GHSA-64cj-qvx5-m4f3
    * GO-2026-5167 CVE-2026-35606 GHSA-67cg-cpj7-qgc9
    * GO-2026-5168 CVE-2026-41648 GHSA-67wx-r9xr-x75x
    * GO-2026-5169 CVE-2026-45796 GHSA-686c-7vgv-v3fx
    * GO-2026-5170 CVE-2026-40293 GHSA-68m9-983m-f3v5
    * GO-2026-5171 CVE-2026-34449 GHSA-68p4-j234-43mv
    * GO-2026-5172 GHSA-69hx-63pv-f8f4
    * GO-2026-5173 CVE-2026-4055 GHSA-6cfr-wp44-6qmv
    * GO-2026-5174 CVE-2026-7572 GHSA-6cmp-qv2f-x97x
    * GO-2026-5175 CVE-2026-34227 GHSA-6fpf-248c-m7wm
    * GO-2026-5176 CVE-2026-41574 GHSA-6g38-8j4p-j3pr
    * GO-2026-5177 CVE-2026-34761 GHSA-6gm8-3g4h-w82m
    * GO-2026-5178 CVE-2026-47780 GHSA-6gxq-gpr8-xgjp
    * GO-2026-5179 CVE-2026-8782 GHSA-6h8r-h22r-jj64
    * GO-2026-5180 CVE-2026-40912 GHSA-6jwx-7vp4-9847
    * GO-2026-5181 CVE-2026-55883 GHSA-6m68-r693-78qx
    * GO-2026-5182 CVE-2026-55770 GHSA-6mwx-4547-5vc9
    * GO-2026-5183 CVE-2026-48089 GHSA-6p54-fw2f-q7gf
    * GO-2026-5184 CVE-2026-52812 GHSA-6p9m-q3jp-47h4
    * GO-2026-5185 CVE-2026-41888 GHSA-6pjf-3r9x-m592
    * GO-2026-5186 CVE-2026-35471 GHSA-6qcc-6q27-whp8
    * GO-2026-5187 CVE-2026-6987 GHSA-6r3x-h84w-fhxx
    * GO-2026-5188 CVE-2026-45147 GHSA-6r88-8v7q-q4p2
    * GO-2026-5189 CVE-2026-42083 GHSA-6rgm-gr97-x3j5
    * GO-2026-5190 CVE-2026-8783 GHSA-6v92-ph9p-hrpc
    * GO-2026-5191 GHSA-6vgg-xhvh-38ff
    * GO-2026-5192 CVE-2026-39946 GHSA-6vgr-cp5c-ffx3
    * GO-2026-5193 GHSA-6vxv-wg6j-5qwp
    * GO-2026-5194 CVE-2026-47268 GHSA-6x26-5727-rrm9
    * GO-2026-5195 CVE-2026-41263 GHSA-6x2q-h3cr-8j2h
    * GO-2026-5196 CVE-2026-46354 GHSA-6x44-w3xg-hqqf
    * GO-2026-5197 CVE-2026-55670 GHSA-6x8v-2fq5-2229
    * GO-2026-5199 CVE-2026-4525 GHSA-72gw-fmmr-c4r4
    * GO-2026-5200 CVE-2026-42273 GHSA-72h4-mxfc-jx37
    * GO-2026-5201 CVE-2026-34605 GHSA-73g7-86qr-jrg3
    * GO-2026-5202 CVE-2026-52815 GHSA-744x-3838-5r56
    * GO-2026-5203 CVE-2026-42275 GHSA-74m3-9qvm-rp9h
    * GO-2026-5204 GHSA-74m6-4hjp-7226
    * GO-2026-5205 CVE-2026-35607 GHSA-7526-j432-6ppp
    * GO-2026-5206 GHSA-763j-3p5v-jfc6
    * GO-2026-5207 CVE-2026-41050 GHSA-765j-qfrp-hm3j
    * GO-2026-5209 CVE-2026-42081 GHSA-77x9-rf64-92gv
    * GO-2026-5210 CVE-2026-34403 GHSA-78mf-482w-62qj
    * GO-2026-5211 CVE-2026-24905 GHSA-79qw-g77v-2vfh
    * GO-2026-5212 CVE-2026-44310 GHSA-7c37-gx6w-8vc5
    * GO-2026-5213 CVE-2026-39388 GHSA-7ccv-rp6m-rffr
    * GO-2026-5214 CVE-2026-44778 GHSA-7cfq-5mhv-jrp9
    * GO-2026-5215 GHSA-7cwm-fpfh-rrch
    * GO-2026-5216 CVE-2026-48708 GHSA-7fq5-7wr8-rjwj
    * GO-2026-5217 CVE-2026-44850 GHSA-7fw3-x4r2-g7wc
    * GO-2026-5218 CVE-2026-44543 GHSA-7fxv-8wr2-mfc4
    * GO-2026-5219 CVE-2026-21724 GHSA-7g92-g4vh-hp84
    * GO-2026-5220 CVE-2026-45625 GHSA-7h26-hg47-p9hx
    * GO-2026-5221 CVE-2026-40885 GHSA-7h3j-592v-jcrp
    * GO-2026-5222 GHSA-7hgr-xvrr-xpw3
    * GO-2026-5223 CVE-2026-47722 GHSA-7hp6-g3pq-3pc3
    * GO-2026-5224 CVE-2026-44503 GHSA-7j59-v9qr-6fq9
    * GO-2026-5225 CVE-2026-46405 GHSA-7j6w-vvw2-5f9c
    * GO-2026-5226 CVE-2026-40944 GHSA-7jrq-q4pq-rhm6
    * GO-2026-5227 CVE-2026-42220 GHSA-7jrr-xw9c-mj39
    * GO-2026-5228 CVE-2026-5774 GHSA-7m55-2hr4-pw78
    * GO-2026-5229 CVE-2026-40259 GHSA-7m5h-w69j-qggg
    * GO-2026-5230 CVE-2026-46618 GHSA-7pjr-qpvh-m339
    * GO-2026-5231 GHSA-7qjx-gp9h-65qj
    * GO-2026-5232 GHSA-7qx6-f23w-3w7f
    * GO-2026-5233 CVE-2026-44309 GHSA-7rmh-48mx-2vwc
    * GO-2026-5234 CVE-2026-42590 GHSA-7v3r-m9c8-r855
    * GO-2026-5235 CVE-2026-42295 GHSA-7vf8-2cr6-54mf
    * GO-2026-5236 CVE-2026-40575 GHSA-7x63-xv5r-3p2x
    * GO-2026-5237 CVE-2026-7776 GHSA-7x9r-wcgg-w86f
    * GO-2026-5238 CVE-2026-6347 GHSA-82j6-4fq7-fx62
    * GO-2026-5239 CVE-2026-48096 GHSA-8396-jffm-qx4w
    * GO-2026-5240 GHSA-84g5-x8j3-7235
    * GO-2026-5241 CVE-2026-46617 GHSA-85g2-pmrx-r49q
    * GO-2026-5242 CVE-2026-41491 GHSA-85gx-3qv6-4463
    * GO-2026-5243 CVE-2026-25714 GHSA-8629-vc8r-5p58
    * GO-2026-5244 CVE-2026-45741 GHSA-86m8-88fq-xfxp
    * GO-2026-5245 CVE-2026-20719 GHSA-86vc-mg26-fj6x
    * GO-2026-5246 CVE-2026-44697 GHSA-87m7-qffr-542v
    * GO-2026-5247 CVE-2026-5807 GHSA-88v5-9hxc-f85r
    * GO-2026-5248 CVE-2026-45680 GHSA-89c6-vpcj-7vj4
    * GO-2026-5249 CVE-2026-52811 GHSA-89mr-xqfv-758m
    * GO-2026-5250 CVE-2026-54090 GHSA-8c9q-7855-wfxq
    * GO-2026-5251 CVE-2026-11717 GHSA-8fcc-w5hv-4gxv
    * GO-2026-5252 CVE-2026-47753 GHSA-8g7m-96c8-8wwc
    * GO-2026-5253 CVE-2026-41433 GHSA-8gmg-3w2q-65f4
    * GO-2026-5254 CVE-2026-35527 GHSA-8gw4-p4wq-4hcv
    * GO-2026-5255 CVE-2026-48025 GHSA-8h84-fhqq-q58v
    * GO-2026-5256 CVE-2026-28759 GHSA-8h9w-w78c-vvr3
    * GO-2026-5257 CVE-2026-45089 GHSA-8hf9-3q64-q2qf
    * GO-2026-5258 CVE-2026-34727 GHSA-8jvc-mcx6-r4cg
    * GO-2026-5259 GHSA-8mc6-xjpr-h98x
    * GO-2026-5260 CVE-2026-40922 GHSA-8q5w-mmxf-48jg
    * GO-2026-5261 CVE-2026-49396 GHSA-8qhj-4f8c-j8qg
    * GO-2026-5262 CVE-2026-5052 GHSA-8r5m-3f66-qpr3
    * GO-2026-5263 CVE-2026-5163 GHSA-8r89-8w26-cq32
    * GO-2026-5264 CVE-2026-42154 GHSA-8rm2-7qqf-34qm
    * GO-2026-5265 CVE-2026-45679 GHSA-8rrq-wcg8-cv5q
    * GO-2026-5267 CVE-2026-55776 GHSA-8w8f-r2xv-4q4j
    * GO-2026-5268 GHSA-8wfp-579w-6r25
    * GO-2026-5269 CVE-2026-44247 GHSA-8wxp-xxp2-rcgx
    * GO-2026-5270 CVE-2026-35454 GHSA-8x9r-hvwg-c55h
    * GO-2026-5271 CVE-2026-48501 GHSA-8xvp-7hj6-mcj9
    * GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
    * GO-2026-5273 CVE-2026-44428 GHSA-95c3-6vvw-4mrq
    * GO-2026-5275 CVE-2026-45682 GHSA-962q-hwm5-52x5
    * GO-2026-5276 CVE-2026-35594 GHSA-96q5-xm3p-7m84
    * GO-2026-5277 CVE-2026-44774 GHSA-96qj-4jj5-wcjc
    * GO-2026-5278 CVE-2026-41135 GHSA-98cp-84m9-q3qp
    * GO-2026-5279 CVE-2026-29050 GHSA-98f2-w9h9-7fp9
    * GO-2026-5280 CVE-2026-41685 GHSA-98vh-x9cx-9cfp
    * GO-2026-5281 CVE-2026-45287 GHSA-995v-fvrw-c78m
    * GO-2026-5282 CVE-2026-46716 GHSA-99gv-2m7h-3hh9
    * GO-2026-5283 CVE-2026-39961 GHSA-99j8-wv67-4c72
    * GO-2026-5284 CVE-2026-40344 GHSA-9c4q-hq6p-c237
    * GO-2026-5285 GHSA-9cp7-j3f8-p5jx
    * GO-2026-5286 CVE-2026-28737 GHSA-9cpj-qc93-vw8v
    * GO-2026-5288 GHSA-9fw6-xgg2-mq9q
    * GO-2026-5289 CVE-2026-39350 GHSA-9gcg-w975-3rjh
    * GO-2026-5290 GHSA-9h64-2846-7x7f
    * GO-2026-5291 CVE-2026-41164 GHSA-9hmg-827w-9rhj
    * GO-2026-5292 CVE-2026-45626 GHSA-9mvm-4gwg-v8mp
    * GO-2026-5293 CVE-2026-6346 GHSA-9p64-jpc7-m2rp
    * GO-2026-5294 CVE-2026-47768 GHSA-9pg3-25fq-p6cc
    * GO-2026-5295 CVE-2026-40262 GHSA-9pr4-rf97-79qh
    * GO-2026-5296 CVE-2026-33544 GHSA-9q5m-jfc4-wc92
    * GO-2026-5297 CVE-2026-40097 GHSA-9qq8-cgcv-qmc9
    * GO-2026-5298 GHSA-9r4w-jg96-92mv
    * GO-2026-5299 CVE-2026-28699 GHSA-9r5x-wg6m-x2rc
    * GO-2026-5300 GHSA-9v4j-7g44-qcqw
    * GO-2026-5301 CVE-2026-26191 GHSA-9vcr-g537-3w5v
    * GO-2026-5302 CVE-2026-44423 GHSA-9w9c-9w8m-w89q
    * GO-2026-5303 CVE-2026-40884 GHSA-c29w-qq4m-2gcv
    * GO-2026-5304 CVE-2026-55774 GHSA-c36x-h252-g9x2
    * GO-2026-5305 CVE-2026-52813 GHSA-c39w-43gm-34h5
    * GO-2026-5308 CVE-2026-47179 GHSA-c3px-h233-h6fq
    * GO-2026-5310 CVE-2026-34476 GHSA-c4hg-6933-x62x
    * GO-2026-5311 CVE-2026-4858 GHSA-c4r7-j7pp-r8mp
    * GO-2026-5312 CVE-2026-47267 GHSA-c4v7-xg93-qf8g
    * GO-2026-5314 CVE-2026-40574 GHSA-c5c4-8r6x-56w3
    * GO-2026-5315 CVE-2026-45576 GHSA-c656-jcx2-7pqj
    * GO-2026-5316 CVE-2026-45723 GHSA-c66c-vq6w-fvh5
    * GO-2026-5317 CVE-2026-55884 GHSA-c73q-8xxr-rgqm
    * GO-2026-5318 CVE-2026-34453 GHSA-c77m-r996-jr3q
    * GO-2026-5319 CVE-2026-40243 GHSA-c839-4qxr-j4x3
    * GO-2026-5321 CVE-2026-28744 GHSA-cc8w-r4qh-3v65
    * GO-2026-5322 CVE-2026-55170 GHSA-cf98-j28v-49v6
    * GO-2026-5323 CVE-2026-46612 GHSA-chf8-4hv6-8pg6
    * GO-2026-5324 CVE-2026-42595 GHSA-chwh-f6gm-r836
    * GO-2026-5325 CVE-2026-6340 GHSA-cjm8-jxpw-g43m
    * GO-2026-5326 CVE-2026-44327 GHSA-cmpj-2x3g-m7g3
    * GO-2026-5328 GHSA-cp79-9mwr-wr49
    * GO-2026-5329 CVE-2026-40303 GHSA-cpf9-ph2j-ccr9
    * GO-2026-5330 CVE-2026-48154 GHSA-cpwg-x64r-rgwg
    * GO-2026-5331 CVE-2026-35037 GHSA-cqgf-f4x7-g6wc
    * GO-2026-5332 CVE-2025-41117 GHSA-cqp7-wf4c-3xgc
    * GO-2026-5333 CVE-2026-44884 GHSA-cqpq-2fgr-8mvc
    * GO-2026-5334 CVE-2026-20706 GHSA-cr4g-f395-h25h
    * GO-2026-5335 CVE-2026-45803 GHSA-crc3-h8v6-qh57
    * GO-2026-5337 CVE-2026-41068 GHSA-cvq5-hhx3-f99p
    * GO-2026-5338 CVE-2026-50195 GHSA-cvxm-645q-p574
    * GO-2026-5339 CVE-2026-47701 GHSA-cxh2-4639-vmc5
    * GO-2026-5340 CVE-2026-42461 GHSA-cxx3-hr75-4q96
    * GO-2026-5341 CVE-2026-34454 GHSA-f24x-5g9q-753f
    * GO-2026-5343 CVE-2026-48496 GHSA-f2r5-5m7w-p5cx
    * GO-2026-5344 CVE-2026-46703 GHSA-f396-4rp4-7v2j
    * GO-2026-5345 CVE-2026-45046 GHSA-f3jg-756w-gm35
    * GO-2026-5347 CVE-2026-48709 GHSA-f637-w7p2-m7fx
    * GO-2026-5348 CVE-2026-42560 GHSA-f6qq-3m3h-4g42
    * GO-2026-5349 CVE-2026-44325 GHSA-f8qv-7x5w-qr48
    * GO-2026-5350 CVE-2026-25726 GHSA-f8xp-wvcx-p6f4
    * GO-2026-5351 CVE-2026-41323 GHSA-f9g8-6ppc-pqq4
    * GO-2026-5352 CVE-2026-55828 GHSA-f9m7-vc86-p6jj
    * GO-2026-5353 GHSA-fc67-c4hg-q653
    * GO-2026-5354 GHSA-fcmh-qfxc-w685
    * GO-2026-5355 CVE-2026-11769 GHSA-fcw4-wwqm-m8cf
    * GO-2026-5356 CVE-2026-40242 GHSA-ff24-4prj-gpmj
    * GO-2026-5357 CVE-2026-34585 GHSA-ff66-236v-p4fg
    * GO-2026-5358 CVE-2026-24899 GHSA-ffg9-j72f-j6xm
    * GO-2026-5359 CVE-2026-28377 GHSA-ffqx-q65f-36jf
    * GO-2026-5360 CVE-2026-27656 GHSA-fg35-5rf6-qg3g
    * GO-2026-5361 CVE-2026-6970 GHSA-fg3j-5w9g-hmg7
    * GO-2026-5362 CVE-2026-35597 GHSA-fgfv-pv97-6cmj
    * GO-2026-5363 CVE-2026-41413 GHSA-fgw5-hp8f-xfhc
    * GO-2026-5364 CVE-2026-40946 GHSA-fhvp-9hcj-6m33
    * GO-2026-5365 CVE-2026-22555 GHSA-fhx7-m96w-mv29
    * GO-2026-5366 CVE-2026-45683 GHSA-fjq3-ffvr-vm46
    * GO-2026-5367 CVE-2026-54319 GHSA-fjv8-j4p5-cr9m
    * GO-2026-5369 CVE-2026-8634 GHSA-fm77-94qm-4894
    * GO-2026-5370 CVE-2026-45148 GHSA-fmh9-gpqh-g53g
    * GO-2026-5371 GHSA-fmqp-4wfc-w3v7
    * GO-2026-5372 CVE-2026-35458 GHSA-fmwg-qcqh-m992
    * GO-2026-5373 CVE-2026-53999 GHSA-fp5j-4fj2-4jvq
    * GO-2026-5374 CVE-2026-41485 GHSA-fpjq-c37h-cqcv
    * GO-2026-5375 GHSA-fpw6-hrg5-q5x5
    * GO-2026-5376 CVE-2026-45713 GHSA-fpxj-m5q8-fphw
    * GO-2026-5377 CVE-2026-42876 GHSA-fq7h-9x26-6j22
    * GO-2026-5378 CVE-2026-46680 GHSA-fqw6-gf59-qr4w
    * GO-2026-5379 CVE-2026-49343 GHSA-fw38-pc54-jvx9
    * GO-2026-5381 CVE-2026-44903 GHSA-fw8g-cg8f-9j28
    * GO-2026-5382 GHSA-fwg7-53p4-g33c
    * GO-2026-5383 CVE-2026-44542 GHSA-fwj3-42wh-8673
    * GO-2026-5384 CVE-2026-41647 GHSA-fwj8-62r8-8p8m
    * GO-2026-5385 CVE-2026-45728 GHSA-fwqx-8365-9983
    * GO-2026-5386 CVE-2026-8779 GHSA-fxvj-wqv2-xgcq
    * GO-2026-5387 CVE-2026-52805 GHSA-g2f5-gjr4-qjvm
    * GO-2026-5388 CVE-2026-34969 GHSA-g2qj-prgh-4g9r
    * GO-2026-5389 CVE-2026-44522 GHSA-g49p-4qxj-88v3
    * GO-2026-5390 GHSA-g53w-w6mj-hrpp
    * GO-2026-5391 CVE-2026-55669 GHSA-g5h5-m4hm-xjrr
    * GO-2026-5392 CVE-2026-46695 GHSA-g6ww-w5j2-r7x3
    * GO-2026-5393 CVE-2026-4274 GHSA-g7fp-cqj5-x8hf
    * GO-2026-5394 CVE-2026-35392 GHSA-g8mv-vp7j-qp64
    * GO-2026-5395 CVE-2026-42597 GHSA-g924-cjx7-2rjw
    * GO-2026-5396 CVE-2026-40246 GHSA-g9cw-qwhf-24jp
    * GO-2026-5397 CVE-2026-40195 GHSA-gc7j-g665-rxr9
    * GO-2026-5398 CVE-2024-53412 GHSA-ggmw-mjhv-75rm
    * GO-2026-5399 GHSA-ghmh-jhmj-wcmf
    * GO-2026-5400 CVE-2026-41520 GHSA-gj49-89wh-h4gj
    * GO-2026-5401 CVE-2026-46430 GHSA-gj84-924c-48fx
    * GO-2026-5402 CVE-2026-45371 GHSA-gmmv-4cc5-wr9r
    * GO-2026-5403 CVE-2026-6634 GHSA-gqp3-hfc3-8q54
    * GO-2026-5404 CVE-2026-4286 GHSA-gvg4-jhmr-6j23
    * GO-2026-5405 CVE-2026-4370 GHSA-gvrj-cjch-728p
    * GO-2026-5406 CVE-2026-55636 GHSA-gwxr-7h77-7777
    * GO-2026-5407 CVE-2026-40249 GHSA-gx38-8h33-pmxr
    * GO-2026-5409 CVE-2026-33380 GHSA-gxcp-jjxh-rwp4
    * GO-2026-5411 CVE-2026-54093 GHSA-gxjx-7m74-hcq8
    * GO-2026-5412 CVE-2026-42221 GHSA-h27v-ph7w-m9fp
    * GO-2026-5413 GHSA-h5fq-653g-gxrm
    * GO-2026-5414 CVE-2026-34828 GHSA-h5j9-cvrw-v5qh
    * GO-2026-5415 CVE-2026-39414 GHSA-h749-fxx7-pwpg
    * GO-2026-5416 GHSA-h829-5cg7-6hff
    * GO-2026-5417 CVE-2026-33489 GHSA-h8mm-c463-wjq3
    * GO-2026-5418 CVE-2026-45738 GHSA-h98r-wv3h-fr38
    * GO-2026-5419 CVE-2026-40109 GHSA-h9cx-xjg6-5v2w
    * GO-2026-5420 GHSA-h9mw-h4qc-f5jf
    * GO-2026-5421 CVE-2026-33414 GHSA-hc8w-h2mf-hp59
    * GO-2026-5422 CVE-2026-42575 GHSA-hcwr-pq9g-rq3m
    * GO-2026-5423 CVE-2026-55689 GHSA-hcxc-wf8j-23hv
    * GO-2026-5424 CVE-2026-52879 GHSA-hf2g-6j7h-98wg
    * GO-2026-5425 GHSA-hfc8-w5f4-3x6m
    * GO-2026-5428 CVE-2026-35596 GHSA-hj5c-mhh2-g7jq
    * GO-2026-5429 CVE-2026-41894 GHSA-hjh7-r5w8-5872
    * GO-2026-5430 CVE-2026-47203 GHSA-hjj4-hfjm-fmrj
    * GO-2026-5431 GHSA-hm2h-wwwh-g49x
    * GO-2026-5432 CVE-2026-4273 GHSA-hqpj-f3jh-29vx
    * GO-2026-5433 CVE-2026-42283 GHSA-hqwm-7x7x-8379
    * GO-2026-5434 CVE-2026-39901 GHSA-hqxq-hwqf-wg83
    * GO-2026-5436 CVE-2026-47252 GHSA-hrj8-hjv8-mgwc
    * GO-2026-5437 CVE-2026-41145 GHSA-hv4r-mvr4-25vw
    * GO-2026-5438 CVE-2026-6290 GHSA-hv5g-26jg-pc45
    * GO-2026-5439 CVE-2026-47124 GHSA-hvv7-hfrh-7gxj
    * GO-2026-5440 CVE-2026-46431 GHSA-hw27-4v2q-5qff
    * GO-2026-5441 GHSA-hw5x-4r37-72w7
    * GO-2026-5442 CVE-2026-4053 GHSA-hw87-6jcq-9f8q
    * GO-2026-5443 CVE-2026-44829 GHSA-hwc4-gmrw-5222
    * GO-2026-5444 CVE-2026-39972 GHSA-hwr4-mq23-wcv5
    * GO-2026-5445 CVE-2026-7474 GHSA-hx53-77qj-8663
    * GO-2026-5446 CVE-2026-45709 GHSA-j3fj-qppj-fmmc
    * GO-2026-5447 CVE-2026-44322 GHSA-j59f-x285-69jx
    * GO-2026-5448 CVE-2026-25779 GHSA-j5r2-4c8j-xc3m
    * GO-2026-5449 CVE-2026-44985 GHSA-j643-x8pv-8m67
    * GO-2026-5450 CVE-2026-6383 GHSA-j6cv-3w8p-vrg8
    * GO-2026-5451 CVE-2025-68152 GHSA-j6f6-jp3p-53mw
    * GO-2026-5453 CVE-2026-44424 GHSA-j72x-xfwg-783f
    * GO-2026-5454 CVE-2026-4054 GHSA-j76w-p754-g2w7
    * GO-2026-5455 CVE-2026-24000 GHSA-j8h8-75h3-jg53
    * GO-2026-5456 CVE-2026-45685 GHSA-j8p6-96vp-f3r9
    * GO-2026-5457 CVE-2026-48050 GHSA-j93g-rp6m-j32m
    * GO-2026-5458 CVE-2026-54091 GHSA-j9jx-hp4c-ghhh
    * GO-2026-5459 CVE-2026-47253 GHSA-j9rx-rppg-6hh4
    * GO-2026-5460 CVE-2026-48126 GHSA-jc3j-x6pg-4hmv
    * GO-2026-5461 CVE-2026-46403 GHSA-jc6w-wmfc-fh33
    * GO-2026-5462 CVE-2026-42294 GHSA-jcc8-g2q4-9fxq
    * GO-2026-5464 GHSA-jf2q-463c-6f52
    * GO-2026-5465 CVE-2026-40091 GHSA-jf4f-rr2c-9m58
    * GO-2026-5467 GHSA-jfwg-rxf3-p7r9
    * GO-2026-5468 CVE-2026-35393 GHSA-jg56-wf8x-qrv5
    * GO-2026-5469 CVE-2026-34581 GHSA-jgfx-74g2-9r6g
    * GO-2026-5470 CVE-2026-40248 GHSA-jgq2-qv8v-5cmj
    * GO-2026-5472 CVE-2026-47680 GHSA-jjrm-hr5f-673x
    * GO-2026-5473 CVE-2026-41645 GHSA-jm34-66cf-qpvr
    * GO-2026-5474 CVE-2026-6334 GHSA-jp3f-x449-4q75
    * GO-2026-5475 CVE-2026-47262 GHSA-jpcc-p29g-p8mq
    * GO-2026-5476 CVE-2026-47125 GHSA-jpjh-jm2p-39hh
    * GO-2026-5477 CVE-2026-52798 GHSA-jq8v-rmf6-65jw
    * GO-2026-5478 CVE-2026-44324 GHSA-jqfc-gwj5-3w63
    * GO-2026-5479 CVE-2026-40883 GHSA-jrq5-hg6x-j6g3
    * GO-2026-5480 CVE-2026-44883 GHSA-jvp4-q659-95mj
    * GO-2026-5481 CVE-2026-35585 GHSA-jvpw-637p-h3pw
    * GO-2026-5482 CVE-2026-40343 GHSA-jwch-w7wh-gqjm
    * GO-2026-5483 CVE-2026-34972 GHSA-jwvj-g8pc-cx45
    * GO-2026-5484 CVE-2026-3495 GHSA-jx93-pf6x-874r
    * GO-2026-5485 GHSA-m23h-6mwm-39m8
    * GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
    * GO-2026-5487 CVE-2026-3605 GHSA-m2w4-8ggf-rj47
    * GO-2026-5489 CVE-2026-2325 GHSA-m3p3-8frq-q7qh
    * GO-2026-5491 CVE-2026-46377 GHSA-m5j3-4634-c2vq
    * GO-2026-5493 CVE-2026-46378 GHSA-m6xr-fvfg-5g64
    * GO-2026-5494 CVE-2026-6343 GHSA-m79q-8qf5-v622
    * GO-2026-5495 CVE-2026-28741 GHSA-m7cf-4gh2-v4qg
    * GO-2026-5497 CVE-2026-42576 GHSA-m7hm-vm4x-28jf
    * GO-2026-5499 CVE-2026-45730 GHSA-m8xg-8xg9-mxhm
    * GO-2026-5500 CVE-2026-55185 GHSA-m999-j542-5w3r
    * GO-2026-5501 CVE-2025-41118 GHSA-m9hq-h476-h2g8
    * GO-2026-5502 CVE-2026-44474 GHSA-mc29-hmx6-856q
    * GO-2026-5505 CVE-2026-44882 GHSA-mgq6-4x29-88r3
    * GO-2026-5507 CVE-2026-3590 GHSA-mh4x-rmrx-3hp4
    * GO-2026-5508 GHSA-mhc4-qq83-fmrr
    * GO-2026-5509 CVE-2026-5467 GHSA-mj24-pqx2-6788
    * GO-2026-5510 CVE-2026-26231 GHSA-mm7c-rhg6-qr4r
    * GO-2026-5511 GHSA-mmpx-jh39-wrv6
    * GO-2026-5512 CVE-2026-3115 GHSA-mpc7-mm28-f6wq
    * GO-2026-5514 CVE-2026-46668 GHSA-mqcf-gqvg-rmhm
    * GO-2026-5515 CVE-2026-48031 GHSA-mqq6-462x-jxmm
    * GO-2026-5517 CVE-2026-55775 GHSA-mwr2-wmgp-crj6
    * GO-2026-5519 GHSA-mxg3-432p-mr72
    * GO-2026-5520 CVE-2026-46356 GHSA-mxmp-wr3w-rvqx
    * GO-2026-5521 CVE-2026-42222 GHSA-mxqh-q9h6-v8pq
    * GO-2026-5522 CVE-2026-27769 GHSA-mxxh-fmjq-j6x4
    * GO-2026-5523 CVE-2026-47735 GHSA-p2j4-c4g6-rpf5
    * GO-2026-5524 CVE-2026-25773 GHSA-p32q-v29x-wq9r
    * GO-2026-5526 CVE-2026-40264 GHSA-p49j-v9wc-wg57
    * GO-2026-5527 CVE-2026-42183 GHSA-p4gq-3vxj-f4jq
    * GO-2026-5528 CVE-2026-21728 GHSA-p4r4-xvrq-gvmc
    * GO-2026-5530 CVE-2026-40265 GHSA-p5w6-75f9-cc2p
    * GO-2026-5531 GHSA-p64j-f4x9-wq66
    * GO-2026-5533 CVE-2026-55882 GHSA-p749-9w62-w533
    * GO-2026-5534 CVE-2026-45327 GHSA-p7c4-8x34-8j8f
    * GO-2026-5535 CVE-2026-5469 GHSA-p8c7-hjc4-gwf8
    * GO-2026-5536 CVE-2026-52799 GHSA-p9f5-h3rx-j5qw
    * GO-2026-5537 CVE-2026-44328 GHSA-p9mg-74mg-cwwr
    * GO-2026-5538 CVE-2025-71261 GHSA-pgh9-mpwc-8jjf
    * GO-2026-5539 CVE-2026-45678 GHSA-pgvv-q3wf-mm9m
    * GO-2026-5540 CVE-2026-39846 GHSA-phhp-9rm9-6gr2
    * GO-2026-5541 GHSA-pj6q-4vq4-r8cg
    * GO-2026-5544 CVE-2026-42602 GHSA-pjv4-3c63-699f
    * GO-2026-5545 CVE-2026-52797 GHSA-pm6v-2h4w-4rp2
    * GO-2026-5546 CVE-2026-40945 GHSA-pm7q-rjjx-979p
    * GO-2026-5547 GHSA-pmwq-pjrm-6p5r
    * GO-2026-5549 CVE-2026-40910 GHSA-pq96-pwvg-vrr9
    * GO-2026-5550 CVE-2025-52490 GHSA-pqhp-4xfc-hjgq
    * GO-2026-5551 CVE-2026-39087 GHSA-pqhx-w72w-m393
    * GO-2026-5552 CVE-2026-53541 GHSA-prj9-97mp-mwh2
    * GO-2026-5553 GHSA-prxj-3gcv-cqrh
    * GO-2026-5554 CVE-2026-44475 GHSA-pwfh-mqp3-pqwj
    * GO-2026-5555 CVE-2026-44349 GHSA-pwqg-q8pg-pp6r
    * GO-2026-5556 CVE-2026-52800 GHSA-pwx3-qcgw-vh7h
    * GO-2026-5557 CVE-2026-41571 GHSA-pxf8-6wqm-r6hh
    * GO-2026-5558 GHSA-pxh5-6rrc-8rjv
    * GO-2026-5559 CVE-2026-41059 GHSA-pxq7-h93f-9jrg
    * GO-2026-5560 CVE-2026-43644 GHSA-q23m-vm9r-5745
    * GO-2026-5561 CVE-2026-45627 GHSA-q2pj-8v84-9mh5
    * GO-2026-5562 CVE-2026-29051 GHSA-q2pw-xx38-p64j
    * GO-2026-5563 CVE-2026-41326 GHSA-q49m-57vm-c8cc
    * GO-2026-5564 CVE-2026-4740 GHSA-q4gv-pjmh-c735
    * GO-2026-5565 CVE-2026-42223 GHSA-q4w7-56hr-83rm
    * GO-2026-5567 CVE-2026-44523 GHSA-q6mh-rqwh-g786
    * GO-2026-5568 CVE-2026-55686 GHSA-q6r4-3wmg-fwcq
    * GO-2026-5571 GHSA-q7j3-v8qv-22vq
    * GO-2026-5572 CVE-2026-40281 GHSA-q7r4-hc83-hf2q
    * GO-2026-5573 CVE-2026-45760 GHSA-q8ch-jx67-q52x
    * GO-2026-5574 CVE-2026-46358 GHSA-q8cj-789h-vg24
    * GO-2026-5575 CVE-2026-40868 GHSA-q93q-v844-jrqp
    * GO-2026-5577 CVE-2026-44245 GHSA-q98m-7w8c-w388
    * GO-2026-5578 CVE-2026-5724 GHSA-q98v-9f9w-f49q
    * GO-2026-5579 CVE-2026-34992 GHSA-qcmw-8mm4-4p28
    * GO-2026-5580 CVE-2026-52806 GHSA-qf6p-p7ww-cwr9
    * GO-2026-5581 CVE-2026-44473 GHSA-qfxw-v8qx-vj3v
    * GO-2026-5582 CVE-2026-35602 GHSA-qh78-rvg3-cv54
    * GO-2026-5583 CVE-2026-33190 GHSA-qhmp-q7xh-99rh
    * GO-2026-5584 CVE-2026-22872 GHSA-qjjm-7j9w-pw72
    * GO-2026-5586 CVE-2026-47726 GHSA-qm33-p5p9-f8vg
    * GO-2026-5587 GHSA-qmwh-9m9c-h36m
    * GO-2026-5588 CVE-2026-38651 GHSA-qpv2-rwc8-c993
    * GO-2026-5589 CVE-2026-42574 GHSA-qq3r-w4hj-gjp6
    * GO-2026-5590 CVE-2026-45152 GHSA-qqq4-5773-pmw5
    * GO-2026-5591 CVE-2026-48777 GHSA-qqqm-5547-774x
    * GO-2026-5594 GHSA-qr4g-8hrp-c4rw
    * GO-2026-5598 CVE-2026-54324 GHSA-qwxf-2m7m-2m3x
    * GO-2026-5599 CVE-2026-45711 GHSA-qx5x-85p8-vg4j
    * GO-2026-5600 CVE-2026-54322 GHSA-qxvm-pcfm-qc39
    * GO-2026-5601 CVE-2026-11401 GHSA-r236-5pc3-3qcp
    * GO-2026-5602 CVE-2026-34984 GHSA-r2pg-r6h7-crf3
    * GO-2026-5603 GHSA-r2x7-427f-rq69
    * GO-2026-5604 CVE-2026-55887 GHSA-r2xf-7jw5-pjg6
    * GO-2026-5605 CVE-2026-42594 GHSA-r33j-c622-r6qp
    * GO-2026-5607 CVE-2026-44430 GHSA-r48c-v28r-pf6v
    * GO-2026-5608 CVE-2026-35599 GHSA-r4fg-73rc-hhh7
    * GO-2026-5609 CVE-2026-39396 GHSA-r65v-xgwc-g56j
    * GO-2026-5610 CVE-2026-45681 GHSA-r6c9-g6q5-qrf9
    * GO-2026-5611 CVE-2026-33467 GHSA-r727-5pf6-47r2
    * GO-2026-5612 CVE-2026-40197 GHSA-r7w7-mmxr-47r9
    * GO-2026-5613 CVE-2026-41136 GHSA-r99v-75p9-xqm5
    * GO-2026-5614 GHSA-rc6v-5rmx-w5mv
    * GO-2026-5615 GHSA-rf84-wr5g-m3rp
    * GO-2026-5616 CVE-2026-42882 GHSA-rfgq-wgg8-662p
    * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
    * GO-2026-5618 CVE-2026-45737 GHSA-rg3g-4rw9-gqrp
    * GO-2026-5619 CVE-2025-70950 GHSA-rg3p-p27c-2f39
    * GO-2026-5620 CVE-2026-44594 GHSA-rg65-45m7-hq57
    * GO-2026-5621 CVE-2026-4789 GHSA-rggm-jjmc-3394
    * GO-2026-5622 CVE-2026-53489 GHSA-rgh6-rfwx-v388
    * GO-2026-5623 GHSA-rgj7-vg8v-j4wr
    * GO-2026-5624 GHSA-rh99-wc69-c255
    * GO-2026-5625 CVE-2026-42091 GHSA-rhf7-wvw3-vjvm
    * GO-2026-5626 GHSA-rj4g-rqgh-rx9h
    * GO-2026-5627 CVE-2026-42591 GHSA-rm4c-xj6x-49mw
    * GO-2026-5628 CVE-2026-52878 GHSA-rm5c-5x2p-48wr
    * GO-2026-5629 CVE-2026-27659 GHSA-rmhw-c3xr-m3xx
    * GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
    * GO-2026-5631 GHSA-rp7v-4384-hfrp
    * GO-2026-5632 CVE-2026-42571 GHSA-rpfr-x88x-xwcw
    * GO-2026-5633 CVE-2026-44881 GHSA-rpgq-m5fp-32wr
    * GO-2026-5634 CVE-2026-27806 GHSA-rphv-h674-5hp2
    * GO-2026-5635 CVE-2026-48058 GHSA-rqfj-vv8r-xhqc
    * GO-2026-5636 CVE-2026-42589 GHSA-rqgh-gxv4-6657
    * GO-2026-5637 CVE-2026-44429 GHSA-rqv2-m695-f8j4
    * GO-2026-5638 CVE-2026-44210 GHSA-rr59-xxvx-96qr
    * GO-2026-5639 CVE-2026-44848 GHSA-rrmm-9v76-h3p4
    * GO-2026-5640 CVE-2026-41422 GHSA-rw2c-8rfq-gwfv
    * GO-2026-5641 CVE-2026-44982 GHSA-rw47-hm26-6wr7
    * GO-2026-5642 CVE-2026-44330 GHSA-rwww-x45w-p52w
    * GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
    * GO-2026-5644 CVE-2026-34448 GHSA-rx4h-526q-4458
    * GO-2026-5645 CVE-2026-47120 GHSA-rxf6-wjh4-jfj6
    * GO-2026-5646 GHSA-rxmp-8h9v-56cx
    * GO-2026-5647 CVE-2026-44319 GHSA-rxrq-fv76-26pr
    * GO-2026-5648 CVE-2026-44671 GHSA-rxvx-hhpj-q6px
    * GO-2026-5649 CVE-2026-45087 GHSA-v25v-m36w-jp4h
    * GO-2026-5650 CVE-2026-40103 GHSA-v479-vf79-mg83
    * GO-2026-5651 CVE-2026-3637 GHSA-v549-xx3c-6pc8
    * GO-2026-5652 CVE-2026-42339 GHSA-v5c3-6wvc-pc2q
    * GO-2026-5653 GHSA-v5mh-h5hx-7v92
    * GO-2026-5654 CVE-2026-40481 GHSA-v7xq-3wx6-fqc2
    * GO-2026-5656 CVE-2026-44514 GHSA-v8j7-hp7c-738f
    * GO-2026-5657 CVE-2026-45808 GHSA-v8v8-cm84-m686
    * GO-2026-5658 CVE-2026-44427 GHSA-v8vw-gw5j-w7m6
    * GO-2026-5659 CVE-2026-35604 GHSA-v9w4-gm2x-6rvf
    * GO-2026-5661 CVE-2026-52807 GHSA-vcm5-gvmp-78mp
    * GO-2026-5662 CVE-2026-40179 GHSA-vffh-x6r8-xx99
    * GO-2026-5663 CVE-2026-3114 GHSA-vhgh-g7x8-4rx8
    * GO-2026-5664 GHSA-vjgj-42f6-7997
    * GO-2026-5667 CVE-2026-35579 GHSA-vp29-5652-4fw9
    * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5
    * GO-2026-5669 CVE-2026-45742 GHSA-vp73-vjw8-8f32
    * GO-2026-5670 CVE-2026-28736 GHSA-vph7-r229-qxpf
    * GO-2026-5671 CVE-2026-6333 GHSA-vqp5-2mrp-qqxg
    * GO-2026-5672 CVE-2026-49397 GHSA-vrmh-5mmx-hjwx
    * GO-2026-5673 CVE-2026-42082 GHSA-vrrx-58h3-prmh
    * GO-2026-5674 CVE-2026-42186 GHSA-vv66-6rp4-wr4f
    * GO-2026-5677 CVE-2026-45684 GHSA-vvmg-8mjr-g6q3
    * GO-2026-5678 GHSA-vw82-7fv8-r6gp
    * GO-2026-5679 CVE-2026-40318 GHSA-vw86-c94w-v3x4
    * GO-2026-5680 CVE-2026-44426 GHSA-vwx9-7qcf-gg7f
    * GO-2026-5682 CVE-2026-46370 GHSA-vxm7-9x8v-8gm4
    * GO-2026-5683 CVE-2026-44544 GHSA-vxvc-cg7j-rwqj
    * GO-2026-5685 CVE-2026-47249 GHSA-w342-mj6g-v9c4
    * GO-2026-5686 CVE-2026-52880 GHSA-w4c6-7r69-w7j9
    * GO-2026-5687 CVE-2026-46717 GHSA-w4g9-mxgg-j532
    * GO-2026-5688 CVE-2026-55187 GHSA-w4mc-hhc6-xp28
    * GO-2026-5689 CVE-2026-45712 GHSA-w4vj-r5pg-3722
    * GO-2026-5690 CVE-2026-55701 GHSA-w5cv-pw74-4rxc
    * GO-2026-5691 CVE-2026-54092 GHSA-w5fm-68j4-fpc4
    * GO-2026-5692 CVE-2026-5412 GHSA-w5fq-8965-c969
    * GO-2026-5694 CVE-2026-39395 GHSA-w6c6-c85g-mmv6
    * GO-2026-5695 CVE-2026-25119 GHSA-w6j9-vw59-27wv
    * GO-2026-5696 CVE-2026-40263 GHSA-w6m9-39cv-2fwp
    * GO-2026-5697 CVE-2026-5468 GHSA-w799-7525-rpr6
    * GO-2026-5698 CVE-2026-47723 GHSA-w7w5-5gcp-38rw
    * GO-2026-5701 GHSA-w8jj-cwmc-wgq2
    * GO-2026-5702 CVE-2026-40107 GHSA-w95v-4h65-j455
    * GO-2026-5703 CVE-2026-8462 GHSA-wc3v-3457-c8cm
    * GO-2026-5704 CVE-2026-35036 GHSA-wc4h-2348-jc3p
    * GO-2026-5705 GHSA-wcmj-x466-56mm
    * GO-2026-5706 CVE-2026-11718 GHSA-wcpr-6g7x-p44r
    * GO-2026-5708 CVE-2026-33381 GHSA-wfhv-mj62-f5xh
    * GO-2026-5709 GHSA-wfqx-gjrf-g28r
    * GO-2026-5710 CVE-2026-42151 GHSA-wg65-39gg-5wfj
    * GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
    * GO-2026-5712 CVE-2026-52810 GHSA-wmfg-5p4h-5fw3
    * GO-2026-5714 CVE-2026-45676 GHSA-wp73-mwgf-4jq9
    * GO-2026-5715 CVE-2026-47215 GHSA-wqcr-7rf3-f64m
    * GO-2026-5716 CVE-2026-42541 GHSA-wqcw-g35j-j578
    * GO-2026-5717 CVE-2026-44320 GHSA-wqfh-gq79-j8mf
    * GO-2026-5718 CVE-2026-8052 GHSA-wqwc-x3rc-2xw6
    * GO-2026-5719 CVE-2026-44015 GHSA-wr32-99hh-6f35
    * GO-2026-5720 CVE-2026-44316 GHSA-wr8j-6chw-gm6p
    * GO-2026-5721 CVE-2026-24791 GHSA-wrr5-99h5-gq57
    * GO-2026-5722 CVE-2026-40245 GHSA-wrwh-rpq4-87hf
    * GO-2026-5723 CVE-2026-42875 GHSA-wv26-88m5-6h59
    * GO-2026-5724 CVE-2026-52801 GHSA-wv27-2vqp-j7g5
    * GO-2026-5725 CVE-2026-45726 GHSA-wv8c-6mx2-xf4j
    * GO-2026-5726 CVE-2026-28732 GHSA-wvcv-9xpm-7mqc
    * GO-2026-5727 CVE-2026-6345 GHSA-wvgv-4fc3-2rcp
    * GO-2026-5728 CVE-2026-40189 GHSA-wvhv-qcqf-f3cx
    * GO-2026-5729 CVE-2026-54321 GHSA-ww63-pv5x-vfc8
    * GO-2026-5731 CVE-2026-44317 GHSA-wwqh-7jm5-gj7w
    * GO-2026-5732 GHSA-wxg7-w2v3-w38g
    * GO-2026-5733 CVE-2026-33031 GHSA-x234-x5vq-cc2v
    * GO-2026-5734 CVE-2026-21388 GHSA-x274-8qfc-hrgf
    * GO-2026-5735 CVE-2026-32885 GHSA-x2xq-qhjf-5mvg
    * GO-2026-5737 GHSA-x3f4-v83f-7wp2
    * GO-2026-5738 CVE-2026-41246 GHSA-x4mj-7f9g-29h4
    * GO-2026-5739 CVE-2026-46371 GHSA-x4qr-qw6h-wvxq
    * GO-2026-5741 CVE-2026-40247 GHSA-x5r2-r74c-3w28
    * GO-2026-5742 CVE-2026-41684 GHSA-x5r6-jr56-89pv
    * GO-2026-5744 CVE-2026-26062 GHSA-x67p-9m2r-fxqv
    * GO-2026-5745 GHSA-x845-2f78-7v36
    * GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
    * GO-2026-5747 CVE-2026-34528 GHSA-x8jc-jvqm-pm3f
    * GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
    * GO-2026-5751 CVE-2026-42297 GHSA-xchc-cqwg-g76q
    * GO-2026-5752 CVE-2026-48020 GHSA-xf64-8mw2-4gr2
    * GO-2026-5753 CVE-2026-41432 GHSA-xff3-5c9p-2mr4
    * GO-2026-5754 CVE-2026-34530 GHSA-xfqj-3vmx-63wv
    * GO-2026-5755 CVE-2026-10720 GHSA-xg3j-c7q4-f9ph
    * GO-2026-5756 CVE-2026-47703 GHSA-xgx4-4h9w-53pv
    * GO-2026-5757 CVE-2026-42600 GHSA-xh8f-g2qw-gcm7
    * GO-2026-5758 CVE-2026-53488 GHSA-xhf5-7wjv-pqxp
    * GO-2026-5759 GHSA-xhj4-g6w8-2xjw
    * GO-2026-5760 CVE-2026-41174 GHSA-xhjw-95fp-8vgq
    * GO-2026-5763 CVE-2026-39984 GHSA-xm5m-wgh2-rrg3
    * GO-2026-5765 CVE-2026-52814 GHSA-xp79-5mx3-jx52
    * GO-2026-5766 CVE-2026-5199 GHSA-xpg8-3hhp-p7w8
    * GO-2026-5767 CVE-2026-4531 GHSA-xq44-64rg-8g3h
    * GO-2026-5768 CVE-2026-55672 GHSA-xqxv-4jc2-x56x
    * GO-2026-5769 CVE-2026-6339 GHSA-xvcx-mgpc-5xh3
    * GO-2026-5770 CVE-2026-34762 GHSA-xw45-cc32-442f
    * GO-2026-5771 CVE-2026-34742 GHSA-xw59-hvm2-8pj6
    * GO-2026-5772 CVE-2026-45721 GHSA-xwcr-wm99-g9jc
    * GO-2026-5773 CVE-2026-52802 GHSA-xxhq-69mf-w8cr
    * GO-2026-5776 GHSA-r4v7-6wcg-ghj5

++++ graphviz:

  - Remove stale ocaml support, fix disable java support

++++ graphviz-addons:

  - Remove stale ocaml support, fix disable java support

++++ graphviz-qt6:

  - Remove stale ocaml support, fix disable java support

++++ gssproxy:

  - Add package runtime requirement to libverto-module-base (bsc#1268795)
    Require libverto-module-base so that at least one of the event loop
    backend implementations will be installed alongside the package,
    otherwise gssproxy cannot start without explicitly installing the
    libverto-libev1 package.
  - Update to 0.9.2
  - Added upstream patches to address libini compilation issues:
    * Remove-unneeded-include-in-configure-script.patch
    * Don-t-check-for-libref_array-explicitly.patch
    * Fix-cross-compilation.patch
  - Added upstream patch to address failing failing tests
    * gssproxy-Modernize-systemd.m4-macro.patch
  - Updated systemd service hardening patch to match upstream
    * harden_gssproxy.service.patch

++++ gvfs:

  - Update to version 1.60.1:
    + smb: Fix authentication fallback broken with Samba 4.24
    + dav: Fix redirect handling to prevent HTTPS downgrade and
    credential leakage
    + Some other fixes
    + Updated translations.
  - Drop gvfs-fix-udisks2-crash.patch: Fixed upstream.

++++ gvisor-tap-vsock:

  - Update to version 0.8.9:
    * fix: ensure IPV4Broadcast check remains for UDP
    * doc: clarify ec2-metadata-access setting
    * fix: apply ec2MetadataAccess bypass to UDP forwarder for link-local traffic
    * build(deps): bump github.com/apparentlymart/go-cidr from 1.1.0 to 1.1.1
    * unixgram transport: build for all Unix(-like) platforms again - can be used by libkrun on Linux
    * build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0
    * Fix issue where udp_proxy enters a tight loop polling the socket if the read returns 0 with err = nil.
    * build(deps): bump golang.org/x/mod from 0.34.0 to 0.35.0
    * Remove duplicate check for `log-file`
    * Fix support for 'log-file' arg
    * test: Reword failure message
    * build(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0
    * build(deps): bump github.com/golangci/golangci-lint/v2 in /tools
    * build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0
    * build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0
    * build(deps): bump github.com/coreos/stream-metadata-go
    * build(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0
    * ci: drop Go 1.24 from build matrix; align artifact upload with 1.25.x
    * build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    * fix(gvproxy): propagate --listen-stdio flag into config
    * build(deps): bump actions/upload-artifact from 6 to 7
    * gvproxy: Fix --log-file having no effect
    * build(deps): bump golang.org/x/mod from 0.32.0 to 0.33.0
    * build(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0

++++ haproxy:

  - Update to version 3.4.1+git0.3e888a769:
    * [RELEASE] Released version 3.4.1
  - Update to version 6344dfa:
    * MINOR: otel: test: documented the context name header prefix in fe/be tests
    * BUG/MINOR: otel: fixed the inject '-' autoname and its header prefix
    * CLEANUP: otel: cast discarded prune_acl/pool_destroy returns to void
    * MINOR: otel: returned ERR_WARN from the scope location checks
    * DOC: otel: reconciled the README manual with the keyword reference
    * DOC: otel: corrected the inline-link limit in the span reference
    * DOC: otel: documented the metric create/update value-binding model
    * MINOR: otel: demoted advisory config diagnostics to warnings
    * MINOR: otel: waited for in-progress instrument creation before recording
    * MINOR: otel: coerced string instrument values, warning only on failure
    * MINOR: otel: unified the configuration parser checks and messages
    * MINOR: otel: guarded flt_otel_pool_alloc against oversize requests
    * DOC: otel: corrected the pool-allocator and ACL-resolution descriptions
  - Update to version 3.4.0+git43.e5221ba2b:
    * BUG/MEDIUM: mux-quic: Drain the given amount of data in qcs_http_reset_buf()
    * BUG/MEDIUM: mux-spop: Truly drain outgoing data when the stream is closed
    * BUG/MEDIUM: mux-h2: Truly drain outgoing HTX data when the stream is closed
    * BUG/MEDIUM: mux-fcgi: Truly drain outgoing HTX data when the stream is closed
    * REGTESTS: quic: test H3 request without content-length
    * BUG/MEDIUM: h3: increment unknown request payload length
    * DOC: lua: remove incorrect init tags
    * BUG/MINOR: hq-interop: support response buffer wrapping
    * BUG/MINOR: hq-interop: support full demux buf on large response
    * BUG/MEDIUM: hlua: Properly report EOS when http applet exits
    * BUG/MINOR: hq-interop: prevent reset if missing content-length
    * BUG/MINOR: hq-interop: reject too big content

++++ jackson-annotations:

  - Update to 2.18.8
    * No changes since 2.17.3

++++ jackson-bom:

  - Update to 2.18.8
    * Changes
    + #68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x
    to help junit5 migration
    + 'base/pom.xml' now creates '${project.version.underscore}' for
    "cleansed" version of '${project.version}'

++++ jackson-core:

  - Update to 2.18.8
    * Changes of 2.18.8
    + #1611: Apply number-length validator on streaming integer path
    of async parser
    * Changes of 2.18.7
    + #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
    .getMaxDocumentLength()' set
    (bsc#1268603, GHSA-2m67-wjpj-xhg9)
    + #1600: Rework 3rd party licenses in jar
    + #1602: 'UTF8DataInputJsonParser' needs to enforce
    'StreamReadConstraints.maxNameLength' limit
    * Changes of 2.18.6
    + #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
    + #1548: 'StreamReadConstraints.maxDocumentLength' not checked
    when creating parser with fixed buffer
    + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
    non-blocking (async) parser
    * Changes of 2.18.5
    + #1433: 'JsonParser#getNumberType()' throws
    'JsonParseException' when the current token is non-numeric
    instead of returning null
    + #1446: Invalid package reference to "java.lang.foreign" from
    'com.fasterxml.jackson.core:jackson-core' (from
    'FastDoubleParser')
    * Changes of 2.18.3
    + #1391: Fix issue where the parser can read back old number
    state when parsing later numbers
    + #1397: Jackson changes additional values to infinite in case
    of special JSON structures and existing infinite values
    + #1398: Fix issue that feature
    COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
    characterEscape is used
    * Changes of 2.18.2
    + #1359: Non-surrogate characters being incorrectly combined
    when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
    enabled
    * Changes of 2.18.1
    + #1353: Use fastdoubleparser 1.0.90
    * Changes of 2.18.
    + #223: 'UTF8JsonGenerator' writes supplementary characters as a
    surrogate pair: should use 4-byte encoding
    + #1230: Improve performance of 'float' and 'double' parsing
    from 'TextBuffer'
    + #1251: 'InternCache' replace synchronized with 'ReentrantLock'
  - the cache size limit is no longer strictly enforced for
    performance reasons but we should never go far about the limit
    + #1252: 'ThreadLocalBufferManager' replace synchronized with
    'ReentrantLock'
    + #1257: Increase InternCache default max size from 100 to 200
    + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
    + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
    classes to prevent use by downstream consumers
    + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
    from 3.0)
    + #1274: 'NUL'-corrupted keys, values on JSON serialization
    + #1277: Add back Java 22 optimisation in FastDoubleParser
    + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
    /getDecimalValue()' to avoid String allocation
    + #1305: Make helper methods of 'WriterBasedJsonGenerator'
    non-final to allow overriding
    + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
    limit maximum number of Tokens allowed per document#
    + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
    decoding proble
  - Modified patch:
    * 0001-Remove-ch.randelshofer.fastdoubleparser.patch
    + rebase

++++ jackson-databind:

  - Update to 2.18.8
    * Changes of 2.18.8
    + #5950: Improve 'UUIDeserializer' error handling
    + #5951: Improve 'InetSocketAddress' deserialization
    (bsc#1268899, CVE-2026-54514)
    + #5969: '@JsonView' by-passed for some "setterless" creator
    properties
    + #5971: '@JsonView' by-passed for unwrapped creator parameters
    + #5974: '@JsonIgnore' on Record property ignored with
    'PropertyNamingStrategy'
    + #5981: 'BasicPolymorphicTypeValidator' setting
    'allowIfSubTypeIsArray()' should validate element type
    (bsc#1268898, CVE-2026-54513)
    + #5988: 'PolymorphicTypeValidator' needs to validate generic
    type parameters too (bsc#1268897, CVE-2026-54512)
    + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
    fold case using JVM default locale (Turkish-I bug)
    * Changes of 2.18.4
    + #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
    Record property ignored for deserialization
    + #5049: Duplicate creator property "b" (index 0 vs 1) on simple
    java record
    * Changes of 2.18.3
    + #4444: The 'KeyDeserializer' specified in the class with
    '@JsonDeserialize(keyUsing = ...)' is overwritten by the
    'KeyDeserializer' specified in the 'ObjectMapper'.
    + #4827: Subclassed Throwable deserialization fails since
    v2.18.0 - no creator index for property 'cause'
    + #4844: Fix wrapped array handling wrt 'null' by
    'StdDeserializer'
    + #4848: Avoid type pollution in 'StringCollectionDeserializer'
    + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not
    work with multiple constructors since 2.18
    + #4878: When serializing a Map via
    Converter(StdDelegatingSerializer), a NullPointerException is
    thrown due to missing key serializer
    + #4908: Deserialization behavior change with @JsonCreator and
    @ConstructorProperties between 2.17 and 2.18
    + #4917: 'BigDecimal' deserialization issue when using
    '@JsonCreator'
    + #4920: Creator properties are ignored on abstract types when
    collecting bean properties, breaking AsExternalTypeDeserializer
    + #4922: Failing '@JsonMerge' with a custom Map
    + #4932: Conversion of 'MissingNode' throws
    'JsonProcessingException'
    * Changes of 2.18.2
    + #4733: Wrong serialization of Type Ids for certain types of
    Enum values
    + #4742: Deserialization with Builder, External type id,
    '@JsonCreator' failing
    + #4777: 'StdValueInstantiator.withArgsCreator' is now set for
    creators with no arguments
    + #4783 Possibly wrong behavior of @JsonMerge
    + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'
    hides actual error
    + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides
    '@JsonProperty' values
    + #4790: Fix '@JsonAnySetter' issue with "setter" method
    (related to #4639)
    + #4807: Improve 'FactoryBasedEnumDeserializer' to work better
    with XML module
    + #4810: Deserialization using '@JsonCreator' with renamed
    property failing (since 2.18)
    * Changes of 2.18.1
    + #4508: Deserialized JsonAnySetter field in Kotlin data class
    is null
    + #4639: @JsonAnySetter on field ignoring unrecognized
    properties if they are declared before the last recognized
    properties in JSON
    + #4718: Should not fail on trying to serialize
    'java.time.DateTimeException'
    + #4724: Deserialization behavior change with Records,
    '@JsonCreator' and '@JsonValue' between 2.17 and 2.18
    + #4727: Eclipse having issues due'module-info' class "lost" on
    2.18.0 jars
    + #4741: When 'Include.NON_DEFAULT' setting is used on POJO,
    empty values are not included in json if default is 'null'
    + #4749: Fixed a problem with
    'StdDelegatingSerializer#serializeWithType' looking up the
    serializer with the wrong argument
    * Changes of 2.18.0
    + #562: Allow '@JsonAnySetter' to flow through Creators
    + #806: Problem with 'NamingStrategy', creator methods with
    implicit names
    + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and
    field level '@JsonProperty'
    + #3120: Return 'ListIterator' from 'ArrayNode.elements()'
    + #3241: 'constructorDetector' seems to invalidate
    'defaultSetterInfo' for nullability
    + #3439: Java Record '@JsonAnySetter' value is null after
    deserialization
    + #4085: '@JsonView' does not work on class-level for records
    + #4119: Exception when deserialization uses a record with a
    constructor property with 'access=READ_ONLY'
    + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't
    work for beans with Creator methods
    + #4407: 'null' type id handling does not work with
    'writeTypePrefix()'
    + #4452: '@JsonProperty' not serializing field names properly on
    '@JsonCreator' in Record
    + #4453: Allow JSON Integer to deserialize into a single-arg
    constructor of parameter type 'double'
    + #4456: Rework locking in 'DeserializerCache'
    + #4458: Rework synchronized block from 'BeanDeserializerBase'
    + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'
    method is not called on the serializer
    + #4472: Rework synchronized block in 'TypeDeserializerBase'
    + #4483: Remove 'final' on method BeanSerializer.serialize()
    + #4515: Rewrite Bean Property Introspection logic in Jackson
    2.x
    + #4545: Unexpected deserialization behavior with
    '@JsonCreator', '@JsonProperty' and javac '-parameters'
    + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper
    .canSerialize()'
    + #4580: Add 'MapperFeature
    .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator
    properties' declaration order for sorting
    + #4584: Provide extension point for detecting "primary"
    Constructor for Kotlin (and similar) data classes
    + #4602: Possible wrong use of _arrayDelegateDeserializer in
    BeanDeserializerBase::deserializeFromObjectUsingNonDefault()
    + #4617: Record property serialization order not preserved
    + #4626: '@JsonIgnore' on Record property ignored for
    deserialization, if there is getter override
    + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'
    ignored when serializing Records, if there is getter override
    + #4634: '@JsonAnySetter' not working when annotated on both
    constructor parameter & field
    + #4678: Java records don't serialize with 'MapperFeature
    .REQUIRE_SETTERS_FOR_GETTERS'
    + #4688: Should allow deserializing with no-arg
    '@JsonCreator(mode = DELEGATING)'
    + #4694: Deserializing 'BigDecimal' with large number of
    decimals result in incorrect value
    + #4699: Add extra 'writeNumber()' method in 'TokenBuffer'
    + #4709: Add 'JacksonCollectors' with 'toArrayNode()'
    implementation
  - Added patch:
    * jackson-databind-CVE-2026-54515.patch
    + Fix #5962: Case-insensitive deserialization may use wrong
    @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)

++++ jackson-dataformats-binary:

  - Update to 2.18.8
    * Changes of 2.18.8
    + #696: (ion) Incomplete number length validation in Ion decoder
    (for 'BigDecimal' and/or 'BigInteger')
    * Changes of 2.18.6
    + #645: (avro) Remove use of Avro 'Schema.Parser()
    .setValidate()' to allow use of Avro core 1.12.1 (2.x)
    + #649: (cbor, smile) 'StreamReadConstraints.maxDocumentLength'
    not checked when creating parser with fixed buffer
    + #651: (smile) Ensure Smile backend supports
    'StreamReadConstraints.maxTokenCount'
    + #652: (cbor) Ensure CBOR backend supports
    'StreamReadConstraints.maxTokenCount'
    + Minor fix to 'ProtobufGenerator._reportEnumError()' helper
    method
    * Changes of 2.18.5
    + #599: (cbor) Unable to deserialize stringref-enabled CBOR with
    ignored properties
    + #623: (ion) Upgrade 'ion-java' dep to 1.11.11 (from 1.11.10)
    * Changes of 2.18.4
    + #569: (ion) 'IonParser' fails to parse some 'long' values
    saying they are out of range when they are not
    + #584: (protobuf) Missing 'JsonToken.END_OBJECT' for nested
    Protobuf Objects
    + (ion) Upgrade 'ion-java' to 1.11.10 (from 1.11.9)
    * Changes of 2.18.3
    + #541: (cbor, protobuf, smile) 'SmileParser.getValueAsString()'
    FIELD_NAME bug
    * Changes of 2.18.1
    + #518: Should not read past end for CBOR string values
    * Changes of 2.18.0
    + #167: (avro) Incompatibility with Avro >=1.9.0 (upgrade to
    Avro 1.11.3)
    + #484: (protobuf) Rework synchronization in 'ProtobufMapper'
    + #494: (avro) Avro Schema generation: allow mapping Java Enum
    properties to Avro String values
    + #508: (avro) Ignore 'specificData' field on serialization
    + #509: IonValueMapper.builder() not implemented, does not
    register modules

++++ jackson-dataformats-text:

  - Update to 2.18.8
    * Changes of 2.18.8
    + #679: (toml) Validate integer length for hex/octal/binary
    radix literals
    * Changes of 2.18.7
    + #615: (csv) Feature
    'CsvReadFeature.EMPTY_UNQUOTED_STRING_AS_NULL' ignored when
    preceding column is quoted
    * Changes of 2.18.6
    + #613: (csv) Support 'StreamReadConstraints
    .maxDocumentLength()' validation for CSV module
    * Changes of 2.18.1
    + #499: (yaml) SnakeYAML upgrade to 2.3
    * Changes of 2.18.0
    + #442: (csv) Allow use of "value decorators" (like '[' and ']'
    for arrays) for reading 'CsvSchema' columns
    + #468: (csv) Remove synchronization from 'CsvMapper'
    + #469: (csv) Allow CSV to differentiate between 'null' and
    empty fields (foo,,bar vs. foo,"",bar)
    + #482: (yaml) Allow passing 'ParserImpl' by a subclass or
    overwrite the events
    + #483: (csv) Incorrect location of CSV errors
    + #485: (csv) CSVDecoder: No Long and Int out of range
    exceptions
    + #495: (csv) Support use of 'CsvValueDecorator' for writing CSV
    column values

++++ jackson-dataformat-xml:

  - Upgrade to 2.18.8
    * Changes of 2.18.8
    + #863: Fix to support Woodstox 7.2.0 (but no dep version bump)
    * Changes of 2.18.2
    + #678: XML module not registered correctly when setting a
    custom 'SerializerFactory'
    + #682: 'MismatchedInputException' encountered while
    deserializing XML to an Enum type using a factory method
    * Changes of 2.18.0
    + Remove unnecessary synchronization around 'LRUMap' in
    'XmlRootNameLookup'
    + Upgrade Woodstox to 7.0.0 (dependency fixes)

++++ jackson-datatypes-collections:

  - Update to 2.18.8
    * No changes since 2.18.5
    * Changes of 2.18.5
    + #185: `ACCEPT_SINGLE_VALUE_AS_ARRAY` doesn't work on Guava
    `ImmutableList`
    * Changes of 2.18.0
    + #160: (guava) Defect guava OSGi dependency version specified?
    + HPPC dependency upgraded to 0.9.1 (from 0.8.2)

++++ jackson-modules-base:

  - Upgrade to 2.18.8
    * No changes since 2.18.0
    * Changes of 2.18.0
    + #233: (jaxb) Tolerate JAX-RS 2.2 in
    jackson-module-jaxb-annotations so that it can be deployed in
    Liberty alongside features which use 2.2
    + #248: (android-record) jClass annotations and polymorphic
    types are ignored when deserializing Android Record fields
    + #251: (android-record) Constructor is not recognized when a
    record uses both arrays and generic types

++++ jackson-module-jsonSchema:

  - Update to 2.18.8
    * No changes since 2.18.3
    * Changes of 2.18.3
    + #161: Jakarta does not have 'jakarta.validation' as
    'module-info' dependency

++++ jackson-modules-java8:

  - Upgrade to 2.18.8
    * No changes since 2.18.5
    * Changes of 2.18.5
    + #372: 'java.util.Optional' deserialisation fails when using
    'TypeFactory.defaultInstance' for creating 'JavaType' for
    'Optional<?>'
    * Changes of 2.18.4
    + #291: 'InstantDeserializer' fails to parse negative numeric
    timestamp strings for pre-1970 values
    * Changes of 2.18.3
    + #333: 'ZonedDateTime' serialization with '@JsonFormat.pattern'
    never uses it while 'WRITE_DATES_WITH_ZONE_ID' enabled
    * Changes of 2.18.2
    + #308: Can't deserialize 'OffsetDateTime.MIN': Invalid value
    for EpochDay
    * Changes of 2.18.1
    + #319: 'java.time.DateTimeException' serialization fails
    * Changes of 2.18.0
    [#124] Issue serializing and deserializing 'LocalDateTime.MAX'
    and 'LocalDateTime.MIN'

++++ jackson-parent:

  - Update to 2.18.4
    * Changes of 2.18.4
    + Update to latest 'oss-parent' (69)
    * Changes of 2.18.3
    + Update to latest 'oss-parent' (68)
    + Switch to publishing via Sonatype Central Portal repo
    * Changes of 2.18.2
    + Update to latest 'oss-parent' (66); future-proof for Sonatype
    Central Portal
    * Changes of 2.18.1
    + #15: Add override to downgrade 'moditect-maven-plugin' from
    1.2.2 to 1.1.0 to work around Eclipse issues
    * Changes of 2.18
    + Update to oss-parent 61 (plugin version updates)

++++ jline3:

  - Added patch:
    * jline3-GHSA-47qp-hqvx-6r3f.patch
    + backport of the upstream fix for GHSA-47qp-hqvx-6r3f,
    bsc#1269021: unauthenticated remote memory exhaustion via
    unbounded Telnet 'NEW-ENVIRON variables

++++ jsoncpp:

  - Add jsoncpp-i586-float-precision.patch to fix the
    ValueTest/objects %%check failure (FTBFS) on i586: the test
    stored 0.12345f and compared it exactly as a double, which x87
    80-bit excess precision (no SSE2 in the i586 baseline) broke;
    the patch compares the value narrowed back to float, which is
    precision-robust on every architecture (the library itself was
    always correct). Replaces the earlier, ineffective
  - fexcess-precision=standard workaround.

++++ python-jupyterlab:

  - Update to 4.5.9 (bsc#1269072, GHSA-vmhf-c436-hxj4):
    * Use CSS anchor for prompt overlay
    * Fix XSS in extension manager's homepage_url
    * Forbid relative URLs in extensionmanager
    * Fix jupyter labextension build crash on webpack ≥ 5.107

++++ libglycin:

  - Update to version 2.1.5:
    + Fixed: image-rs/jpeg: Support RGB for editing. There are
    actually images that don't use ycbcr.

++++ libglycin-gtk4:

  - Update to version 2.1.5:
    + Fixed: image-rs/jpeg: Support RGB for editing. There are
    actually images that don't use ycbcr.

++++ mupdf:

  - Modernise the spec with spec-cleaner (drop obsolete Group tags,
    use pkgconfig() build requires).

++++ nftables:

  - add support-reproducible-build.patch: this is a cherry pick of
    four unreleased upstream commits which are needed to properly
    backport the reproducible build feature.

++++ onnxruntime:

  - Packaging fixes for Factory submission:
    * Fix the python314 build flavor: the spec only handled 3.11/3.12/3.13
    while _multibuild requests 3.11/3.13/3.14, so the python314 build aborted
    with "Unknown flavor". The spec now targets 3.11/3.13/3.14.
    * Add BSD-3-Clause to the License tag to cover the bundled, statically
    linked protobuf and re2.
    * Declare the bundled() provides on the python subpackage as well, via a
    shared macro so the shared library and python packages stay in sync.
    * Document in the spec why each dependency is bundled (the set matches
    upstream cmake/deps.txt exactly and system versions are incompatible).
    * Drop unused, unreferenced source archives (cxxopts, dlpack, FP16).

++++ pangomm1_4:

  - Update to version 2.46.5:
    + Documentation:
  - Language::get_scripts(): Improve documentation.
  - Don't link to removed parts of gnome.org
  - Replace gtkmm.org by gtkmm.gnome.org
  - Remove obsolete FSF (Free Software Foundation) address
  - README.win32.md: Mention Visual Studio 2026
  - Visual Studio builds: Update build information
    + Meson build:
  - Require meson >= 0.60.0
  - Use the Python installation that Meson uses.
  - Meson and NMake builds: Distinguish Visual Studio 2026 builds
    from Visual Studio 2022 builds
  - NMake Makefiles: Consolidate items and improve flexibility
  - NMake Makefiles: Make build process more robust
  - NMake Makefiles: Update .m4 installation location
  - Don't require the 'dot' command to build the documentation
  - Drop pangomm1_4-docs-without-timestamp.patch: Fixed upstream.
  - Update to version 2.56.2:
    + Documentation:
  - Remove obsolete FSF (Free Software Foundation) address
  - README.win32.md: Mention Visual Studio 2026
  - Visual Studio builds: Update build information
    + Meson build:
  - Use the Python installation that Meson uses.
  - Meson and NMake builds: Distinguish Visual Studio 2026 builds
    from Visual Studio 2022 builds
  - NMake Makefiles: Consolidate items and improve flexibility
  - NMake Makefiles: Make build process more robust
  - NMake Makefiles: Update .m4 installation location
  - Don't require the 'dot' command to build the documentation

++++ libpsl:

  - Update to version 0.22.0:
    * Can now be built from the release tarball without Python
    * Drop an external dependency by implementing the IPv4/IPv6
    address checks internally
    * Avoid using alloca() and improve general portability
    * Add support for native ICU on Windows and libcucore on Apple
    systems
    * Improve the meson and autotools builds and the installed
    libpsl.pc pkg-config file
    * Documentation improvements
    * No soname change (still libpsl.so.5)

++++ tesseract-ocr:

  - Drop the now-unused OpenCL build dependencies opencl-headers and
    pkgconfig(OpenCL) (boo#1213370):
    * OpenCL support is experimental and disabled (the --enable-opencl
    configure flag was already removed); these requires were left
    behind and only bloated the build.
    * With OpenCL off, libtesseract no longer links libOpenCL.so.1,
    so it no longer fails to start with "libOpenCL.so.1: cannot
    open shared object file" (boo#1232640).

++++ libvirt:

  - spec: Strengthen dependency on numa-preplace
    bsc#1268783

++++ libzio:

  - Update to version 1.15
    Refactored zio.c as well as optimized
  - Functional Verification: All compression formats (gzip, bzip2, lzma, xz, zstd)
    were validated via the test loop.
  - Static Analysis & Bugfixes:
  - Fixed a memory leak and uninitialized value in autodetect and fzopen.
  - Fixed Double-Free vulnerabilities in zio_open_gzip_pipe and zio_open_bzip2_pipe.
  - Compatibility: Verified the HAS_LZMADEC_H path with the legacy lzmadec.h.
  - Optimizations: Replaced heap allocation for the check buffer with a stack-based
    buffer in fzopen and _knowntype_fdzopen to reduce overhead.

++++ lynis:

  - Update to 3.1.7
    * Changed
  - Add Debian 13 EOL
  - Add Fedora 43 EOL date
  - Add AlmaLinux to EOL DB
  - Add EOL date for Alpine 3.22
  - Add openSUSE Leap to EOL DB
  - Fix OS detection for CachyOS (ID=cachyos)
  - Add CachyOS to OS end-of-life database
  - Update software-eol.db
  - Update RHEL 8 EOL and add RHEL 9 and 10 dates to software-eol.db
  - add Ubuntu 25.10 EOL date
  - Add publiccode.yml check as a GitHub workflow
  - Add end-of-life date for Ubuntu 26.04
  - Added EoL for Ubuntu 26.04.
  - Add NixOS EOL data
  - Update HAPPY_USERS.md
  - Add Alpine 3.23 EOL date
  - add and fix fedora dates
  - Drop 1682.patch, included upstream

++++ nekobox:

    Update to 5.11.24
  - Updated sing-box to 1.13.14
  - Added Snell protocol support
  - Fixed startup crash (c0000005)
  - Fixed selection issues
  - Improved the basic routes grid
  - Improved feiyangqingyun theme
  - Fixed amnezia preshared_key field
  - Added a searchbox

++++ nextcloud:

  - Update to 33.0.6
    * server
  - Dav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
  - Fix(files,files_sharing): swallow redirected navigation errors (server#59887)
  - Fix(caldav): grant sharee Acls to the delegate (server#60646)
  - Fix(http): avoid iconv for header ascii fallback (server#60722)
  - Fix(DB): Enforce foreign key constraints in SQLite (server#60792)
  - Fix(encryption): recovery keys should be shown when user keys are used (server#60799)
  - Fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
  - Fix(files): Chromium-based browsers drag-and-drop (server#60899)
  - Fix: actually register listener for updating stored external storage credentials (server#60905)
  - Chore(deps): Update flake to NixOS 26.05 (server#60912)
  - Fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
  - Fix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
  - Fix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
  - Fix(psalm): Update psalm baseline (server#60933)
  - Test(cache): avoid ordering assumptions in testExtended (server#60935)
  - Fix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
  - Fix(files_sharing): clear the password after saving (server#60951)
  - Fix(files): show proper information when a move will override the target (server#60962)
  - Fix: access shared and delegated trashbin objects (server#60967)
  - Fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
  - Master] fix(security): Update code signing revocation list (server#61002)
  - Fix(dav): finalize upload metadata before post-write hooks (server#61070)
  - Fix(dav): properly handle files metadata (server#61079)
  - Fix(comments): Use capped memory cache for comments (server#61096)
  - Fix(security): don't propagate ValueError from Crypto::decrypt() fallback (server#61104)
  - Fix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
  - Fix: Correctly detect appid for dist css files (server#61112)
  - Fix: use correct permissions mask for non-home storage public links (server#61117)
  - Fix(settings): Show loading spinner while searching accounts (server#61121)
  - Build(deps): bump the symfony group across 1 directory with 9 updates (server#61130)
  - Master] fix(security): Update code signing revocation list (server#61134)
  - Feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
  - Build(deps): bump phpseclib/phpseclib from 2.0.53 to 2.0.54 (server#61179)
  - Fix(previews): ffprobe hangs (server#61183)
  - Fix(files_versions): guard null path in event listeners (server#61188)
  - Fix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
  - Fix(search-query): fix psalm type error (server#61196)
  - Master] fix(security): Update code signing revocation list (server#61238)
  - Fix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
  - Fix: use card interface instead of object (server#61251)
  - Master] fix(security): Update code signing revocation list (server#61284)
  - Fix(twofactor_backupcodes): Add a clean helper to set code as used (server#61297)
  - Fix(theming): preserve uploaded favicon and touch icon (server#61301)
  - Fix: Use token expiration for ephemeral sessions (server#61306)
  - Fix(user_ldap): Escape filter part when searching for group members (server#61326)
  - Chore: Reduce PHPUnit test matrix on stable34 and remove coverage (server#61336)
  - Fix: trim duplicate search results for external share (server#61339)
  - Fix: Do not set last-password-confirm for apptoken sessions (server#61343)
  - Fix(team-manager): ensure team resources are only retrived for members (server#61350)
  - Fix(ocm-add-share): adjust domain validation (server#61356)
  - Fix: ensure file names are string-typed (server#61360)
  - Feat(oauth2): Add commands for adding and deleting clients (server#61362)
  - Fix: prevent editing delegated admins (server#61370)
  - Fix(caldav): respect federation settings (server#61380)
  - Fix(files_sharing): Hide incompatible actions in shares (server#61387)
  - Fix(files_versions): avoid version snapshot races during cross-storage renames (server#61402)
  - Fix: Fix alignment issues of app password form (server#61405)
  - Master] fix(security): Update code signing revocation list (server#61430)
  - Fix(onetime-qrcode): Remove password confirmation attribute (server#61503)
    * activity
  - Perf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)
    * bruteforcesettings
  - Fix: fix toggle the allow list option (bruteforcesettings#1105)
    * circles
  - Build: add .nextcloudignore for release builds (circles#2495)
  - Feat: Add role-based filtering for circle member queries (circles#2504)
  - Fix(local-controller): dont show full config int of circle for non-members (circles#2527)
  - Fix(local-controller): validate params set on team creation (circles#2533)
  - Adjust local controller to better handle permission checks (circles#2537)
  - Fix(local-controller): include CFG_OPEN in config mask for visible circles (circles#2556)
    * notifications
  - Chore: extend testing of `encryptAndSign` and make the methods discoverable by psalm (notifications#3079)
  - Fix(email): Correctly initialize next_send_time field (notifications#3119)
  - Fix: Subject in encrypt method (notifications#3137)
    * serverinfo
  - Chore: Require PHP 8.2 (serverinfo#1021)
    * survey_client
  - Fix(report): Fix sending huge reports (survey_client#441)
    * suspicious_login
  - Fix(notifier): Fix label length limited to 32 characters (suspicious_login#1116)
    * text
  - Fix: disable open link button for unsafe link (text#8684)
  - Fix(mediaHandler): strip relevant bidi chars in filenames (text#8692)
  - Fix(Editor): emit modified fileNode size on save (text#8695)
  - Chore(github): update workflows (text#8715)
  - Fix(math): fix lost content after math node (text#8721)
  - Fix(editorApi): allow to disable image lazy-loading (text#8727)
  - Fix permission change in text doc (text#8750)
  - Fix: show Assistant icon if only translation provider available (text#8759)
  - Performance: Only check permissions when changing content (text#8765)
  - Ci: remove compile command, as it happens after merge. Then, also run reuse (text#8768)
    * viewer
  - Fix(plyr): the speed settings button should not be cut (viewer#3198)
  - Fix(plyr): add l10n to components (viewer#3202)
  - Fix(plyr): the speed selection should not go out of the viewport (viewer#3208)
  - Fix(plyr): add l10n to speed selections (viewer#3215)

++++ obs-service-update_changelog:

  - Add correct Provides/Obsoletes

++++ openQA:

  - Update to version 5.1782418423.92589c9c:
    * fix: Correct call to console.error

++++ otpclient:

  - Update to 5.1.0:
    * BREAKING: After upgrading to 5.1.0, older OTPClient releases
    will NOT be able to open v3 databases, so keep a backup before
    upgrading if you may need to downgrade
    * NEW: webcam QR scanning runs on a worker thread, no more main-
    thread freeze while the camera initializes or while frames are
    decoded
    * NEW: you can quit OTPClient while the database is locked (#456)
    * NEW: the app locks automatically when the system suspends (via
    logind PrepareForSleep), so the database is never left
    decrypted across sleep
    * IMPROVEMENT: database file format bumped to v3 with a portable,
    byte-addressable big-endian header. v1 and v2 databases are
    read transparently and upgraded to v3 on first successful
    open/unlock. Older OTPClient releases cannot open v3 databases,
    so keep a backup before upgrading if you may need to downgrade
    * IMPROVEMENT: cross-process write serialization via a bounded-
    wait .lock sidecar, prevents two OTPClient instances from
    clobbering each other on save
    * IMPROVEMENT: search-filter cache, large token lists filter
    without re-walking the model on every keystroke
    * IMPROVEMENT: changing the password now requires verifying the
    current one before the change is applied
    * IMPROVEMENT: CLI plain imports dispatch by file type
    automatically, no longer prompt for a password on unencrypted
    formats
    * IMPROVEMENT: Google Authenticator migration import was
    rewritten with bounded payload/token/batch limits and now
    reports multi-batch progress, across the file, screen, and
    webcam paths
    * SECURITY: locking wipes the decrypted database and master key
    from memory; unlocking re-derives the key instead of comparing
    a copy held in RAM
    * SECURITY: generated codes, notification text, clipboard
    contents, and per-token values are wiped after use, and live
    codes are kept in libgcrypt secure memory
    * SECURITY: search-provider activation IDs are now random 128-bit
    capability tokens with a 30-second TTL and single-use
    enforcement, replacing the predictable db_index:json_index
    scheme
    * SECURITY: HOTP entries are excluded from the search provider at
    load time, advancing a counter from a desktop search result is
    too easy to do by accident
    * SECURITY: transient password buffers are wiped after use across
    the GUI and CLI, including on password-dialog cancel and
    dispose
    * SECURITY: search-provider derived-key cache + rate limit on OTP
    delivery, using a single global rate bucket (no per-connection
    bypass) and an idle-wipe timer for keys and caches
    * SECURITY: 2FAS encrypted import now surfaces decryption errors
    instead of silently swallowing them
    * SECURITY: broad correctness and hardening pass across src/
    (core, GUI, importers, CLI), including a parse-uri double-error
    fix, an authpro stream check, a bytes_to_hexstr overflow guard,
    and NULL-checked secure-memory allocations
    * SECURITY: tightened Argon2id parameter bounds (MAX_ITER 100 ->
    64, MAX_MC 4 GiB -> 1 GiB, MAX_PARAL 64 -> 16) to reject
    pathological configurations
    * FIX: v2 databases were misread as a far-future format version
    and refused to open; both v2 and v3 headers are now read
    correctly
    * FIX: the window no longer gets stuck on the "Unlocking..." page
    when a database fails to load for a reason other than a missing
    file or wrong password; it drops back to the no-database view
    so you can retry
    * FIX: the desktop search provider copies the OTP to the
    clipboard asynchronously on KDE; the synchronous Klipper D-Bus
    call could block every activation for up to a second when
    Klipper did not reply in time, delaying the copy and the
    notification
    * FIX: CLI HOTP counter is now persisted before the code is
    printed, the counter upper bound is exclusive everywhere, the
    terminal is restored on interrupt, and CR/LF is stripped from
    piped input
    * FIX: memory leaks in DB and OTP handling paths
    * FIX: freeotp importer secmem budget and GError-overwrite bug
    that also affected other importers
    * FIX: in-memory database state is now restored if an encrypt-on-
    save fails, instead of being left half-mutated
    * FIX: debianStable CI build and the JPEG sanitizers test

++++ perl-Business-ISBN-Data:

  - updated to 20260624.1.0 (20260624.001)
    see /usr/share/doc/packages/perl-Business-ISBN-Data/Changes
    20260624.001 2026-06-24T18:50:16Z
    * data update for 2026-06-24

++++ perl-Module-CPANTS-Analyse:

  - updated to 1.30.0 (1.03)
    see /usr/share/doc/packages/perl-Module-CPANTS-Analyse/Changes
    1.03 2026-06-24
  - Applied a test patch by pghmcfc++ (GH#51) for newer Archive::Tar

++++ psl-make-dafsa:

  - Update to version 0.22.0:
    * Can now be built from the release tarball without Python
    * Build and portability improvements
    * No soname change in the shared library (libpsl.so.5)

++++ python-azure-communication-callautomation:

  - New upstream release
    + Version 1.6.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-billing:

  - New upstream release
    + Version 8.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-computelimit:

  - New upstream release
    + Version 1.2.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-kusto:

  - New upstream release
    + Version 4.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-loganalytics:

  - New upstream release
    + Version 14.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-qumulo:

  - New upstream release
    + Version 3.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-cchardet:

  - Update opensuse-build.patch to explicitly link against libstdc++
    fixing build failure under Python 3.14 (undefined symbol
    _ZTVN10__cxxabiv117__class_type_infoE)

++++ python-fastuuid:

  - Clean up SPEC file.
  - We need to setup .cargo/config.toml manually, vendoring scripts
    do it automatically.

++++ python-mistune:

  - update to 3.3.2 (CVE-2026-49851, bsc#1269091)
    * Resolve O(n^2) DoS in parse_link_text (CWE-400)
    * Avoid quadratic scans in general
    * cli: Add entrypoint and utf-8 output
    * image: Validate figure width option
    * Reject currency patterns and cross-line matches in inline math
    * math: Support display and backtick math
    * renderer: Render plugin list and table nodes
    * renderer: Block encoded unsafe URL schemes
    * abbr: Update process_text method in abrr, adding parse_emphasis
    parameter

++++ python-pycocotools:

  - Use pyproject macros to build and install the module.
  - List directories under sitelib explicitly.

++++ python-ruff:

  - update to 0.15.19
    * Preview features
    * Support human-readable names when hovering suppression comments and in code actions
    * Bug fixes
    * Fall back to default settings when editor-only settings are invalid
    * Fix panic when inserting text at a notebook cell boundary
    * Rule changes
    * [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801)
    * Performance
    * Avoid allocating when parsing single string literals
    * Avoid reallocating singleton call arguments
    * Lazily create source files for lint diagnostics
    * Optimize formatter text width and indentation
    * Reserve capacity for builtin bindings
    * Skip repeated-key checks for singleton dictionaries
    * Use ArrayVec for qualified name segments
    * Documentation
    * [flake8-pyi] Note that PYI051 is an opinionated stylistic rule
    * [pyupgrade] Clarify UP029 as a Python 2 compatibility rule

++++ python-uv:

  - update to 0.11.24
    * Preview features
    * Make project environments relocatable under preview
    * Performance
    * Use a compact index for lazy version maps
    * Bug fixes
    * Allow disabling exclude-newer
    * Avoid archive id collisions
    * Reapply "Fix transparent Python upgrades in project environments"
    * Clean up partial tool entrypoint installs
    * Fix relocatable activate.fish and broaden Fish version support

++++ swig:

  - Remove stale ocaml support

++++ thextech:

  - Update to version 1.3.7.3.1
    This is a hotfix release for the 1.3.7.3 since there are serious
    bugs were been found and were been fixed.
    * Adjusted the IME start logic to enable it when direct text
    input is enabled.
    * Fixed behaviour of the MD5 algorithm on Big Endian hardware.
    * Fixed a critical bug of checkpoints being reset when
    re-entering normal level from the hub.
    * Fixed TheXTech bug where medals were incorrectly saved after
    death in hub worlds.

++++ yambar:

  - Add yambar-gcc16-unused-but-set.patch: fix build with GCC 16,
    which no longer counts a bare increment as a use and so rejects
    the debug-only "count"/"focused" counters under
  - Werror=unused-but-set-variable (boo#1256994); backported from
    upstream
  - Modernize the spec with spec-cleaner

------------------------------------------------------------------
------------------  2026-6-24  -  Jun 24 2026  -------------------
------------------------------------------------------------------

++++ ComputeLibrary:

  - Backport upstream patch to fix build of armnn:opencl
    * 1299.patch

++++ GraphicsMagick:

  - added patches
    CVE-2026-46523: heap-use-after-free via a crafted MSL image [bsc#1268125]
    * GraphicsMagick-CVE-2026-46523.patch
  - modified patches
    * GraphicsMagick-disable-insecure-coders.patch (disable MSL
    to align with ImageMagick)

++++ R-base:

  - Changes in R 4.6.1:
    New Features:
    • The LaTeX class jss bundled in share/texmf/tex/latex/jss.cls has
    been updated to work with hyperref version 7.01q (2026/04/24).
    • Plain-text (and legacy HTML) conversion for a simple Rd \eqn{}
    now handles \geq, \leq, \neq and \ne in addition to \ge and \le
    (PR#19070).
    Bug Fixes:
    • abbreviate(<non-ASCII>) now works better, using iswlower() and
    * upper() to treat “wide” characters, thanks to Kevin's PR#19058.
    • cut(1:11, {}) now signals an error for the invalid breaks, fixing
    PR#19057, thanks to Kevin Ushey.
    • all(<symbol>) signals an error now, as some similar coercions;
    previously, the coercion of the symbol resulted in NULL
    internally, raised a warning, and could access illegal memory;
    thanks to Kevin Ushey's PR#19054.
    • stl() now checks its 3 x 3 tuning parameters on the R level;
    stl(*, s.window = 0) now “works” instead dumping core, stl(*,
    s.window = 1) “works” correctly, too.  Also, the summary() method
    mentions the robustness weights only if any robustness iterations
    happened.
    Further, stl() is now based on C code, translated from previous
    Fortran, triggered by a flang 22 compiler optimization bug (-O2).
    • The border case zapsmall(x, digits=Inf) where x contains an Inf
    entry no longer returns all NaN but rather x.  The improved help
    page now has more non-default examples.
    • wilcox.test(x, exact=FALSE, correct = k)'s p-value computation
    got a missing dnorm(z) factor, and so did the 2-sample case, in
    addition to more fixes.
    • The data part of getGenerics() listed package names for generic
    functions defined in more than one package.  Now it lists generic
    function names, as intended.  Thanks to Michael Chirico for
    report and patch proposal (PR#19080).
    • Overly long dyn.load() error messages (C level dlerror()), should
    no longer corrupt its state, thanks to Ivan Krylov's PR#19029
    report and patch.
    • as.matrix(<POSIXlt>) again produces a _numeric_ matrix, and the
    c() and subassignment methods for POSIXlt objects work correctly
    more often, e.g., without a "tzone" attribute, back porting a few
    of the PR#18989 fixes from R-devel, both thanks to Suharto
    Anggono.
    • In methods, as() now correctly coerces S4 objects to S4
    superclasses extending old-style classes, instead of returning
    only the S3 part.

++++ agama:

  - fix unattended installation for full medium SLES iso
    (bsc#1268635)
  - fix premature reboot or shutdown in unattended installation
    when inst.finish kernel parameter is used (bsc##1268803)

++++ apko:

  - Update to version 1.2.19:
    * paths: honor `recursive` for `type: permissions`, make uid/gid
    nullable (#2281)
    * Lower SBOM duplicate-package log from info to debug (#2293)
    * build(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
    (#2277)
    * build(deps): bump go.step.sm/crypto from 0.82.0 to 0.83.0
    (#2280)
    * build(deps): bump google.golang.org/api from 0.283.0 to 0.285.0
    (#2287)
    * build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2291)
    * build(deps): bump chainguard.dev/sdk from 0.1.57 to 0.1.74
    (#2290)
    * build(deps): bump chainguard-dev/actions from 1.6.22 to 1.6.24
    (#2292)

++++ assimp:

  - added patches
    CVE-2026-10200: This affects the function glTFCommon:CopyValue in the library glTFCommon.h of the component 4x4 Matrix Parser. Performing a manipulation results in a heap-based buffer overflow [bsc#1266999]
    * assimp-CVE-2026-10200.patch

++++ python-avocado:

  - Update to version 113.0:
    * Tests can now depend on virtual-machine images via the new
    vmimage runner, with VMImage support for current openSUSE
    Leap 15.x images
    * Full support for running under Python 3.13
    * HTML report can filter on negative conditions (e.g. show all
    tests that did not pass)
    * "avocado plugins" gained a --capabilities option
    * Reworked logging with support for custom loggers and levels
    * avocado.utils gained NVMe self-encrypting-drive and shared
    namespace helpers, hugepage allocation detection, decimal
    data-structure support, and bzip2 archive handling
    * Numerous bug fixes (job log level handling, process.can_sudo)
  - Package the remaining optional plugins to complete the stack:
    * python3-avocado-plugins-ansible (run Ansible modules as tests)
    * python3-avocado-plugins-result-mail (e-mail job results)
    * python3-avocado-plugins-spawner-remote (run tests on a
    remote host over SSH)

++++ buildpacks-cli:

  - Update to version 0.40.7:
    * Features
  - fix(buildpack): correct yank registry issue body (add yank =
    true + code fence) (#2631 by @MD-Mushfiqur123)
  - chore: remove direct dependency on github.com/docker/docker
    (#2617 by @jjbustamante)
  - Suggest heroku/builder:26 instead of heroku/builder:24 (#2611
    by @runesoerensen)
    * Dependencies
  - build(deps): bump Go directive to 1.25.11 for stdlib security
    fixes (#2642)
  - build(deps): bump x/crypto, x/net, and go-git for security
    fixes (#2641)
  - chore: remove direct dependency on github.com/docker/docker
    (#2617)

++++ nextcloud-desktop:

  - Update to version 33.0.6:
    * New remote items inherit the content policy
    (gh#nextcloud/desktop#10066)
    * Update NextcloudKit API calls for breaking changes in 7.3.3
    (gh#nextcloud/desktop#10111)
    * Move processEvents after reply reads in LsColJob
    (gh#nextcloud/desktop#10103)
    * Do not trigger false remote wipe messages
    (gh#nextcloud/desktop#10112)
    * Use correct path when fetching file tags
    (gh#nextcloud/desktop#10129)
    * Add direct log entry when folder watcher detects changes
    (gh#nextcloud/desktop#10146)
    * Avoid double‑translating strings
    (gh#nextcloud/desktop#10154)
    * Disable Qt decompression check to allow listing very large
    folders again
    (gh#nextcloud/desktop#10211)
    * Evaluate notify‑push IDs and only start sync when IDs are known
    (gh#nextcloud/desktop#10210)
    * Prevent data loss when folders are moved or renamed
    (gh#nextcloud/desktop#10219)

++++ checkmedia:

  - merge gh#openSUSE/checkmedia#25
  - fine-tune build requirements
  - 7.1

++++ cloud-init:

  - Re-add cloud-init-write-routes.patch (bsc#1267422) incorrectly dropped

++++ clpeak:

  - Update to version 2.0.14:
    * Gate AMX intrinsics on 64-bit targets to fix i686 builds
    * CPU: expose every supported ISA variant as its own compute
    test
    * CPU: volatile-seed fp32/fp64 affine coefficients to fix the
    SSE2 peak result under -ffast-math
    * CPU: use matrix instruction names for ARM matrix engine
    labels
    * ROCm: fix bf16 and rocWMMA AOT kernel builds on ROCm 6.4,
    tighten AOT arch groups, and fix dlopen shim compile errors
    * Optionally build driver-only GPU binaries (AOT CUDA/ROCm,
    optional GEMM libraries)
  - Add clpeak-install-bindir.patch: the upstream packaging rework
    started installing the binary into the prefix root (/usr/clpeak);
    install it into bindir via GNUInstallDirs instead (sent upstream)
  - Drop _service/_servicedata and build straight from the upstream
    release tarball

++++ clusterctl:

  - Update to version 1.13.3:
    * Bug Fixes
  - clusterctl: Skip update check for clusterctl completion
    (#13697)
    * Others
  - CI: Bump gcb-docker-gcloud image (#13794)
  - Dependency: Bump go to v1.25.11 (#13789)
  - Dependency: Bump golang/x/net to 0.55.0 (#13746)
  - e2e: Bump to kind main to fix e2e tests (#13769)
  - e2e: Bump to kind v0.32.0 (#13781)
  - e2e: Bump to kind v0.32.0 (#13787)
  - e2e: Make the clusterctl upgrade management cluster control
    plane count configurable (#13771)
  - KCP: Update RemoveEtcdMember to accept a *etcd.Member instead
    of a member name (#13786)
  - Misc: Add finalizer only after we got owner/cluster (#13748)
    * Dependencies changed
  - golang.org/x/crypto: v0.50.0 → v0.51.0
  - golang.org/x/mod: v0.34.0 → v0.35.0
  - golang.org/x/net: v0.53.0 → v0.55.0
  - golang.org/x/sys: v0.43.0 → v0.45.0
  - golang.org/x/telemetry: 579e4da → be6f6cb
  - golang.org/x/term: v0.42.0 → v0.43.0
  - golang.org/x/text: v0.36.0 → v0.37.0
  - golang.org/x/tools: v0.43.0 → v0.44.0
  - Update to version 1.13.2:
    * Others
  - CI: Make it possible to exclude CVEs with govulncheck
    (#13671)
  - Dependency: Bump envtest 1.36 (#13658)
  - Dependency: Bumping corefile-migration to v1.0.32 (#13635)
  - Dependency: Go bump to 1.25.10 (#13666)
  - e2e: Start testing K8s 1.37 (#13638)
  - KCP: Add kubeadm cluster role (#13670)
  - KCP: KCP cleanup etcd members not started after a machine is
    remediated (#13688)
    * Dependencies changed
  - github.com/coredns/corefile-migration: v1.0.31 → v1.0.32

++++ coredns:

  - Exclude flaky unit test on build

++++ crmsh:

  - Update to version 5.1.0+20260624.349562dd:
    * Dev: storage_utils: Rename blkid UUID helper
    * Dev: storage_utils: Refactor storage helpers out of utils.py

++++ darktable:

  - Add darktable-link-wayland-client.patch: link libwayland-client
    explicitly into lib_darktable. Fixes the "undefined reference to
    wl_display_roundtrip" link failure of libdarktable.so under
  - -as-needed/LTO (gtk.c server-side-decoration detection added in
    5.6.0 calls libwayland-client directly).
  - Debian/Ubuntu build fixes for 5.6.0:
    * Add missing Build-Depends libpotrace-dev and libxml2-dev
    (cmake find_package(Potrace/LibXml2 REQUIRED) aborted configure).
    * Add libwayland-dev (gtk.c now includes wayland-client.h) and
    apply darktable-link-wayland-client.patch via debian/patches/series
    so the deb build links libwayland-client too.
  - Disable AI/ONNX support by default since onnxruntime package
    is not present in the repo.
  - Add a "--with ai" build conditional (x86_64) wired to a future
    system onnxruntime package, so AI can be enabled once ONNX Runtime
    is available in Factory

++++ delve:

  - Update to version 1.27.0:
    * v1.27.0 (#4372)
    * pkg/proc: skip TestSetVariable on riscv64
    * pkg/proc: skip TestPanickyIterator2 on riscv64
    * service/debugger: validate AttachPid before attempting attach
    * service/dap: fix TestFilterGoroutines for runtime.mcall on Windows
    * pkg/debugdetect: use dynamic port assignment in tests
    * service/dap: fix TestNextParked for ExitedEvent ordering
    * service/dap: fix test failures from ExitedEvent change (#4373)
    * service/dap: send ExitedEvent before TerminatedEvent (#4371)
    * pkg/proc: add GOEXPERIMENT=mapsplitgroup support (#4370)
    * proc: make PushPackageVarOrSelect check local variables first (#4181)
    * service/dap: add dap write memory request handler (#4364)
    * proc: fix stepping test on go1.27 / arm64 (#4365)
    * proc/test: include GOEXPERIMENT in the fixture cache key  (#4367)
    * Revert "winarm64: remove experimental build tags (#4176)" (#4281)
    * proc: support generic methods (#4356)
    * proc: add test for accessing global C variables (#4358)
    * gobuild: increase wait length for deleting binaries on Windows (#4359)
    * proc: disable some failing tests on riscv64 (#4361)
    * proc: add test for struct literals with embedded field selectors (#4362)
    * proc/internal/ebpf: switch to header+param event ring buffer protocol (#4352)
    * TeamCity: adjust execution timeout (#4354)
    * service/dap: relax TestBadLaunchRequest (#4351)
    * chore: fix comment to improve readability (#4350)
    * proc: fix hasInlines in stacktrace, fix range step with inlining (#4345)
    * Teamcity: reenable riscv64 build (#4346)
    * chore: fix some comments to improve readability (#4344)
    * proc: fix range over func stepping for go1.27 (#4343)
    * proc: fix test for go1.27 regexp refactor (#4339)
    * service/dap: add newline to the build message (#4340)
    * proc: compile hit-condition regexp once (#4335)
    * proc: bail out of loadArrayValues after stride overflow (#4328)
    * dwarf/reader: propagate errors during Reader entry iteration (#4327)
    * proc: fix OR handling in breakpointConditionSatisfiable (#4325)
    * proc/internal/ebpf: fix AddressToOffset off-by-one at section load (#4324)
    * proc: propagate AddrPiece ReadMemory errors in composite memory (#4323)
    * native: propagate PtraceGetRegs error on linux/ppc64le (#4322)
    * native: propagate PtraceSetRegs error on linux/ppc64le (#4321)
    * proc: fix SP calculation for sigpanic frames on arm64 (#4319)
    * proc: implement frame pointer unwinding (#4288)
    * service/dap: avoid Session.conn race in breakpoint-after-disconnect test (#4317)

++++ docker-compose:

  - Update to version 5.2.0:
    This version introduces a new reconciliation algorithm between
    the observed state and the expected state.
    If you experience any issues with a Compose workload that was
    previously working, please open an issue.
    * Improvements
  - Reconciliation plan by @ndeloof & @glours in #13830
  - Add rawsetenv message type for provider plugins by @rajyan in
    [#13742]
    * Fixes
  - Fix(build): skip remote URL contexts from bake fs.read
    allowlist by @ndeloof in #13816
  - Skip validation when extracting config variables by
    @scarab-systems in #13831
  - Fix(progress): probe stderr (not stdout) for TTY
    auto-detection by @glours in #13837
  - Fix(publish): honor env_file required: false for missing
    files by @Ijtihed in #13848
    * Internal
  - Docs: compose logs: add links for since/until flag
    descriptions by @thaJeztah in #13806
  - Ci: add Dependabot cooldown (20260603-170456) by
    @securityeng-bot[bot] in #13820
  - Docs(CLAUDE.md): note that commits must be signed off (DCO)
    by @ndeloof in #13817
  - Refactor: replace Split in loops with more efficient SplitSeq
    and replace HasPrefix+TrimPrefix with CutPrefix by
    @caltechustc in #13810
  - Chore: fix some comments to improve readability by @solunolab
    in #13823
  - GHA: update docs-upstream to pin workflows by sha by
    @thaJeztah in #13834
  - Docs: compose logs: add more links for flag descriptions by
    @thaJeztah in #13833
  - Fix/progress tty line overflow 13595 by @glours in #13840
  - Fix(publish): bypass Docker Desktop proxy for loopback
    registries by @ptrdom in #13825
  - Watch: do not rebuild depends_on services on file change by
    @ndeloof in #13856
  - pkg/e2e: fix malformed JWT in fixtures by @thaJeztah in
    [#13857]
  - pkg/e2e: drop unused run param from getEnv by @glours in
    [#13867]
  - Docs: ps --format json outputs JSON Lines, not a JSON array
    by @glours in #13868
    * Dependencies
  - Build(deps): bump github.com/docker/cli from
    29.5.1+incompatible to 29.5.2+incompatible by
    @dependabot[bot] in #13802
  - Update to go 1.26.4 by @thaJeztah in #13828
  - Chore(deps): github.com/containerd/typeurl/v2 v2.3.0 by
    @thaJeztah in #13829
  - Build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 by
    @dependabot[bot] in #13838
  - Chore(deps): github.com/docker/cli v29.5.3,
    github.com/docker/buildx v0.34.1, buildkit v0.30.0 by
    @thaJeztah in #13841
  - Build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by
    @dependabot[bot] in #13832
  - Chore(deps): golang.org/x/crypto v0.53.0 by @thaJeztah in
    [#13844]
  - Build(deps): bump github.com/containerd/containerd/v2 from
    2.2.3 to 2.2.4 in the go_modules group across 1 directory by
    @dependabot[bot] in #13804
  - Chore(deps): bump github.com/containerd/containerd/v2 to
    v2.2.5 by @thaJeztah in #13855
  - Chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1 by
    @thaJeztah in #13847
  - Chore(deps): github.com/docker/cli v29.6.0,
    github.com/docker/buildx v0.35.0, buildkit v0.31.0 by
    @thaJeztah in #13842
  - Bump compose-go to version v2.12.1 by @glours in #13865

++++ drawy:

  - Update to 1.0.2, Check the CHANGELOG.md file for the full list of
    changes.
    Fixes:
    * Multiple issues with group items and multi-selections acting
    incorrectly during rotation or resizing.
    * Canvas corruption bugs and visual artifacts that appeared
    when zooming or resizing the window.
    * Undo and redo history breaking after grouping items or
    clearing the canvas.
    * Loss of stylus pressure data when saving and loading files.
    * Bounding box and intersection logic errors for the Diamond tool.
    * Accidental duplication of items when attempting to translate
    them across the canvas.
    * Saved strokes failing to load correctly upon opening a document.
    * Property bar flickering rapidly when selecting new items.
    * Background color fills unintentionally applying to grouped
    polygon strokes.
    * Memory leaks and uninitialized variables flagged by internal
    analysis tools.

++++ esbuild:

  - update to 0.28.1:
    * Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)
    * Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
    * Avoid inlining using and await using declarations (#4482)
    * Fix module evaluation when an error is thrown (#4461, #4467)
    * Fix some edge cases around the new operator (#4477)
    * Fix renaming of nested var declarations (#4471)
    * Emit var instead of const for certain TypeScript-only
    constructs for ES5 (#4448)

++++ faugus-launcher:

  - Bump to version 1.22.6
  - Upstream changes:
    * fix ge proton arch in proton manager
  - For version 1.22.5:
    * Fix GE-Proton downloading the wrong-architecture build
    * remove duplicate faugus_png now centralized in path_manager
    * deduplicate lsfgvk paths and icon selection to path_manager
    * deduplicate launch args, addapp and lossless dialogs into utils
    * Removed lossless workaround
    * Keep lossless workaround for now
    * Remove dead code and unnecessary lossless cenversion
    * extract show_invalid_image_dialog() to utils.py
    * Update runner.py
    * Replaced run with Popen
    * Improved playtime accuracy
    * Fixed linux game not downloading umu
    * Fixed Show logs option unavailable
    * fix use elif for Proton path checks to prevent false error on Linux-Native
    * extract write_addapp_bat to utils.py
    * fix show game icon on splash when discrete GPU is enabled
    * centralize populate_combobox_with_runners to utils.py
    * Updated metadata screenshot
    * Updated screenshot
    * optimize logging I/O and remove unnecessary gc.collect()
    * Simplify selected() method and add null safety to context menu handlers
    * update(translation): updated 1.22 zh-CN.

++++ geeqie:

  - Update to version 2.8:
    + Extensive bug fixes and code improvements
    + More progress in GTK4 migration

++++ ghc-aws:

  - Update aws to version 0.25.3.
  - Switch from memory to ram to allow building with http-client-tls 0.4.x
  - Obsoletes "0001-switch-from-memory-or-ram-to-allow-building-with-htt.patch".

++++ giflib:

  - Added patch:
    * 0001-Fix-CVE-2026-26740-heap-OOB-write-in-EGifGCBToSavedE.patch
    + fixing bsc#1259836 (CVE-2026-26740): heap out-of-bounds read
    when processing a specially crafted GIF file containing a GCE
    block with a truncated extension byte count

++++ glab:

  - Update to version 1.105.0:
    * Features
  - c8fed254: feat(orbit): rename --format flag to
  - -response-format (Dmitry Gruzd dgruzd@gitlab.com)
    * Bug Fixes
  - e9a1266d: fix(orbit): handle new nested status response shape
    (Dmitry Gruzd dgruzd@gitlab.com)
  - 122f46f4: fix: route deprecation warnings to stderr (Kai
    Armstrong karmstrong@gitlab.com)
    * Dependencies
  - ba0f56a8: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.40.1 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - Update to version 1.104.0:
    * Features
  - 5380ef66: feat(duo): warn when running duo cli under snap
    confinement (Kai Armstrong karmstrong@gitlab.com)
  - 4ee1edf5: feat(packages): add upload command (Oscar Tovar
    otovar@gitlab.com)
  - 383d5994: feat: generate GitLab Docs navigation block for
    glab (Brendan Lynch blynch@gitlab.com)
    * Documentation
  - 6440f987: docs(skills): improve glab threaded-reply guidance
    (Thomas Schmidt tschmidt@gitlab.com)
    * Dependencies
  - 2ba749a0: chore(deps): update module charm.land/glamour/v2 to
    v2.0.1 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - 5f958dff: chore(deps): update module charm.land/lipgloss/v2
    to v2.0.4 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - 4e20a953: chore(deps): update module
    github.com/coder/websocket to v1.8.15 (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - 2f358bfa: chore(deps): update module golang.org/x/crypto to
    v0.53.0 (Jay McCure jmccure@gitlab.com)
  - d9be4c7a: chore(deps): update module k8s.io/client-go to
    v0.36.2 (GitLab Renovate Bot gitlab-bot@gitlab.com)
    * Maintenance
  - dd6eb3c8: chore: update labels in templates (Kai Armstrong
    karmstrong@gitlab.com)
  - 41afe2f6: refactor: uppercase initialisms in test key
    generators (Jay McCure jmccure@gitlab.com)

++++ gnome-control-center:

  - Update to version 50.3:
    + Updated translations.

++++ gnome-music:

  - Update to version 50.0:
    + Drop Grilo and use LocalSearch directly
    + Add volume controls accelerators
    + Refactor Repeat Mode Button into a separate class
    + Misc gstplayer refactoring
    + Icon is missing in «Add to Playlist» dialog
    + Updated translations
  - Add global __requires_exclude typelib\\(TSparql\\), filter out
    bogus typelib dependency.

++++ godot:

  - Unbundle mbedtls by dependening on mbedtls-devel < 4 since newer versions are not supported

++++ goshs:

  - Update to version 2.1.2
    New Features
    * Payload templating — Files can now be rendered as Go templates
    on the fly. Request a file with the ?tpl query parameter and
    {{.VAR}} placeholders are substituted at download time. Enable
    with --template and pass variables via the repeatable
  - -tpl-var KEY=VALUE flag (e.g. --tpl-var LPORT=4444). Ideal for
    serving payloads/scripts that need host- or port-specific
    values baked in without editing files on disk.
    * Resumable downloads (HTTP Range support) — The file handler now
    honors Range requests, enabling partial content responses and
    resumable/interrupted downloads of large files.
    Security Fixes
    * Bulk-download ACL bypass — Selecting a parent directory for
    bulk (zip) download no longer bypasses authentication or block
    rules defined in nested .goshs files. ACL is now enforced
    per-file during the recursive zip walk, and .goshs files are
    excluded from archives.
    * WebDAV ACL enforcement — Added a .goshs guard to the WebDAV
    interface so directory-level access controls are now applied
    over WebDAV as well.
    * Brute-force lockout reset — Failed-login lockouts now correctly
    reset after the lockout duration expires instead of remaining
    stuck.
    * Path handling — Removed a double URL-decode in sanitizePath so
    filenames containing literal % and + are preserved correctly.
    * Share creation crash — Fixed a missing return after a failed
    os.Stat in the share handler that could lead to a
    nil-dereference, plus a related error-message typo.
    Packaging
    * Refreshed shell completions (bash/zsh/fish) — added --ttl and
  - -tui, and corrected the FTP flag names.
    * Makefile cleanup and COPR spec fixes.
    * Fixed integration tests.

++++ hugo:

  - Update to version 0.163.1 (bsc#1269014, bsc#1269015):
    * releaser: Bump versions for release of 0.163.1
    * build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0
    * Fix multi --renderSegments merge behavior
    * security: Normalize integer IPv4 host encodings in http.urls check
    * Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists
    * Update CI workflow to exclude macOS
    * commands: Fix convert command
    * releaser: Prepare repository for 0.164.0-DEV
    * releaser: Bump versions for release of 0.163.0
    * pagesfromdata: Use relative path for content adapter template metrics
    * ci: Re-add macos-latest to the test matrix
    * build(deps): bump github.com/bits-and-blooms/bitset
    * build(deps): bump github.com/tetratelabs/wazero
    * all: Run go fix ./...
    * images: Deprecate Imaging.Compression and move it down to webp and avif configs
    * Only support the latest Go version
    * resources/jsconfig: Remove deprecated baseUrl setting
    * build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0
    * page: Add IsBranch and deprecate IsNode
    * images: Force cache invalidation for AVIF target
    * images: Add a per-format AVIF hint setting
    * build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0
    * images: Make AVIF chroma subsampling content-aware via the hint
    * Cap AVIF lossy quality at 99
    * config: Deprecate the glogal imaging quality setting
    * images: Make 60 the default quality for AVIF
    * livereload: Disconnect from websocket server on pageswap
    * tpl/tplimpl/embedded: Prevent leading newline in sitemap template
    * images: Recover from memory alloc errors in WASM image processors
    * images: Add quality setting per image format
    * all: Adjust tests for deprecated link and image render hook settings
    * misc: Remove duplicate words in comments
    * Add some PNG to AVIF golden test cases
    * releaser: Prepare repository for 0.163.0-DEV
    * releaser: Bump versions for release of 0.162.1
    * modules/npm: Fix false stale warning after npm pack
    * tpl/tplimpl: Fix X shortcode test
    * tpl: Skip broken x shortcode test
    * Revert "tpl/collections: Make dict return nil when no values are provided"
    * tpl/time: Fix locale-specific month abbreviations
    * releaser: Bump versions for release of 0.162.0
    * Disallow HTML content by default
    * Add image processing support for AVIF
    * config: Preserve intentionally empty maps
    * hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory
    * hugolib: Merge existing hugo_stats.json when renderSegments is set
    * all: Replace RWMutex struct caches with ConcurrentMap
    * tpl/tplimpl: Consolidate and improve embedded template integration tests
    * parser: Drop empty sub maps from hugo config output
    * markup/highlight: Allow overriding type and code via options
    * Fix typo in CONTRIBUTING.md
    * Remove note on refactoring contributions
    * Update AI assistance disclosure requirements
    * build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0
    * build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0
    * hugolib: Use AllTranslated in IsTranslated
    * tpl: Simplify sitemap template
    * tpl: Use AllTranslations in sitemap template
    * tpl/collections: Make dict return nil when no values are provided
    * Sync Go template package to 1.26.3
    * Squashed 'docs/' changes from 0755fb534d..1f8ddb8a52
    * resources: Fix the :counter placeholder
    * Upgrade to Go 1.26.3
    * ci: Check embedded template formatting with gotmplfmt
    * tpl: Run gotmplfmt -w .
    * build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0
    * build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2
    * markup/goldmark/codeblocks: Always split Chroma options into .Options
    * docs: Update docs.yaml
    * hugolib: Allow empty params front matter
    * commands: Fix import from Jekyll
    * common/hmaps: Merge slice-valued module config into site config
    * build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0
    * tpl: Use GetMatch for both local and global image resources
    * Revert "markup/tableofcontents: Skip empty TOC levels"
    * build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0
    * tpl/templates: Reject Defer inside partialCached
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    * common/hexec: Make NODE_PATH a fallback for ESM bare imports
    * build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1
    * config: Allow repeating the root key in /config files
    * Revise test naming guidelines in AGENTS.md
    * Update AGENTS.md
    * js: Return error for missing batch imports
    * resources/images: Keep smart crop target size
    * testing: Use synctest where relevant
    * Fix prevention of direct symlink reads in resources.Get
    * security: Validate redirects against security.http.urls
    * markup/tableofcontents: Skip empty TOC levels
    * Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds
    * agents: Add a note to Ai security researchers
    * deps: Upgrade to Chroma v2.24.1
    * commands: Fix github-dark chromastyles
    * css: Make css.Build's file-loader URLs absolute to web context root
    * hugolib: Don't warn about lang/kind/path coming from cascade.params
    * markup/goldmark: Unwrap inner HTML for plain code blocks
    * tpl/tplimpl: Extend page image lookup to include global resources
    * security: Allow hostnames starting with digits in default http.urls
    * commands: Improve description of command flags
    * releaser: Prepare repository for 0.162.0-DEV

++++ jenkins-x-cli:

  - Update to version 3.17.17:
    * Bug Fixes
  - make jx updatebot work (Mårten Svantesson)
    * Other Changes
    These commits did not use Conventional Commits formatted
    messages:
  - Revert "fix: ensure current directory is the working
    directory" (Mårten Svantesson)
  - Update to version 3.17.16:
    * Bug Fixes
  - ensure current directory is the working directory (Mårten
    Svantesson)
  - Update to version 3.17.15:
    * Chores
  - deps: bump anchore/sbom-action from 0.20.5 to 0.24.0
    (dependabot[bot])
  - Update to version 3.17.14:
    * Chores
  - deps: bump actions/checkout from 4 to 7 (dependabot[bot])
  - Update to version 3.17.13:
    * Chores
  - deps: bump actions/setup-go from 5 to 6 (dependabot[bot])
  - Update to version 3.17.12:
    * Bug Fixes
  - get rid of build warnings (Mårten Svantesson)
  - try to get cosign to work (Mårten Svantesson)
  - Update to version 3.17.11:
    * Chores
  - deps: upgrade jenkins-x-plugins/jx-promote to version 0.6.41
    (jenkins-x-bot-test)
  - Update to version 3.17.10:
    * Bug Fixes
  - change to use cosign 3 (Mårten Svantesson)
  - Update to version 3.17.9:
    * Bug Fixes
  - update sha (Test)
    * Chores
  - update coverage report to go 1.26.3 (Test)
  - upgrade coverage-report pr step to go 1.26.3 (Test)
  - amend all golint suggestions (Test)
  - upgrade go 1.26.3 (mentlak)
  - Update to version 3.17.8:
    * Chores
  - update go releaser image 1.0.3 (Test)
  - Update to version 3.17.7:
    * chore: change the name and website of the project
    * chore: upgrade golang to 1.26

++++ python-nbclassic:

  - Revendor node_modules.tar.xz to update ws >= 7.5.11
    (CVE-2026-48779, bsc#1268958)

++++ kubelogin:

  - Update to version 0.2.19:
    * What's Changed
  - Add optional Azure CLI subscription selection via
  - -subscription (-s) by @Copilot in #767
  - Return errors when cache cleanup fails by @pathei-kosmos in
    [#760]
    * Maintenance
  - Bump golang.org/x/crypto to v0.52.0 and Go to 1.26.4 by
    @Copilot in #781
  - Bump MSAL Go v1.4.2→v1.7.2 and azidentity v1.8.0→v1.14.0 to
    use form_post response mode by default for
    AcquireTokenInteractive by @vineeth-thumma in #778
  - Bump softprops/action-gh-release from 3.0.0 to 3.0.1 by
    @dependabot[bot] in #779
  - Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot]
    in #777
  - Bump mindsers/changelog-reader-action from 2.2.2 to 2.4.0 by
    @dependabot[bot] in #775
  - Bump docker/login-action from 3.0.0 to 4.2.0 by
    @dependabot[bot] in #774
  - Bump golangci/golangci-lint-action from 8.0.0 to 9.2.1 by
    @dependabot[bot] in #773
  - Bump docker/build-push-action from 5.1.0 to 7.2.0 by
    @dependabot[bot] in #772
  - Bump actions/upload-artifact from 4 to 7 by @dependabot[bot]
    in #771
  - Bump softprops/action-gh-release from 1 to 3 by
    @dependabot[bot] in #770
  - Bump mukunku/tag-exists-action from 1.6.0 to 1.7.0 by
    @dependabot[bot] in #769
  - Bump codecov/codecov-action from 6.0.1 to 7.0.0 by
    @dependabot[bot] in #768
  - Bump actions/checkout from 3.6.0 to 6.0.3 by @dependabot[bot]
    in #766
  - Bump actions/setup-go from 4.1.0 to 6.4.0 by @dependabot[bot]
    in #765
  - Bump peaceiris/actions-gh-pages from 3.9.3 to 4.1.0 by
    @dependabot[bot] in #764
  - Bump actions/download-artifact from 4 to 8 by
    @dependabot[bot] in #763
  - Bump peter-evans/create-pull-request from 5 to 8 by
    @dependabot[bot] in #759
  - Bump codecov/codecov-action from 5.1.2 to 6.0.1 by
    @dependabot[bot] in #758
  - Bump docker/setup-buildx-action from 3.0.0 to 4.1.0 by
    @dependabot[bot] in #757
  - Bump actions/dependency-review-action from 2.5.1 to 5.0.0 by
    @dependabot[bot] in #756

++++ ldacBT:

  - Update to version 2.0.2.5:
    + Allow build with CMake 4.0.0
    + Drop patch version in soname, built libraries will only have
    .so.2.0.2 suffix at most. This is to distinguish between
    library version and build script version.
    + Pin version to 2.0.2.3 in pkgconfig file for compatibility.
  - Modernize spec: use cmake_build and ldconfig_scriptlets macros.
  - Switch to source service, upstream no longer includes upstream
    libldac bundled tarball, so we now need to clone the git repo
    ourselves.

++++ shadowsocks-libev:

  - Build against the mbedtls 3.6 LTS line: switch BuildRequires from
    mbedtls-devel to mbedtls-3-devel. mbedtls 4.x removed the legacy
    mbedtls_cipher_* abstraction layer that shadowsocks-libev relies
    on (a proper fix needs a PSA-crypto port upstream), so track the
    3.6 LTS package which keeps the stable public API.

++++ libslirp:

  - Update to version 4.9.3+4:
    * Add CVE information
    * slirp: permit guestfwd to vhost_addr/vnameserver_addr
    * Test qemu migration support
    * Release v4.9.3
    * slirp: Fix migration break on incorrect vmstate retcode
    * Add missing diff url
    * Release v4.9.2
    * tcp_sockclosed: Set linger timer on remaining closing states
    * oob: cap urgent data count to what is actually available
    * bootp: allow https for UEFI HTTP boot
    * ncsi: Document the Get Version ID (GVI) packet handler
    * ncsi: Document why we fix memory alignment by adding 2-byte padding
    * ncsi: add documentation comments to the packet handler table for improved readability
    * Fix byte order
    * SO_ERROR: take the errno as error hint
    * vmstate: pass on read/write errors for state
    * cope with SO_ERROR possibly failing
    * Move the modified 3-Clause BSD text into LICENSE
    * fix: honor dns server port number on macos
  - fixes CVE-2026-9539 [bsc#1268903]

++++ loki:

  - Update to version 3.7.3:
    * fix(ci): prepare release 3.7.3
    * chore: Publish release images to the GAR mirror, skip docker plugin (#22549)
    * chore: Bump loki-release for the publish mkdir fix (#22540)
    * chore: Bump loki-release to pick up github-release fix (#22537)
    * fix(ci): Log into dockerhub (#22528)
    * fix(ci): Use latest version of loki-release for capital letter support (#22520)
    * chore(release-3.7.x): Release 3.7.3 (#22306)
    * fix(ci): Remove test checking for nfpm vars, like main (#22501)
    * fix(ci): Use latest workflow definitions for 3.7.x (#22496)
    * chore: Bump Go to 1.26.4 [release-3.7.x] (#22459)
    * chore(docs): Add migration guide from SSD to HA Monolithic [release-3.7.x] (#22462)
    * chore: Update Prometheus dependency to latest main [release-3.7.x] (#22404)
    * fix(security/UNKNOWN/): Update security golang.org/x/net to v0.55.0 [SECURITY] (release-3.7.x) (#22190)
    * fix(security/UNKNOWN/): Update security golang.org/x/crypto to v0.52.0 [SECURITY] (release-3.7.x) (#22189)
    * fix(security/UNKNOWN/): Update security golang.org/x/sys to v0.44.0 [SECURITY] (release-3.7.x) (#22191)
    * fix(security/UNKNOWN/cmd/dataobj-inspect): Update security cmd/dataobj-inspect golang.org/x/sys to v0.44.0 [SECURITY] (release-3.7.x) (#22193)
    * docs: Backport mermaid fix 3.7 (#22387)
    * fix(security/UNKNOWN/pkg/push): Update go toolchain directive to v1.25.11 [SECURITY] (release-3.7.x) (#22199)
    * docs: Update Helm charts docs (#22309) (#22326)
    * fix(security/HIGH/cmd/dataobj-inspect): Update module go.opentelemetry.io/otel to v1.41.0 [SECURITY] (release-3.7.x) (#22188)
    * fix(security/UNKNOWN/cmd/dataobj-inspect): Update go module directive to v1.25.11 [SECURITY] (release-3.7.x) (#22184)
    * fix(security/UNKNOWN/cmd/chunks-inspect): Update go toolchain directive to v1.25.11 [SECURITY] (release-3.7.x) (#22192)
    * fix(security/HIGH/): Update module github.com/containerd/containerd/v2 to v2.0.9 [SECURITY] (release-3.7.x) (#22187)
    * chore: Backport #19866 to 3.7.x (#21982)
    * ci: Backport GitHub App token broker changes to release-3.7.x (#21975)
    * docs: Switch from png to mermaid markdown and switch to alloy (#21939)
    * docs: Restore missing Helm Charts reference file (#21916)
    * docs: Spellcheck docs on 3.7 branch (#21699)
    * docs: Backport 21705 to 3.7 (#21877)
    * docs: Update Helm charts docs (backport release-3.7.x) (#21879)
    * docs: RN for 3.6.11 (backport release-3.7.x) (#21875)
    * docs: RN for 3.7.2 (backport release-3.7.x) (#21876)
    * docs: backport 21841 to 3.7 (#21871)
    * chore(release-3.7.x): release 3.7.2 (#21403)

++++ nbd:

  - Add nbd-fix-device-parsing.patch to fix nbdtab device parsing
    in all netlink paths (disconnect/check/connect), which broke
    dracut's TEST-72-NBD with nbd 3.27.1 (boo#1268185, upstream
    commit a80304e10e97)

++++ openQA:

  - Update to version 5.1782295118.57cb8aa0:
    * chore(deps): Dependency cron 2026-06-24
    * feat: Don't rewrite history for test result tabs
    * chore(deps): Dependency cron 2026-06-23

++++ perl-CPAN-Perl-Releases:

  - updated to 5.202.606.230 (5.20260623)
    see /usr/share/doc/packages/perl-CPAN-Perl-Releases/Changes

++++ pika-backup:

  - Update to version 0.8.3:
    * Add Ctrl+W shortcut to close window.
    * Fix details page not loading information when opened after
    scheduled backup started.

++++ postgresql14-postgis:

  - update to 3.6.4
    see full release note especially breaking changes
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.4/NEWS
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.3/NEWS

++++ postgresql15-postgis:

  - update to 3.6.4
    see full release note especially breaking changes
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.4/NEWS
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.3/NEWS

++++ postgresql16-postgis:

  - update to 3.6.4
    see full release note especially breaking changes
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.4/NEWS
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.3/NEWS

++++ postgresql17-postgis:

  - update to 3.6.4
    see full release note especially breaking changes
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.4/NEWS
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.3/NEWS

++++ postgresql18-postgis:

  - update to 3.6.4
    see full release note especially breaking changes
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.4/NEWS
    https://gitea.osgeo.org/postgis/postgis/raw/tag/3.6.3/NEWS

++++ python-avocado-plugins-vt:

  - Update to version 113.0:
    * Large catch-up from 88.0, tracking the avocado 113.0 release
    and dropping Python 2 support (Python 3 only)
    * Updated VM test providers and helpers for current QEMU,
    libvirt and KVM, including newer guest OS variants and
    machine types
    * Numerous virttest utility and networking fixes and improved
    handling of disk, migration and serial-console test scenarios
  - Adjust runtime dependencies to match upstream:
    * Require python-avocado >= 82.1 and add python-packaging
    * Drop python-netaddr, python-netifaces and python-simplejson,
    which avocado-vt no longer uses

++++ python-inspektor:

  - Update to version 0.5.3:
    * Fix a crash in the linter where LinterStats was accessed with
    a missing .get attribute

++++ python-aexpect:

  - Update to version 1.8.0:
    * Drop drop-use-of-pipes.patch (merged upstream)
    * Centralize all output handling into a single output function
    and fix losing log output before it is configured
    * Add a grep_pipe() helper and drop the internal use of pipes
    * Raise a clear error when aexpect_helper does not work
    * Fix a race where the tail thread could be unset before a
    close hook was added
    * Remote door: adjust the file-transfer port for custom setups
    and shorten control-file output to a readable length

++++ python-housekeeping:

  - Initial package (version 1.1)
    * Needed as a dependency of RBTools 6.0

++++ python-kgb:

  - Initial package (version 7.3)
    * Needed as a test dependency of python-pydiffx (RBTools 6.0 stack)

++++ python-pydiffx:

  - Initial package (version 1.1)
    * Needed as a dependency of RBTools 6.0
  - Add pydiffx-assertRaisesRegex.patch: fix the test suite on
    Python 3.12+ where the removed assertRaisesRegexp alias raised
    AttributeError (backport from upstream master)

++++ python-pymdown-extensions:

  - update to version 11.0:
    * BREAK: B64: Restricts relative links to base_path by default.
    * NEW: Drop Python 3.9 support.
    * FIX: Tabbed: Fix issue where an empty title would cause an
    exception.
  - increase minimum python version to 3.10

++++ python-pytest-codspeed:

  - Update to 5.0.3:
    [#]# Features
    * Skip Python runtime objects in callgrind
    * Use instrument_hooks markers in walltime
    * Declare native extension free-thread safe
    * Remove cffi in favor of native extension
    * Collect Python toolchain information via instrument hooks environment
    API
    [#]# Bug Fixes
    * Use instrument_hooks_callgrind_add_obj_skip from C API
    * Exclude setup time from benchmark in walltime mode
    * Fix segfault caused by multiple activate_stack_trampoline

++++ python-resultsdb_api:

  - Update to version 2.1.6:
    * Replace the deprecated logger.warn() with logger.warning()
    * More robust HTTP error handling: cope with responses whose
    JSON body is missing the expected message or cannot be parsed
    * Internal code-style cleanup
  - Drop support-pytest-9.patch (the patched testing/conftest.py was
    removed upstream); run the now fully-mocked test suite via
    plain pytest (the --functional gate was dropped upstream)

++++ setools:

  - Update to version 4.7.0:
  - Add MCP server to provide LLMs the ability to analyze policy.
  - Internal changes:
  - The source distribution is now a Python sdist.
  - The policyrep C extension is cythonized, so cython is
    an optional build dependency now. Still keeping it in, might be good
    to still rebuild it ourselves.

++++ python-typelets:

  - Initial package (version 1.1)
    * Needed as a dependency of RBTools 6.0

++++ python-yara:

  - Add patch use-dynamic-linking.patch:
    * Specify dynamic linking in setup.cfg.
  - Use pyproject macros to build and install the module.

++++ rubygem-hoe:

  - Update to version 4.7.0, see bundled History.rdoc

++++ rumdl:

  - Update to version 0.2.22:
    * Added
  - md077: add opt-in style = "aligned" for continuation indent
    (14eebe1)
    * Fixed
  - md040: keep blockquote fences valid when adding default
    language (eab51f6)
  - md013: keep blockquote markers when reflowing a blockquote
    nested in a list item (f601c8c)
  - Update to version 0.2.21:
    * Fixed
  - emphasis: align MD049 and MD037 with CommonMark flanking
    (#681) (d1b9968)
  - ci: bump pinned Rust toolchain to 1.96.0 to unblock mise tool
    install (b2afd76)

++++ velociraptor-client:

  - Add sysusers_requires macro to system-user-velociraptor

++++ tboot:

  - add tboot-grub2-fix-version-find-latest.diff: grub2-mkconfig no longer works
    with the tboot drop-in configuration files, because they rely on the no
    longer available "find_version_latest" (bsc#1266833). This patch provides
    drop-in replacements of that function based on the recommended
    "version_sort()" helper function.
  - update to version v1.11.12:
    Fix lcptools-v2 compilation error, caused by incorrect size of
    digest buffer allocation. The size of the digest buffer should be
    SHA1_DIGEST_SIZE, not sizeof(tb_hash_t).
    Fix SGX status verification. TBOOT used improper method of the SGX
    status verification. Added proper SGX status verification by checking
    both CPUID and MSR_IA32_FEATURE_CONTROL[bit 18]. If SGX is not
    enabled, TBOOT will print error message and return without doing the
    SVN check.
    Secure pointer to the TBOOT Log base from unauthorized DMA access.
    Defined new functions in tboot.h to return the base address of the
    TBOOT Log and validate its UUID, ensuring proper initialization.
    Provide DMA protection for global variable holding the number of e820
    entries. Defined a secure global pointer in OsMleData structure,
    protected from unauthorized DMA access, with verification procedure
    called before e820 map copying and TXT heap initialization.
  - update to version v1.11.11:
    Provide new cmdline option - "force_pmrs", which disabled TPR
    configuration and support both for TBOOT and SINIT ACM. TBOOT sets
    PMRs for SINIT ACM as it's default memory protection mechanism.
    Disable Intel CET technology, during TBOOT shutdown execution.
  - drop tboot-fix-alloc-size-warning.patch: now contained upstream.
  - drop tboot-cet.patch: now contained upstream.

++++ teleport:

  - update to 17.7.26:
    * Breaking changes
  - Kubernetes API server proxy access
    Access to the Kubernetes API server pods/{name}/proxy/{path},
    services/{name}/proxy/{path}, and nodes/{name}/proxy/{path}
    endpoints now requires the new proxy verb in
    kubernetes_resources.  Previously these endpoints were
    authorized as the get verb. Roles that use the Kubernetes API
    server proxy must add &#34;proxy&#34; to the relevant verbs
    list.
    * Other fixes and improvements
  - Fixed Teleport Connect file uploads for empty files. #67926
  - Fixed an issue where path separators could be included in scp
    file names during upload. #67773
  - Sanitized AWS console federation transport errors to avoid
    logging AWS session credential material. #67708
  - Fixed an SSRF vulnerability in AWS application access where a
    crafted X-Forwarded-Host header could divert IAM-signed AWS
    API requests to an attacker-controlled host. #67707
  - Cap AWS STS AssumeRole session duration to the Teleport
    identity TTL, including query-string AssumeRole requests and
    requests made with cached assumed-role credentials. #67705
  - Fixed role impersonation incorrectly being affected by user
    allow/deny rules. #67690
  - Prevented users with the same name in different clusters from
    being able to cancel each others' remote port forwards.
    [#67688]
  - Update golang.org/x/crypto to v0.53.0. #67641

++++ tik:

  - Update to version 1.5:
    * Refactor tik (#62)
    * [10-welcome] increase btrfs filesystem size to max

++++ velociraptor:

  - Add sysusers_requires macro to system-user-velociraptor

++++ werf:

  - Update to version 2.71.0:
    * Features
  - build: add commit to build report for images and stages
    (#7566) (38be712)
    * Bug Fixes
  - build, stapel, import: importing into symlinked directories
    no longer silently loses files (#7545) (9d1bb68)
  - deploy: autodependencies between pods/controllers,
    rolebindings and serviceaccounts (#7567) (f152352)

------------------------------------------------------------------
------------------  2026-6-23  -  Jun 23 2026  -------------------
------------------------------------------------------------------

++++ AusweisApp:

  - New upstream release
    + Version 2.5.3
  - Update of OpenSSL to version 3.6.3.

++++ MozillaFirefox:

  - Mozilla Firefox 152.0.2
    https://www.firefox.com/en-US/firefox/152.0.2/releasenotes/
    * Fixed some Settings section headings showing placeholder text
    instead of the translated name in certain languages
    (bmo#2047983)
    * Fixed New Tab content not matching the browser's display
    language after it was changed. (bmo#2046945)
    * Fixed a regression that could break playback of some MP4 video
    files (bmo#2047467)
    * Fixed a performance regression that could slow down sites
    performing many encryption and decryption operations at once,
    such as Proton Drive (bmo#2046401)

++++ agama:

  - Allow adding optional resolvables (gh#agama-project/agama#3649).

++++ agama-web-ui:

  - Unify the localization settings into a single form: replace the
    separate language, keyboard and time zone selection pages with
    one form using a searchable typeahead for each
    (gh#agama-project/agama#3661).
  - Explicitly require "monaco-editor" NPM package to fix a build
    failure in OBS (related to bsc#1268433)

++++ agama-yast:

  - Do not take zypp lock (bsc#1268344).
  - Avoid calling to YaST software and configure products to include
    os-prober as optional package.

++++ amake:

  - Update to version 0.5.0:
    * chore: update project version to 0.5.0 (#22)
    * build(deps): bump actions/checkout from 6 to 7 (#21)
    * build(deps): bump assert_cmd from 2.2.1 to 2.2.2 (#19)
    * feat: implement model selection (#20)
    * feat: add `pi` adapter

++++ apache-commons-csv:

  - Do not use spotbugs annotations. They create build cycle

++++ arkade:

  - Update to version 0.11.102:
    * Add pluto CLI to find deprecated K8s APIs
  - Update to version 0.11.101:
    * Make symlink extraction in UntarNested conditional
    * Fix symlink path-traversal escape in UntarNested
    * Remove stray file

++++ asn1c:

  - Update to version 0.9.29
    FEATURES:
    * Added support for basic Information Object Sets driven code generation.
    * Added OER support.
    * Added LTE RRC example (Bi-Ruei, Chiu).
    * Added IEEE 1609.2 example.
    * Added SAE J2735 example.
    NOTABLE:
    * Converter example (included by default):
    + converter-sample.c renamed into converter-example.c
    + make converter-example.mk file for building that
    converter.
    + asn1c -no-gen-example to stop generating
    converter-example.{c,mk}.
    * asn1c -no-gen-example option to disable converter-example
    generation.
    * Added random value generation (-R option to converter-example).
    * Added LibFuzzer-based randomized tests for supported transfer
    syntaxes.
    * (DER, OER, UPER, XER) into tests/tests-randomized. See the
    following * article to get the latest LibFuzzer-enabled clang
    on macOS:
    https://medium.com/@levwalkin/compile-llvm-clang-libfuzzer-b61e82718430
    then ensure the new clang is in the way:
    CC=clang CXX=clang++ ./configure --enable-Werror
  - -enable-test-fuzzer
    * OBJECT IDENTIFIER and RELATIVE-OID API simplified.
    * uper_encode() API got new argument (breaks API compatibility).
    * asn1c -gen-XXX flags are deprecated. Use -no-gen-XXX to disable
    codecs.
    FIXES IN COMPILER-GENERATED OUTPUT:
    * Fix incomplete (failed) CHOICE XER decoding memory leak.
    * Fix REAL type overwrite conversion memory leak.
    * Fix UPER string decoding constrained only by lower bound > 0
    * Fix UPER decoding of large [bit-]strings of size a multiple of
    16K.
    * Fix XER decoder crash on maliciously constructed ENUMERATED
    input.
    * Fix XER decoder of INTEGER, OBJECT IDENTIFIER, and RELATIVE-OID
    In some cases an INTEGER overflow during parsing is not
    detected and incorrect value is returned to the decoder instead
    of an error.
    * Fix BER CHOICE decoding infinite loop.
    FIXES IN TOOLING:
    * CVE-2017-12966 verified not present. Fix unber buffer overrun.

++++ aurorae6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ avalon-framework:

  - Split the api and impl artifacts in two different builds in order
    to break build cycle with apache-commons-logging

++++ avalon-framework-api:

  - Split the api and impl artifacts in two different builds in order
    to break build cycle with apache-commons-logging

++++ blktests:

  - Add 0001-tests-md-allow-overriding-minimum-kernel-version-via.patch
    to allow overriding the minimum kernel version for md tests via
    BLKTESTS_MD_KVER environment variable, to support distro kernels
    with backported atomic write support
  - Update to version 0+20260623.5a62429:
    * scsi/009: fix unset bytes_to_write in TEST 8
    * ublk: mark all tests as QUICK
    * throtl/008: Add a test for the iocost cgroup controller
    * nvme/059: fix unset bytes_to_write in TEST 7
    * common/nvme, nvme/rc: use _set_attr() to trace attribute writes
    * common/rc: add _set_attr() function to trace attribute writes
    * check: add --cmd-trace option
    * nbd/rc: redirect nbd-server stderr
    * nvme/064, src/nvme-passthrough-meta.c: test a large metadata_len
    * nvme/068: add a test for multipath delayed removal
    * loop: add regression test for partscan double-scan race
    * throtl/{002,003,007}, zbd/014: use _get_page_size to get PAGE_SIZE

++++ bluedevil6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ breeze6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ bshoshany-thread-pool:

  - Update to 5.1.0 (major v5 series):
    * v5.0.0: major release adding C++20/23 module support while
    retaining full C++17 compatibility, with API changes (see the
    upstream CHANGELOG for migration notes)
    * v5.1.0: add detach_bulk()/submit_bulk() to submit tasks in bulk
    while locking the task-queue mutex only once
  - The BS_thread_pool_utils.hpp helpers are now part of the single
    BS_thread_pool.hpp header, so the separate utils header is no
    longer shipped

++++ bugzilla-mcp:

  - Update to version 0.15.1

++++ cargo-packaging:

  - Update to version 1.5.0+0:
    * Revert addition of --release flag (#18)
    * Don't force --locked to allow some vendoring conditions (#17)

++++ chromium:

  - Chromium 149.0.7827.196:
    * stability and performance improvements

++++ cifs-utils:

  - Update cifs-utils to 7.6
    * cifs.upcall: remove getpwuid() dependency
    * smbinfo: update notify subcommand
    * smbinfo: add filecompressioninfo subcommand
    * cifs.upcall: Adjust log level
    * docs: Enable debug logs
    * cifs.upcall: add option to enable debug logs
    * cifs.upcall: Retry krb5 TGS request with uppercase service name
    * mount.cifs: remove runtime pass_length calculation
    * mount.cifs: adjust get_password_from_file() buf size
    * build_assert: add ccan build_assert.h header
    * mount.cifs: fix buffer overrun in set_password
    * smbinfo: fix decimated subseconds in smbinfo filebasicinfo timestamp output
    * smbinfo: add notify subcommand
    * docs: update username= option to drop invalid examples
    * cifs.upcall: fix calloc() argument order in main()
    Fixes from 7.5:
    * docs: update echo_interval description
    * cifscreds: fix parsing of commands and parameters
    * cifs-utils: Fix documentation for character remappings.

++++ lagrange:

  - update to 1.20.8
  - Adjusted first-line indentation so it not applied to text that looks like
    lists (starts with punctuation, numbers, etc.).
  - Updated UI translations.
  - update to 1.20.7
  - Fixed: Text layout overflow when monospace body appearance is enabled with
    Gemini. (It was getting confused with normal plain text.)
  - Fixed: Link icons not matching the body font size.
  - Fixed: Link numbers/letters not matching the body font size.
  - Fixed: Content width expansion in Gopher menus. (Line width measured
    incorrectly.)
  - Adjusted first-line indentation to only occur when both previous and current
    paragraphs are getting wrapped.

++++ codespell:

  - Add missing python3-base BR

++++ nodejs24:

  - Update to 24.17.0
    (CVE-2026-48618, bsc#1268593) tls: normalize hostname for server identity checks
    (CVE-2026-48933, bsc#1268592) crypto: guard WebCrypto cipher output length
    (CVE-2026-48615, bsc#1268598) lib,test: redact proxy credentials in tunnel errors
    (CVE-2026-48619, bsc#1268618) http2: cap originSet size to prevent unbounded memory growth
    (CVE-2026-48928, bsc#1268605) tls: fix case-sensitive SNI context matching
    (CVE-2026-48930, bsc#1268606) dns,net: reject hostnames with embedded NUL bytes
    (CVE-2026-48934, bsc#1268608) tls: bind reusable sessions to authenticated host
    (CVE-2026-48617, bsc#1268554) permission: handle process.chdir on writereport
    (CVE-2026-48931, bsc#1268611) http: fix response queue poisoning in http.Agent
    (CVE-2026-48935, bsc#1268609) permission: disable FileHandle utimes with permission model
    (CVE-2026-48937, bsc#1268555) http2: servers keep accepting data even after sending a `GOAWAY` frame
    (CVE-2026-12151, bsc#1268482) undici: Denial of Service due to unbounded memory growth via WebSocket frames
    (CVE-2026-6733,  bsc#1268479) undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery
    (CVE-2026-9679,  bsc#1268477) undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding
    (CVE-2026-11525, bsc#1268481) undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
    (CVE-2026-2581,  bsc#1268480) undici: Denial of Service due to uncontrolled resource consumption
    (CVE-2026-9678,  bsc#1268478) undici: Information disclosure due to improper cache-control header parsing
    (CVE-2026-27135, bsc#1259853) nghttp2: assertion failure due to missing state validation can lead to DoS
  - ngtcp2_bsc1262274.patch: (CVE-2026-40170, bsc#1262274) - ngtcp2: qlog parameters_set stack buffer overflow.
  - pacote-bsc1266318.patch: (CVE-2026-9496,  bsc#1266318) - pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` value can lead to DoS
  - ip-address-bsc1268097.patch: (CVE-2026-42338, bsc#1268097) - ip-address: Cross-site scripting via improper HTML escaping of untrusted input
  - fix_ci_tests.patch: rebased
  - For changes in older versions, see
    https://github.com/nodejs/node/releases

++++ crossplane-cli:

  - Update to version 2.3.3:
    The v2.3.3 release is a patch release that fixes bugs in several
    commands and updates dependencies.
    * deps: Bump crossplane dependencies to v2.3.3
    * chore(deps): update module github.com/containerd/containerd to
    v1.7.33 [security]

++++ deluge:

  - Remove unused BuildRequires: python3-slimit (commit a03e649)

++++ discover6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * rpm-ostree: Wait for 60 seconds before looking at deployments
    * rpm-ostree: Limit filesystem watcher triggers (kde#519672)
    * appiumtests: fix removeButton click
    * Generate valid appstream:// URLs for Flatpak apps

++++ dnsmasq:

  - Update to 2.93:
    * CVE-2026-12725, bsc#1268764: Heap buffer overflow in
    `log_query()` when logging unsupported DS/DNSKEY replies.
    * CVE-2026-12969, bsc#1268882: out-of-bounds read in `find_soa()`
    due to missing extrabytes validation.
    * Fix a corner-case in DNSSEC validation with wildcards.
    * Fix DNSSEC failure with spurious RRSIGs.
    * Fix DNSSEC fail with CNAME replies to DS queries.
    * Fix regression in 2.92 release which broke DHCPv6 when a DHCP
    relay is in use.
    * Modify the inotify implementation so that inotify watches are
    only created after dnsmasq has changed permissions and userid.
    * CVE-2026-2291: Rework storage allocation for domain names.
    * Obsoletes dnsmasq-CVE-2026-6507.patch
    * Obsoletes dnsmasq-Fix-FTBFS-nettle-4.0.patch

++++ docker:

  - Ensure correct certificate is used for TSA auth
    (bsc#1262346, CVE-2026-39984)
    * 0007-CVE-2026-39984-Ensure-correct-certificate-is-used-fo.patch
  - http2: prevent hanging Transport due to bad SETTINGS
    (bsc#1265782, CVE-2026-33814)
    * 0008-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch
  - idna: update from x/text, fix ToUnicode and all-ASCII xn-- labels
    (bsc#1266625, CVE-2026-39821)
    * 0009-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch
  - daemon: Decompress archives before entering container filesystem
    (bsc#1267827, CVE-2026-41567)
    * 0010-CVE-2026-41567-daemon-Decompress-archives-before-ent.patch

++++ doggo:

  - Update to version 1.2.0:
    * New Features
  - 58781f2: feat: add --authoritative/-A flag to query the
    domain's authoritative nameserver (@nopolabs)
    * Bug fixes
  - 8a97e57: fix(app): use delegated NS RRset for authoritative
    queries (@nopolabs)
    * Others
  - 4c3bf3d: chore(ci): use patched Go toolchain (@mr-karan)
  - 86ff8f4: chore(release): prepare v1.2.0 artifacts (@mr-karan)
  - 7dbf633: docs(README): change arch package name (@Souvlaki42)

++++ drkonqi6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ elemental:

  - Initial package for openSUSE Factory (3.0.0)

++++ elixir:

  - Upgrade to Elixir 1.20.2:
    * Changelog available at https://hexdocs.pm/elixir/1.20.2/changelog.html

++++ fabtests:

  - Update to v2.6.0
  - Core
  - ofi_atomic_queue: convert from MPMC to MPSC
  - hmem: Add additional CUDA wrapper functions
  - man: Fix reference to fi_mr_raw_attr()
  - common: Fix byte order of AF_IB ofi_addr_set_port
  - common: Do not assert on truncated buffers
  - man: Update efa man page to reflect zero copy mode deprecation
  - configure.ac: Fix --enable-xpmem=yes
  - man: Clarify FI_INJECT + FI_HMEM restriction
  - core: Replace indirect held, lock, and unlock function calls
  - CXI
  - Fix spelling of "receive" across CXI provider
  - Extend timeout for sw_max_recv msg test
  - Refuse cancel for receives with RDMA in flight
  - Add test for TLE pool sharing from the default service
  - Added FI_SUCCESS return to rnr recv cb
  - Minor tweak to append_oflow test
  - Handle LE append failure for RNR recv
  - Fix minor size check in RNR send_common
  - Check FI_CXI_CTRL_RX_EQ_MAX_SIZE for 0
  - New mr test to check buffer attributes
  - EFA
  - use cmocka's "void ** state" signature in unit tests for C23
  - honor homogeneous_peers in efa_rdm_interop_rdma_read
  - Drive real completion handler in local-read unit test
  - NULL local_read_pkt_entry after data-copied hand-off
  - Track efa_rx_pkts_held with a per-pkt flag
  - Fix pkt leak in efa_rdm_ep_post_queued_pkts on error
  - Fix direct_ope leak on error in efa-direct send/recv/rma
  - remove trailing whitespaces in the mr unit test.
  - Gate the pps interface with feature flag
  - Add rdma-core path support for WQE-level PPS hints
  - Implement WQE level PPS hints in data-path-direct
  - Add efa-specific operational flags for high PPS
  - Guard hardware counter with FI_EFA_USE_HW_CNTR
  - Add feature flag FI_EFA_USE_HW_CNTR
  - Use hardware counter in fi_cntr_open
  - Add fi_cntr_wait for hardware counter
  - Attach hardware completion counter to QP
  - Extend GDA domain op to support hardware cntr with external memory
  - Add hardware counter operations
  - Advertise hardware counter max value in fi_getinfo
  - Set the correct cntr_cnt in domain_attr
  - Baseline the read nack extra feature
  - Baseline the runt extra feature
  - Baseline the connid header extra request
  - Validate dmabuf provided when setting FI_MR_DMABUF
  - Fix pkt_entry double-free during endpoint teardown
  - Add missing txe release check in dc ctsdata packet
  - Destroy buffer pools when pke_vec alloc fails in ep_open
  - Fix info and util_ep leak on efa_recv_wr_vec calloc failure
  - Add assert guards for iov_count bounds in atomic, rma, and srx
  - Propagate robuf allocation failure from peer_construct
  - Check util_cq refcount before destroying ibv_cq in close
  - Clear EFA_RDM_PKE_RNR_RETRANSMIT in peer_destruct
  - Bounds-check fi_mr_attr.iface before indexing g_efa_hmem_info
  - Initialize srx_lock early in efa_domain_open
  - Stop returning early from efa_domain_close
  - Use ret directly in efa_domain_open
  - Do a proper cleanup in case of a fork handler failure
  - Do a proper cleanup in case of an unsupported endpoint type
  - Drop dead assignment to local efa_domain
  - Remove trailing whitespace in efa_domain.c
  - Write CQ error instead of EQ error for unsolicited write recv
  - Extract efa_rdm_cq_write_error() helper for CQ error with EQ fallback
  - Always build rdma-core WQE post functions in header
  - Fix length field in data_path_direct tracepoint
  - Fix out-of-bounds array access in tracepoint post_send
  - Add unit-test for util_foreach_unspec
  - Add FI_EFA_FEATURE_OPS for runtime feature discovery
  - test: Verify EAGAIN when pre-handshake queue is full
  - Separate CNTR into independent efa-direct and efa-rdm implementations
  - Suppress duplicate error CQ/counter for ops errored synchronously
  - Add test confirming multi-packet send is not susceptible to partial-post
  - Fix same double-free pattern in multi-segment RDMA read path
  - Fix double-free on partial multi-segment RDMA write failure
  - Store EFA-internal txe flags in internal_flags, not fi_flags
  - Fix -Wpointer-arith warnings on ARM
  - Remove handshake requirement for DC
  - Remove zero copy receive path, keep send path for compat
  - Move memory alignment helper to header as static inline
  - Inline and remove efa_rdm_ep_alloc_txe
  - Check if the send queue is full earlier
  - Add ep->send_pkt_entry_vec_size
  - Check all descs for HMEM in efa_post_send inline path
  - test: Fix flaky QPN collision in implicit AV unit tests
  - Fix NULL deref in efa_av_reverse_av_remove on QPN collision
  - Fix FI_INJECT in efa direct
  - Remove incorrect assert in test_efa_data_path_direct_qp_gen_initialization
  - Improve error message for ibv_create_ah failure
  - Subtract prefix size in inject assertion for dgram
  - Optimize shm address retrieval in RDM operations
  - test: Cast the qp gen when doing the comparison
  - Fix race between fi_av_lookup and fi_av_remove
  - Fix the max_msg_size validation for efa-direct
  - Preserve shm MR close error in efa_rdm_mr_close
  - Fix ineffective error check on ofi_get_page_size()
  - Fix use-after-free when TX and RX share the same CQ
  - Fix unchecked strndup return in get_sysfs_path
  - Improve the warn log in efa_mr/efa_rdm_mr
  - Introduce a warning macro for fi errno
  - Fix unused return codes
  - Honor user-requested QP sizes within device limits
  - Fix missing mem_desc and iface initialization in non-p2p path
  - Separate core MR logic from RDM-specific MR implementation
  - LNX
  - Update handling of deprecated FI_AV_MAP
  - Fix lnx capability settings and checking
  - Move environment variables into a global struct for easy access
  - Cleanup and reorganization
  - OPX
  - Lower GDRcopy threshold/Allow HMEM MP Eager
  - Initialize deferred HFISVC receive contexts
  - Make OPENED MR notify non-owning for rzv completion
  - Document HMEM-dependent FI_OPX_RZV_MIN_PAYLOAD_BYTES defaults
  - Reject incompatible MR registrations when HFISVC is enabled
  - Handle MP eager FI_CLAIM receives
  - Drop mm lock before memory operations
  - Remove SDMA queue ring size workaround
  - Remove global hfi_local_info
  - Fix origin_rx in realibility ping, ack and nack
  - Store HFI selection per-domain
  - Use generation-agnostic fabric name and RDMA device domain name
  - Populate fid_nic in fi_getinfo with device/bus/link attributes
  - Remove fabric from linked list in close paths
  - Restore fd_verbs (hfi direct) support
  - Dual plane: Send only context
  - Dual plane: Environment variables
  - Fix no common tx context error
  - Dual Plane: Stripe data across two HFISVC clients in dual/single plane
  - Fix reliability origin_rx access
  - sriov support for lmc/lid hairpin
  - Dual plane: Reliability and reply path changes
  - tracer BEGIN/END instrumentation fixes
  - Unsubscribe when entry is removed from cache.
  - FI_MR_DMABUF mr_regattr using invalid addr
  - Catch hfi config error earlier and fail
  - Add valid() calls to opx caching
  - Do not fail kdreg2
  - Don't use FI_DELIVERY_COMPLETE for MSG/Tagged sends
  - Add full FI_DELIVERY_COMPLETE support for MSG/Tagged sends
  - HSA_STATUS_ERROR_INVALID_ARGUMENT IPC RZV Send
  - SLES compilation fix
  - Remove #if 0 dead code
  - MP Eager data validation fix
  - Dual plane - addressing, plane selection and shm
  - Populate PCI bus attributes in fi_info from sysfs
  - OPX Tracer v2
  - Dual plane: Multiple tx and ibv context
  - Restore debugging #ifdef
  - change all CUDA calls to use ofi wrapper functions
  - Reduce warnings
  - Fix use_cnt/mmu windows
  - Fix rendezvous partial registration
  - Unlock mm in shm signal
  - Open HFISVC completion queue on RX CQ when separate from TX CQ (#1321)
  - Fix extended addr allocation during av insert
  - Compute sbuf_offset for non-dmabuf MRs in hfisvc RTS
  - Fix CTS replay payload for RMA GET
  - Support 9B HFI Service
  - store dmabuf base_addr as page-aligned fd start
  - Always poll domain and CQ's HFI service completion queues during CQ Read
  - Fix DMABUF HFISVC addr/offset calculation
  - Fix MP Eager replays for 9B headers
  - Sync HMEM stream before destroy
  - Prevent RDMA lib close in uninitialized state
  - Only close DMABUF fd when created by OPX
  - Remove dead code in rendezvous CTS path
  - Fixing issue in av_insert when using av_table
  - Trivial FI_WARN update
  - Initialize OPX ref counters
  - Fix build error in hmem path for av_type
  - Use ofi_atomics for reference counting.
  - Changing av_map to work like av_table internally
  - Invalid RDMA ops ref counter decrement
  - Segfault with NCCL/RCCL Plugin & HFISVC
  - Enable container build
  - Fix non-powers of 2 rcvhdrcnt
  - Fix mismatched alignment attribute between packet header & payload unions.
  - Use correct device with DMABUF support
  - Fix use of DMABUF fd in the OPX mr
  - Update SDMA/RZV threshold for AMD GPUs
  - fix fi_opx_open_command_queues() segfault
  - Only require DMABUF for HFISVC for HMEM
  - Added hmem_dev_reg_handle so receive side can use ROCr Copy
  - Remove debug log of every reliability inject
  - Add DMA-BUF offset to buffer offset calculation
  - DMABUF support for HFI service
  - MR Registration with HFI service
  - Fix reliability key in reliability debug logs
  - Remove unnecessary csr reads
  - Dynamically growable access_key pool for HFI service.
  - PSM3
  - Internal polling must use timeout to prevent infinite loop during resources acquiring
  - RXD
  - Remove rxd_mr_verify dead code
  - RXM
  - Fix ignored domain_attr->cq_data_size hint
  - SHM
  - DL initialize mem and monitors
  - Register max_gdrcopy_size env var
  - Do not return local cmd copy in smr_discard
  - Remove init_fn from cmd queue release path
  - Fix the error flag propagation
  - Let atomic_inline use smr_flags for format
  - Revert to a lock-unlock inject pool
  - Fix compile warning coming from shm
  - Do not take inject for op_read_req
  - Do not check for total_len < inject_size on rma_fast
  - Push cmd back to stack on error
  - remove cmd_entry ptr
  - Remove 0-byte copy SAR
  - Move inject pool above command stack
  - Use hdr.sm

++++ falco-libs:

  - Add support-bshoshany-thread-pool-v5.patch: build against
    bshoshany-thread-pool 5.x, where BS::thread_pool became a class
    template; the patch aliases it version-agnostically so the source
    still builds against both v4 and v5 (submitted upstream)

++++ flatpak-kcm6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - No code changes since 6.7.0

++++ fleet-cli:

  - Update to version 0.15.3:
    * Validate resolved paths stay within the clone directory (#5277)
    * Migrate integrationtests Docker SDK path (#5272)
    * Validate kubeConfig Namespaces against known Fleet namespaces
    (#5243)
    * Update dependency go to v1.25.11 (#5238)
    * self-heal BD secret when having a hash mismatch (#4963) (#5233)
    * Update Kubernetes dependencies (release/v0.15) (#5231)
    * [v0.15] - webhooks handling update (#5227)
    * Fix fleet-agent bundles not deleted when cluster is deleted
    (#5228)
    * [v0.15] Reintroduce legacyscheme defaults for drift detection
    (#5222)
    * Normalize YAML flow-style docs in post-renderer [SURE-11642]
    (#5180) (#5223)
    * Add tests for namespace label sync (#5203)
    * [v0.15] - Use Custom CAs when pulling OCI artifact (#5128)
    (#5183)

++++ gdal:

  - Build the Python bindings for all supported interpreters
    instead of only the default one (boo#1246076):
    * compile the C++ core once and build the osgeo bindings for
    each supported Python flavor against it
    * move the Python command line utilities (gdal_calc.py, ...)
    into a new noarch gdal-python-tools subpackage
  - Enable additional format drivers that are shipped by other
    distributions:
    * CFITSIO (FITS), Qhull, HEIF, JPEG-XL, AVIF and Blosc support
    * enable libdeflate support explicitly
  - Drop build constructs for the now-EOL Leap 15 / SLE 15
    codestreams (gcc 13 override, sle15 python module macros)

++++ gemini-cli:

  - update to 0.47.0:
    * chore(release): bump version to
    0.47.0-nightly.20260602.gcfcecebe8
    * Changelog for v0.46.0-preview.0
    * Respect backend definitions for 3.5 flash and Update auto
    mode to use 3.5 flash when the flag is enabled.
    * fix(policy): add EBUSY fallback and TOML parse recovery
    * Changelog for v0.45.0
    * update the max amount of times the Antigravity transition
    banner can be displayed.
    * chore: remove experimental text from browser agent docs
    * fix(core): implement atomic update in MCP tool discovery
    * Vertex ai model mapping fix
    * Add documentation and migration commands for Antigravity CLI
    * Avoid persisting empty resume sessions

++++ ghc-hackage-security:

  - Update hackage-security to version 0.6.3.3.
    0.6.3.3
  - ------
    * Remove `lukko` package flag. Now we unconditionally use `GHC.IO.Handle.Lock`
    instead of the [`lukko` package](https://hackage.haskell.org/package/lukko).
    * Allow `Cabal-3.18` and `Cabal-syntax-3.18`.
    * Allow building against newer releases of other dependencies.
    * Tested with GHC 8.4 - 9.14.

++++ python-Glances:

  - Update to 4.5.5 (fixes CVE-2026-46606 (bsc#1268800), CVE-2026-46607
    (bsc#1268854), CVE-2026-46608 (bsc#1268855), CVE-2026-46611 (bsc#1268856),
    CVE-2026-53925 (bsc#1268984))
    * /api/4/containers stays ~4-5s with ~60 Docker containers #3559
    * Crash when using --sparkline #3547
    * VMs section does not show LOAD 1/5/15min values #3535
    * Fix AMD GPU detection for multi-digit DRM card numbers #3578
    * Keep auto_unit within limits, so columns stay aligned #3558
    * Rest status check shouldn't require auth #3544
    * Logging configuration to use boolean value #3536
    * Fix filesystem aliases for mixed-case mount points #3532
    * Regression in Disk I/O reporting #3546
    * Add meter for CPU and MEM of GPU in the Quicklook plugin #1711
    * Add cpu limit to docker, podman and lxd containers #3557
    * GPU Monitoring (ARM / RaspberryPi) #1048
    * GPU plugin: display proc and temperature on NVIDIA Jetson (Tegra)
    integrated #3580
    * Arbitrary file write and command execution in AMP command
    configuration - Correct CVE-2026-53925
    * XML-RPC Server Missing Host Header Validation Enables DNS
    Rebinding Attack - Correct CVE-2026-46611
    * XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard
  - Correct CVE-2026-46608
    * Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code
    Execution - Correct CVE-2026-46607
    * Command Injection via KVM/QEMU VM Domain Names in virsh.py - Correct
    CVE-2026-46606
    * Add top 10 slowest plugins summary at end of --issue output #3572
    * Update documentation for hide/show #3546
    * Refactor: Improve load_additional_plugins Maintainability, Safety, and
    Plugin Discovery #3561
    * Refactor: Reduce Cyclomatic complexity of __display_top Issue #3549
    * Refactor: Reduce Cyclomatic complexity of display_popup() #3542
    * Refactor: Compute spacing
    * Refactor: handle quicklook required for display²
    * Refactor: Get plugin Width & get stats summary
    * Add unit test to containers/docker plugin

++++ go-sendxmpp:

  - Update to 0.16.0:
    Added:
    * Add Ox support to http-upload.
    * Add Ox support for private group chats.
    * Show error cause if joining MUCs failedi (requires go-xmpp >= v0.3.5).
    Changed:
    * Fix --ox-delete-nodes.
    * Fix receiving of 1-1 messages while joined in a MUC.
    * Use go-sendxmpp + a random ID as fallback MUC alias.
    * Strip leading "xmpp:" from recipients.
    * Strip trailing "?join" from MUC JIDs.
    * Add context for timeouts in stanza handling.
    * Check ID for disco items reply (requires go-xmpp >= v0.3.6).
    * Reduce channel buffer size to 1 where only one item will be returned.
    * Deprecate legacy PGP.
    * CVE-2026-1229: The CombinedMult function produces an incorrect value (bsc#1265538)
    Bump circl to 1.6.3
    * CVE-2026-39821: Failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266617)
    Bump net to 0.56.0

++++ godot3:

  - Require mbedtls-devel < 4 since newer versions are not supported

++++ grafana:

  - Require Go >= 1.26 for building
  - Add UI web assets as additional source tarball

++++ breeze6-gtk:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ hashlink:

  - Require mbedtls-devel < 4 since newer versions are not supported

++++ hawk2:

  - bump nokogiri-1.19.2 --> 1.19.4 (bsc#1268688,bsc#1268693,bsc#1268698,bsc#1268703,
    bsc#1268712,bsc#1268713,bsc#1268718,bsc#1268723,bsc#1268729,bsc#1268733,bsc#1268738)
    * nokogiri-1.19.4.gem

++++ haxe:

  - Require mbedtls-devel < 4 since newer versions are not supported

++++ helmfile:

  - Update to version 1.6.0:
    * fix: resolve symlinked plugin directories in GetPluginVersion.
    [#2661]
    * feat: add helmfile doctor command for AI-assisted diff analysis
    [#2660]
    * build(deps): bump github.com/helmfile/chartify from 0.26.5 to
    0.27.0 #2659
    * build(deps): bump github.com/helmfile/vals from 0.44.1 to 0.44.2
    [#2658]
    * build(deps): bump github.com/containerd/containerd from 1.7.32
    to 1.7.33 #2657
    * feat: parallel kubedog tracking with progress printer and safety
    valves #2654
    * docs: Small documentation indentation fixes #2655
    * build(deps): bump helm to v4.2.2 (and v3.21.2 for the v3 track)
    [#2651], #2656
    * build(deps): bump actions/checkout v6 to v7 #2649
    * fix: helmfile deps broken for OCI charts with underscores in
    path #2648
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.103.3 to 1.104.0
    * docs: fix duplicated word in hcl_funcs log description #2647

++++ incus:

  - fix typo on installation the completion files

++++ intel-cmt-cat:

  - libqpos6 -> libqpos7
  - RDT parts removed in below version
  - Update to version 26.06.0.git+dae1297:
    * Release 7.1.0
    * Use int for region_number in MBM counter read and rename it as region_num
    * Change region_number as region_num and type to int in MMIO functions
    * Improve monitoring group exhaustion diagnostics and cleanup
    * Refine PID startup cleanup fallback path
    * lib: cache d_name length in filter_pids loop
    * lib: include errno string in scandir() failure log
    * lib: handle scandir() failure in os_alloc_reset_tasks
    * lib: use uint64_t for page offset in mmap helpers
    * monitor: fix mmio_mon_stop for channel-based groups
    * pqos: handle pathological PID ranges and report invalid PIDs early
    * pqos: update outputs of --print-io-dev, --print-io-devs and --print-mem-regions commands
    * pqos: drop --iface from I/O RDT sample commands
    * pqos: fail clearly when required interface is unavailable
    * pqos: remove unused pid_flag tracking in main()
    * pqos: narrow allocation interface per association token
    * pqos: simplify iface_mask_to_str() buffer clamping
    * pqos: update on interface auto-selection logic
    * pqos: narrow iface to msr/mmio for l3iordt reset options
    * pqos: prefer mmio then msr for io device print
    * pqos: narrow interface constraint mask to available interfaces
    * lib: implement pqos_get_available_interfaces()
    * lib: add pqos_get_available_interfaces() API declaration
    * pqos: select msr for io device commands
    * pqos: document auto interface selection in man page
    * pqos: auto-detect --iface from command-line options
    * Fix TOCTOU race in os_alloc_reset_tasks: add pre-check, downgrade log levels
    * Fix artificial PID parser capacity limit in monitor parsing
    * Fix strlisttotab error reporting and bounds checking
    * lib: validate remaining monitoring path snprintf calls
    * lib: validate resctrl monitoring path formatting results
    * lib: avoid overflow in resctrl_mon_group_path path append
    * pqos : remove mixed MSR/kernel interface warning message
    * pqos: extract msr_l3_id_differs_from_sockets helper to remove duplication
    * pqos: print Domain ID instead of SOCKET in -e output when L3 IDs differ from sockets
    * pqos: print COS definitions per Domain ID when L3 IDs differ from sockets
    * pqos: add AET telemetry events to monitor CLI and output
    * lib: add AET telemetry support on OS monitoring interface
    * lib: fix fd validation in perf.c to accept fd 0
    * lib: compare read() result against value size, not pointer size
    * lib: use logical OR in CDP/MBA change check instead of the bitwise OR
    * lib: fix unreachable RSDP overflow guard
    * pqos: fix Wrong variable in NULL check after malloc
    * pqos/configs: fix 'DAMAGE.O' typo in example config files
    * pqos: fix 'DAMAGE.O' typo in BSD license header of pqos sources
    * lib: fix 'DAMAGE.O' typo in BSD license header of header files
    * lib: fix 'DAMAGE.O' typo in BSD license header of source files
    * pqos: fix misleading pqos monitor assoc return checks
    * pqos: add units to I/O monitoring headers in csv output
    * pqos: add units to I/O monitoring headers in text output
    * pqos: prevented integer overflow and OOB write in realloc_and_init()
    * pqos: enabled monitoring of cores and I/O devices simultaneously
    * lib: read back correct region's BW in mmio_mba_set
    * pqos: Improve error message when no RDT events available
    * Prefer MMIO interface in AUTO selection on Linux (ERDT+MRRM sysfs detection)
    * Adjust PCI database detection message
    * Add custom compilation option to remove lock
    * Fix: skip first MBM measurement output
    * lib: rdtset tool is removed
    * lib: snmp support is removed
    * Release 7.0.0
    * pqos: --alloc-mem-region is accepted in range values
    * pqos: fixed MBA and CAT failures
    * lib: Fixed setting of more than available L3 cache ways
    * lib: Fixed setting of more than available I/O cache ways
    * lib: added CXLD support in pqos

++++ jsoncpp:

  - Switch back to meson build

++++ just:

  - Update to version 1.54.0:
    + Forbid duplicate attribute keys
    + Clear signal handler when infallible line catches signal
    + Allow passing --dotenv-command multiple times
    + Allow [arg] value to be expression
    + Add [continue] attribute
    + Add --dotenv-command and set dotenv-command
    + Add cache key to verbose output
    + Add --no-cache flag
    + Remove empty cache entries with just --clean
    + Add just --clean instructions to readme
    + Allow filtering --clean by recipe and module path
    + Add --clean subcommand for clearing recipe cache
    + Include recipe name in cache entries
    + Add extra user-supplied cache key
    + Fix working directory cache key
    + Add output files to cached recipes
    + Add file inputs to cached recipes
    + Use body lines in cache key
    + Use recipe body in cache key instead of lines
    + Add additional cache keys
    + Add cached recipes

++++ kactivitymanagerd6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kanidm:

  - Update to version 1.10.4~git0.97b1edbc4:
    * Release 1.10.4
    * Clippy
    * Update ldap3_lber to 0.8.0
    * Avoid LSE instructions in arm64 Linux builds (#4372)
    * Release 1.10.3
    * Resolve incorrect login in commited flag
    * Prevent migration double-deletes

++++ kde-cli-tools6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kde-gtk-config6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kdecoration6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kdeplasma6-addons:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kernel-default:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-source:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-docs:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-kvmsmall:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-obs-build:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-obs-qa:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-syms:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kernel-vanilla:

  - selftests/bpf: Tolerate missing files during install
    (poo#202224).
  - selftests/bpf: Provide weak definitions for cross-test functions
    (poo#202224).
  - selftests/bpf: Tolerate benchmark build failures (poo#202224).
  - selftests/bpf: Allow test_progs to link with a partial object
    set (poo#202224).
  - selftests/bpf: Skip tests whose objects were not built
    (poo#202224).
  - selftests/bpf: Tolerate test file compilation failures
    (poo#202224).
  - selftests/bpf: Make skeleton headers order-only prerequisites
    of .test.d (poo#202224).
  - selftests/bpf: Avoid rebuilds when running emit_tests
    (poo#202224).
  - selftests/bpf: Tolerate BPF and skeleton generation failures
    (poo#202224).
  - selftests/bpf: Fix test_kmods KDIR to honor O= and distro
    kernels (poo#202224).
  - selftests/bpf: Add BPF_STRICT_BUILD toggle (poo#202224).
  - commit 58110d9
  - ACPICA: Unbreak tools build after switching over to
    strscpy_pad() (bsc#1268472).
  - Delete
    patches.suse/Revert-ACPICA-Replace-strncpy-with-strscpy_pad-in-ac.patch.
    Replace by a v2 -- the revert was dropped upstream.
  - commit 37bbff8

++++ kgamma6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kglobalacceld6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kinfocenter6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * kcms/samba: Port to Kirigami.StyleHints for framed backgrounds

++++ kmenuedit6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ knighttime6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kpipewire6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ krdp6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * Fix pointer position with the Plasma backend

++++ kscreen6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kscreenlocker6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ ksshaskpass6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ libksysguard6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ ksystemstats6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kwayland-integration6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kwayland6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ kwin6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Too many changes to list here
  - Drop patches, now upstream:
    * 0001-core-drmdevice-correct-the-virtio-driver-name.patch

++++ kwin6-x11:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * plugins: Make nightlight optional

++++ layer-shell-qt6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ lazyworktree:

  - Update to version 1.47.0:
    This release introduces inline status chips for CI checks,
    dedicated PR status badges within the Info pane, and improved
    container execution logic for custom commands. Additionally, it
    features structural code refactoring, streamlined documentation,
    and various dependency upgrades to enhance overall stability.
    * Features
  - Inline CI Status: Replaced the heavy powerline-style CI
    summary pill with a lightweight, inline status chip next to
    the CI Checks heading.
  - PR Status Badges: Added colored state badges (Open, Merged,
    Closed, Draft) directly to the Info pane for improved
    visibility of pull/merge request status.
  - Claude Skill for Docs Review: Introduced an AI-assisted
    workspace skill (docs-drift-review) to systematically analyze
    repository documentation for implementation drift, stale
    examples, or clarity issues.
    * Bug Fixes
  - Container Commands Shell Wrapping: Multi-word container
    commands are now wrapped in a shell execution (sh -c) to
    prevent execution failures in container runtimes, and
    environment variables are properly expanded before execution.
  - Custom Commands Discovery: Fixed an issue where
    container-only custom commands were omitted from the command
    palette.
  - Custom Theme Handling: Ensured custom themes load properly on
    startup and dynamically reconcile with delta syntax theme
    arguments during CLI overrides.
  - CLI Override Scoping: Fixed a bug where unspecified
    configuration string fields were reset to default values
    during CLI theme overrides.
    * Performance Improvements
  - Badge Rendering Optimization: Extracted remote host icon
    mapping tables to the package level to eliminate redundant
    memory allocations, and deferred style calculations until
    after validation to prevent unnecessary processing.
    * Maintenance
  - Code Refactoring: Grouped scattered Model state fields into
    dedicated sub-structs (loadingState, detailsState,
    pendingOpState) to improve long-term codebase
    maintainability.
  - Configuration Default Changes: Adjusted the default
    refresh_interval to 10 seconds, disabled ci_auto_refresh by
    default, mapped the manual refresh key to r, and introduced
    the LAZYWORKTREE_DESCRIPTION variable for notes scripts.
  - Documentation Refinement: Streamlined the user guide and
    README by removing redundant "Refer to this page when"
    callouts and simplifying phrasings.
  - Test & Lint Improvements: Simplified linting targets,
    resolved test-suite lint warnings, and disabled GPG commit
    signing in machine test environments to prevent test
    failures.
  - Weekly Maintenance: Completed weekly codebase maintenance and
    test coverage alignments (Pull Requests #66, #67, #68).
    * Dependencies
  - Upgraded charm.land/bubbletea/v2 to v2.0.7 (Pull Request #66)
  - Upgraded charm.land/lipgloss/v2 to v2.0.4 (Pull Request #67)
  - Upgraded github.com/urfave/cli/v3 to v3.10.0 (Pull Request
    [#67])
  - Upgraded golang.org/x/term to v0.44.0 (Pull Request #67)
  - Upgraded github.com/charmbracelet/ultraviolet to newer
    maintenance snapshots (Pull Requests #66, #67, #68)

++++ lbreakouthd:

  - Update to version 1.2.3
    * added galician translation.

++++ libkscreen6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma5support6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ libplasma6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
  - Add provides for libPlasma6 to fix pulling in libPlasma6-lang
    (boo#1268766)

++++ plasma6-activities:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-activities-stats:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ libfabric:

  - Update to v2.6.0
  - Core
  - ofi_atomic_queue: convert from MPMC to MPSC
  - hmem: Add additional CUDA wrapper functions
  - man: Fix reference to fi_mr_raw_attr()
  - common: Fix byte order of AF_IB ofi_addr_set_port
  - common: Do not assert on truncated buffers
  - man: Update efa man page to reflect zero copy mode deprecation
  - configure.ac: Fix --enable-xpmem=yes
  - man: Clarify FI_INJECT + FI_HMEM restriction
  - core: Replace indirect held, lock, and unlock function calls
  - CXI
  - Fix spelling of "receive" across CXI provider
  - Extend timeout for sw_max_recv msg test
  - Refuse cancel for receives with RDMA in flight
  - Add test for TLE pool sharing from the default service
  - Added FI_SUCCESS return to rnr recv cb
  - Minor tweak to append_oflow test
  - Handle LE append failure for RNR recv
  - Fix minor size check in RNR send_common
  - Check FI_CXI_CTRL_RX_EQ_MAX_SIZE for 0
  - New mr test to check buffer attributes
  - EFA
  - use cmocka's "void ** state" signature in unit tests for C23
  - honor homogeneous_peers in efa_rdm_interop_rdma_read
  - Drive real completion handler in local-read unit test
  - NULL local_read_pkt_entry after data-copied hand-off
  - Track efa_rx_pkts_held with a per-pkt flag
  - Fix pkt leak in efa_rdm_ep_post_queued_pkts on error
  - Fix direct_ope leak on error in efa-direct send/recv/rma
  - remove trailing whitespaces in the mr unit test.
  - Gate the pps interface with feature flag
  - Add rdma-core path support for WQE-level PPS hints
  - Implement WQE level PPS hints in data-path-direct
  - Add efa-specific operational flags for high PPS
  - Guard hardware counter with FI_EFA_USE_HW_CNTR
  - Add feature flag FI_EFA_USE_HW_CNTR
  - Use hardware counter in fi_cntr_open
  - Add fi_cntr_wait for hardware counter
  - Attach hardware completion counter to QP
  - Extend GDA domain op to support hardware cntr with external memory
  - Add hardware counter operations
  - Advertise hardware counter max value in fi_getinfo
  - Set the correct cntr_cnt in domain_attr
  - Baseline the read nack extra feature
  - Baseline the runt extra feature
  - Baseline the connid header extra request
  - Validate dmabuf provided when setting FI_MR_DMABUF
  - Fix pkt_entry double-free during endpoint teardown
  - Add missing txe release check in dc ctsdata packet
  - Destroy buffer pools when pke_vec alloc fails in ep_open
  - Fix info and util_ep leak on efa_recv_wr_vec calloc failure
  - Add assert guards for iov_count bounds in atomic, rma, and srx
  - Propagate robuf allocation failure from peer_construct
  - Check util_cq refcount before destroying ibv_cq in close
  - Clear EFA_RDM_PKE_RNR_RETRANSMIT in peer_destruct
  - Bounds-check fi_mr_attr.iface before indexing g_efa_hmem_info
  - Initialize srx_lock early in efa_domain_open
  - Stop returning early from efa_domain_close
  - Use ret directly in efa_domain_open
  - Do a proper cleanup in case of a fork handler failure
  - Do a proper cleanup in case of an unsupported endpoint type
  - Drop dead assignment to local efa_domain
  - Remove trailing whitespace in efa_domain.c
  - Write CQ error instead of EQ error for unsolicited write recv
  - Extract efa_rdm_cq_write_error() helper for CQ error with EQ fallback
  - Always build rdma-core WQE post functions in header
  - Fix length field in data_path_direct tracepoint
  - Fix out-of-bounds array access in tracepoint post_send
  - Add unit-test for util_foreach_unspec
  - Add FI_EFA_FEATURE_OPS for runtime feature discovery
  - test: Verify EAGAIN when pre-handshake queue is full
  - Separate CNTR into independent efa-direct and efa-rdm implementations
  - Suppress duplicate error CQ/counter for ops errored synchronously
  - Add test confirming multi-packet send is not susceptible to partial-post
  - Fix same double-free pattern in multi-segment RDMA read path
  - Fix double-free on partial multi-segment RDMA write failure
  - Store EFA-internal txe flags in internal_flags, not fi_flags
  - Fix -Wpointer-arith warnings on ARM
  - Remove handshake requirement for DC
  - Remove zero copy receive path, keep send path for compat
  - Move memory alignment helper to header as static inline
  - Inline and remove efa_rdm_ep_alloc_txe
  - Check if the send queue is full earlier
  - Add ep->send_pkt_entry_vec_size
  - Check all descs for HMEM in efa_post_send inline path
  - test: Fix flaky QPN collision in implicit AV unit tests
  - Fix NULL deref in efa_av_reverse_av_remove on QPN collision
  - Fix FI_INJECT in efa direct
  - Remove incorrect assert in test_efa_data_path_direct_qp_gen_initialization
  - Improve error message for ibv_create_ah failure
  - Subtract prefix size in inject assertion for dgram
  - Optimize shm address retrieval in RDM operations
  - test: Cast the qp gen when doing the comparison
  - Fix race between fi_av_lookup and fi_av_remove
  - Fix the max_msg_size validation for efa-direct
  - Preserve shm MR close error in efa_rdm_mr_close
  - Fix ineffective error check on ofi_get_page_size()
  - Fix use-after-free when TX and RX share the same CQ
  - Fix unchecked strndup return in get_sysfs_path
  - Improve the warn log in efa_mr/efa_rdm_mr
  - Introduce a warning macro for fi errno
  - Fix unused return codes
  - Honor user-requested QP sizes within device limits
  - Fix missing mem_desc and iface initialization in non-p2p path
  - Separate core MR logic from RDM-specific MR implementation
  - LNX
  - Update handling of deprecated FI_AV_MAP
  - Fix lnx capability settings and checking
  - Move environment variables into a global struct for easy access
  - Cleanup and reorganization
  - OPX
  - Lower GDRcopy threshold/Allow HMEM MP Eager
  - Initialize deferred HFISVC receive contexts
  - Make OPENED MR notify non-owning for rzv completion
  - Document HMEM-dependent FI_OPX_RZV_MIN_PAYLOAD_BYTES defaults
  - Reject incompatible MR registrations when HFISVC is enabled
  - Handle MP eager FI_CLAIM receives
  - Drop mm lock before memory operations
  - Remove SDMA queue ring size workaround
  - Remove global hfi_local_info
  - Fix origin_rx in realibility ping, ack and nack
  - Store HFI selection per-domain
  - Use generation-agnostic fabric name and RDMA device domain name
  - Populate fid_nic in fi_getinfo with device/bus/link attributes
  - Remove fabric from linked list in close paths
  - Restore fd_verbs (hfi direct) support
  - Dual plane: Send only context
  - Dual plane: Environment variables
  - Fix no common tx context error
  - Dual Plane: Stripe data across two HFISVC clients in dual/single plane
  - Fix reliability origin_rx access
  - sriov support for lmc/lid hairpin
  - Dual plane: Reliability and reply path changes
  - tracer BEGIN/END instrumentation fixes
  - Unsubscribe when entry is removed from cache.
  - FI_MR_DMABUF mr_regattr using invalid addr
  - Catch hfi config error earlier and fail
  - Add valid() calls to opx caching
  - Do not fail kdreg2
  - Don't use FI_DELIVERY_COMPLETE for MSG/Tagged sends
  - Add full FI_DELIVERY_COMPLETE support for MSG/Tagged sends
  - HSA_STATUS_ERROR_INVALID_ARGUMENT IPC RZV Send
  - SLES compilation fix
  - Remove #if 0 dead code
  - MP Eager data validation fix
  - Dual plane - addressing, plane selection and shm
  - Populate PCI bus attributes in fi_info from sysfs
  - OPX Tracer v2
  - Dual plane: Multiple tx and ibv context
  - Restore debugging #ifdef
  - change all CUDA calls to use ofi wrapper functions
  - Reduce warnings
  - Fix use_cnt/mmu windows
  - Fix rendezvous partial registration
  - Unlock mm in shm signal
  - Open HFISVC completion queue on RX CQ when separate from TX CQ (#1321)
  - Fix extended addr allocation during av insert
  - Compute sbuf_offset for non-dmabuf MRs in hfisvc RTS
  - Fix CTS replay payload for RMA GET
  - Support 9B HFI Service
  - store dmabuf base_addr as page-aligned fd start
  - Always poll domain and CQ's HFI service completion queues during CQ Read
  - Fix DMABUF HFISVC addr/offset calculation
  - Fix MP Eager replays for 9B headers
  - Sync HMEM stream before destroy
  - Prevent RDMA lib close in uninitialized state
  - Only close DMABUF fd when created by OPX
  - Remove dead code in rendezvous CTS path
  - Fixing issue in av_insert when using av_table
  - Trivial FI_WARN update
  - Initialize OPX ref counters
  - Fix build error in hmem path for av_type
  - Use ofi_atomics for reference counting.
  - Changing av_map to work like av_table internally
  - Invalid RDMA ops ref counter decrement
  - Segfault with NCCL/RCCL Plugin & HFISVC
  - Enable container build
  - Fix non-powers of 2 rcvhdrcnt
  - Fix mismatched alignment attribute between packet header & payload unions.
  - Use correct device with DMABUF support
  - Fix use of DMABUF fd in the OPX mr
  - Update SDMA/RZV threshold for AMD GPUs
  - fix fi_opx_open_command_queues() segfault
  - Only require DMABUF for HFISVC for HMEM
  - Added hmem_dev_reg_handle so receive side can use ROCr Copy
  - Remove debug log of every reliability inject
  - Add DMA-BUF offset to buffer offset calculation
  - DMABUF support for HFI service
  - MR Registration with HFI service
  - Fix reliability key in reliability debug logs
  - Remove unnecessary csr reads
  - Dynamically growable access_key pool for HFI service.
  - PSM3
  - Internal polling must use timeout to prevent infinite loop during resources acquiring
  - RXD
  - Remove rxd_mr_verify dead code
  - RXM
  - Fix ignored domain_attr->cq_data_size hint
  - SHM
  - DL initialize mem and monitors
  - Register max_gdrcopy_size env var
  - Do not return local cmd copy in smr_discard
  - Remove init_fn from cmd queue release path
  - Fix the error flag propagation
  - Let atomic_inline use smr_flags for format
  - Revert to a lock-unlock inject pool
  - Fix compile warning coming from shm
  - Do not take inject for op_read_req
  - Do not check for total_len < inject_size on rma_fast
  - Push cmd back to stack on error
  - remove cmd_entry ptr
  - Remove 0-byte copy SAR
  - Move inject pool above command stack
  - Use hdr.sm

++++ zlib:

  - drop 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch
    * effectively a noop now, as strstart and insert are unsigned,
    hence the if condition is always true (if not equal).

++++ mupdf:

  - Build and ship MuPDF as a shared library (make shared=yes) instead of
    static-only:
    * New subpackage libmupdf27_2 carries libmupdf.so.27.2 (the SONAME
    tracks the upstream minor.patch version).
    * Replaced the static-only mupdf-devel-static with mupdf-devel, which
    ships the .so symlink and a generated mupdf.pc (upstream provides no
    pkg-config file).
    * mupdf-devel obsoletes the dropped mupdf-devel-static so it is
    cleanly replaced on upgrade (resolves the /usr/include/mupdf
    header file conflict flagged in staging).
  - Consumers that statically embedded libmupdf.a (e.g. zathura's
    pdf-mupdf plugin) failed to load with "undefined symbol:
    jpeg_resync_to_restart" because openSUSE builds MuPDF against system
    codec libraries and the static archive does not pull them in; linking
    against the shared library (which carries those codecs in its own
    NEEDED) fixes this (boo#1165273).

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1083
  - order command options and arguments "posixly correct"
  - 4.5.335

++++ systemd:

  - Temporarily add 1002-nss-systemd-avoid-ELF-TLS-for-recursion-guard.patch until
    upstream releases it (bsc#1254924)

++++ systemd-mini:

  - Temporarily add 1002-nss-systemd-avoid-ELF-TLS-for-recursion-guard.patch until
    upstream releases it (bsc#1254924)

++++ upower:

  - Revert unneeded policy kit rules (mainline git commit d75f2dbee4df2)
    A    policy-org.freedesktop.upower.rules-grant-permission-for-skipping-the-inhibitor.patch

++++ libvirt:

  - spec: Don't configure non-existent virt-secret-init-encryption
    socket units
    bsc#1268535

++++ linkerd-cli:

  - Update to version 2.20:
    major update, see the release announcement
    https://linkerd.io/2026/06/23/announcing-linkerd-2.20/

++++ lowfi:

  - update to 2.0.7:
    * Add proper logging, helping people tweak their own track lists and see
    when errors happen.

++++ milou6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * lib/ResultsView: consider all data changes results (kde#521598)

++++ nano:

  - Update to version 9.1:
    * When searching, the viewport is placed snug left where
    possible.
    * The ability to read and write files in old Mac format (a lone
    carriage return as line ending) was removed.
    * The ^T toggle between WhereIs and GotoLine was dropped.
    * Fix backups that were missing or had a wrong timestamp when
  - -backup is active.
    * On a crash or kill, a .save file is no longer chmodded or
    chowned to the base file's permissions and owner.
    * The history code now creates the ~/.local directory with
    limited access rights (boo#1263437; the referenced
    CVE-2026-40556 was rejected upstream).
    * M-Ins and M-Del have become rebindable.

++++ nelm:

  - Update to version 1.24.0:
    * Features
  - ability to init ts files with WerfRenderContext type (#593)
    (4b90254)
  - adopt chart ts init for werf (#594) (671cf54)
  - deno runtime for typescript (#565) (942d8aa)

++++ netperfmeter:

  - Update to version 2.0.7
    * Removed usage of strcpy(), and some clean-ups.
    * Added UTF-8 handling to setpdfmetadata, removing the ISO-8859
    restriction for PDF metadata.

++++ nvidia-open-driver-G07-signed-cuda:

  - update non-CUDA variant to 595.84 (boo#1268792)

++++ nvidia-open-driver-G07-signed:

  - update non-CUDA variant to 595.84 (boo#1268792)

++++ ocean-sound-theme6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ openSUSE-build-key:

  - do not include the projects _pubkey if we have it already.

++++ openqa-mon:

  - Update to version 1.5.2:
    * Remove removed 'PublicCloud SLEM 6.2 Product Increments' job group
    * Update dependencies
    * Prepare 1.5.2 release
    * Bump actions/checkout from 6 to 7
    * Style: Replace if..else if block with switch
    * Fix: Do not crash when no jobs are returned
    * Revert "Revert "Bump uncenter/setup-taplo from 1 to 2""

++++ oxygen6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * desktop theme: Fix Air's off-center clock hands (kde#521715)

++++ pam_kwallet6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ perftest:

  - Update to perftest 26.04.17
  - https://github.com/linux-rdma/perftest/releases/tag/26.04.17

++++ perl-List-SomeUtils-XS:

  - updated to 0.590.0 (0.59)
    see /usr/share/doc/packages/perl-List-SomeUtils-XS/Changes
    0.59     2026-06-22
  - Fix a heap buffer overflow in the pairwise function when it would return a very large list. Fixed
    by Paul Johnson. CVE-2026-12844 bsc#1269210

++++ perl-Text-CSV_XS:

  - updated to 1.640.0 (1.64)
    see /usr/share/doc/packages/perl-Text-CSV_XS/ChangeLog
    1.64	- 2026-06-22, H.Merijn Brand
    * Fix syntax error in csv2xlsx
    1.63	- 2026-06-22, H.Merijn Brand
    * Check attribute lengths (memory protection)
    * Minor code consistencies (not user-visible)
    * Dropped support for 5.6.x and 5.8.0. Minimum perl is now 5.8.1
    * Fix special str setting consistency for types, undef_str and
    comment_str
    * Characters []:*/\ are not allowed in XLSX sheet names

++++ plasma6-bigscreen:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * bin: Drop explicit QT_QUICK_CONTROLS_STYLE, QT_QPA_PLATFORMTHEME (kde#520783)
    * homescreen: Ensure keyboard always pops up for search window (kde#521560)

++++ plasma6-openSUSE:

  - Update to 6.7.1

++++ plasma6-browser-integration:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-desktop:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * applets/kickoff: show sidebar highlight with switch on hover (kde#521558)
    * applets/kickoff: explicitly set implicit sizes for fullRep StackView (kde#521383)
    * kcms/gamecontroller: Disable gamepad input emulation by default
    * applets/taskmanager: fix badge overflow at extreme margins of usage (kde#521562)
    * kcms/keyboard: Ensure that keyboards without variant info don't show "undefined" as variant

++++ plasma6-disks:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-firewall:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-integration:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-keyboard:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * fix: Don't try to close diacritics overlay twice
    * fix: Don't disable key repeat when diacritics overlay is enabled
    * fix: improve reliability of dead key and compose key handling w/ overlay (kde#518141,kde#519339,kde#520410,kde#520344)

++++ plasma6-mobile:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-nano:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-nm:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * Fix showing network details (kde#521415)
    * Fix tray icon for virtual wired devices (kde#516709)

++++ plasma6-pa:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-print-manager:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * set selected: property on ItemDelegates's contentItem stuff

++++ plasma6-sdk:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-workspace:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * applets/kicker: return empty string for computermodel description (kde#521799)
    * startplasma: Tweak the time when global themes are switched
    * scripting: Read/write panel alignment from correct config
    * plasma-apply-lookandfeel: Optionally blend changes when changing color scheme
    * Klipper: reset search field on popup close (kde#504658)
    * wallpapers/image: fix heap-use-after-free in SlideFilterModel::invalidate()
    * libtaskmanager: Fix missing argument for QString::arg
    * wallpapers/image: fix flaky testCustomAccentColorFromWallpaperMetaData test
    * wallpapers/image: fix flaky SlideFilterModelTest from QFuture synchronous continuation
    * components/calendar: fix today-highlight showing wrong day for UTC+x timezones before UTC midnight (kde#521114)
    * applets/notifications: Explicitly set rotation in the unread state (kde#458156)
    * 🍒 kcms/wallpaper: Avoid storing screen as raw pointer (kde#521078)

++++ plasma6-systemmonitor:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * table: Do nothing if data() functions are passed an invalid index
    * table: Make sure to cleanup sorted columns when using "hide column" on table
    * table: Explicitly remove duplicate entries from sortedColumns in ColumnSFModel (kde#518073)

++++ plasma6-thunderbolt:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - No code changes since 6.7.0

++++ plasma6-vault:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-welcome:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plasma6-workspace-wallpapers:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ plymouth-theme-breeze6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ podman:

  - Update to version 5.8.3:
    * Bump to v5.8.3
    * Update release notes for v5.8.3
    * Bump to gvisor-tap-vsock v0.8.9
    * [v5.8] Bump Buildah to v1.43.2
    * ci: fix validate-source checks vs stale labels
    * Release automation: update org location
    * ci: use env vars to avoid template expansion in code contexts
    * ci: use --sandbox for dynamically generated sed scripts
    * Update gh org from which releases are pulled in pswh scripts
    * pkg/machine/e2e: set XDG_CONFIG_HOME
    * Set permissions for win installer CI job
    * ci: delete netavark v2
    * ci: fix storage.conf composefs setup
    * Update release ID in win-installer-main.ps1
    * Use GH token to download Podman release in utils.ps1
    * validate ci.yml file
    * ci: add path-filter to success job
    * CI: Adjust Mac tmpdir
    * ci: fix validate job to actually work on push
    * ci: skip validate-source on push
    * ci: add GITHUB_TOKEN to win installer test
    * test/python/docker/compat: skip test_search_image
    * ci.yml: add macos jobs
    * ci.yml: add windows jobs
    * New GHA lima ci testing setup
    * Run 'make swagger' in the validate-source GHA job
    * Migrate 'build each commit' check from Cirrus to GHA
    * Migrate validate-source from Cirrus to GitHub Actions
    * Rename contrib/cirrus to hack/ci
    * .cirrus.yml: do not run golangci-lint for freebsd and mac
    * Makefile: run golangci-lint for all supported OSes
    * hack/golangci-lint.sh: fix binary lookup order
    * pkg/bindings/generator: fall back to golangci-lint from $PATH
    * hack: reuse already installed golangci-lint
    * ci: replace git-validation with a small shell script
    * .editorconfig: add indentation rule for shell files
    * ci: rm contrib/cirrus/check_go_changes.sh
    * .golangci.yml: deny using obsoleted os.Is... checks
    * Remove unused nolint annotations
    * Replace os.Is* error checks with errors.Is
    * Fix compilation of tests without CGo
    * test/system: fix "quadlet kube - start error" flake
    * test/system: fix can trap signal flake
    * test/system: do not use image mount as rootfs source
    * test/system: fix "podman kill - concurrent stop"
    * test/system: use DISABLE_HC_SYSTEMD for 2 tests
    * test/e2e: deduplicate some network subnets
    * test/system: bump "unlock while waiting for timeout" timeout
    * test/system: do not run "podman pause/unpause" in parallel
    * test/system: fix "stop container when healthcheck runs" flake
    * test/system: fix "podman stop - unlock while waiting for timeout"
    * test/e2e: fix static port assignment
    * test/system: skip one new pasta flake
    * test/e2e: fix some duplciated network subnets
    * test/e2e: skip "podman run --shm-size-systemd" as root
    * test/e2e: skip "sshd and API services required"
    * test/system: fix "add username to /etc/passwd if --userns=keep-id"
    * test/system: skip "IPv6 default address assignment"
    * test/system: fix quadlet - rootfs on kernel 7.1
    * Cite go module change
    * Install WiX v5.0.2 to build the Windows installer
    * Bump Podman to v5.8.3-dev

++++ polkit-default-privs:

  - Update to version 1550+20260623.563df94:
    * profiles: added kdeplasma6-addons kameleon.qmk (bsc#1267818)

++++ polkit-kde-agent-6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ powerdevil6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ publicsuffix:

  - Update to version 20260622:
    * Add mkm.fan to private domains (#2937)
    * util: gTLD data autopull updates for 2026-06-13T16:12:40 UTC (#2958)
    * Add vibehost.space for cross-tenant cookie isolation (#2932)
    * Add OpenAI private suffixes (#2930)
    * add khsj.cn and canva.link (#2898)
    * add ai.id (#2922)
    * Add book.online (#2890)

++++ python-click-extra:

  - update to 8.0.1:
    Redo a proper release.
  - update to 8.0.0:
    No changelog available

++++ python-crc32c:

  - Initial import of python-crc32c 2.8

++++ python-fastmcp:

  - Update to version 3.4.2

++++ python-fastmcp-slim:

  - Update to version 3.4.2
  - Add missing python-starlette dependency, declared by the
    client and server extras

++++ python-nethsm:

  - update to 2.1.2:
    * Changes
  - Patch generated client to remove the python-dateutil dependency.

++++ python-node-semver:

  - Update to 0.9.1:
    * Handle invalid versions in valid() (gh#podhmo/python-node-semver#54)

++++ python-notify-py:

  - Initial package (version 0.3.43):
    * Cross-platform desktop notification library for Python; on Linux
    it uses notify-send (libnotify) with a jeepney/D-Bus fallback
    * Drop the bundled macOS Notificator.app (prebuilt Mach-O
    binaries), which is useless on Linux
    * Relax the upstream loguru <= 0.6.0 cap (overly strict poetry
    pin; builds and imports fine against the current loguru)

++++ python-oci-sdk:

  - Update to version 1.180.0
    * Support for static redirect paths in OAuth2 and OpenID Connect
    authentication policies in the API Gateway service
    * Support for returning SDK resources and etags during SDK updates
    in the API Gateway service
    * Support for virtual node pool cycling in the Kubernetes Engine service
    * Support for access types on Autonomous AI Database Serverless instances
    in the Database service
    * Support for external logical zones on Autonomous AI Database Serverless
    instances and local Autonomous Data Guard standby databases in the
    Database service
    * Support for scheduled backups of Autonomous Database Dedicated resources
    in the Resource Scheduler service
    * Support for action-type filtering of resource types in the Resource
    Scheduler service
    * Support for Log Analytics log groups on Oracle Process Automation (OPA)
    instances attached to Integration instances in the Integration service
    * Support for Zero Trust Packet Routing (ZPR) security attributes on DNS
    resolver endpoints in the DNS service
    * Support for free-form and defined tags on DNS resolver endpoints in the
    DNS service
    * Support for resolver, private endpoint, and VNIC identifiers in DNS
    resolver endpoint responses in the DNS service
    * Support for the UPDATING  lifecycle state on DNS steering policies in
    the DNS service
    * Return type of method `update_sdk` changed from `None` to
    `oci.apigateway.models.Sdk` in the API Gateway service
  - from version 2.179.0
    * Support for ExaDB-D Public Cloud in the Operator Access Control service
    * Support for cross region replication with hot standby in the PostgreSQL service
    * Support for starting and stopping DB systems in the PostgreSQL service
    * Support for Kerberos authentication in the PostgreSQL service
    * Support for performance insights in the PostgreSQL service
    * Support for log analytics integration in the Application Performance
    Monitoring Control Plane service
    * Support for storing large data files in Application Performance Monitoring
    configurations in the Application Performance Monitoring service
    * Support for compute clusters and host groups in the Kubernetes Engine service
    * Support for Zero Trust Packet Routing (ZPR) security attributes on private
    endpoints in the Object Storage service
    * Support for Zero Trust Packet Routing (ZPR) security attributes in the
    Cloud Migrations service
    * Support for Zero Trust Packet Routing (ZPR) security attributes in the
    Secure Desktops service
    * Support for forcefully restarting and stopping Autonomous Databases and
    Autonomous Container Databases in the Database service
    * Support for restarting Oracle Rest Data Services (ORDS) services on Autonomous
    VM Clusters and Cloud Autonomous VM Clusters in the Database service
    * Support for triggering forced reboot and stop of DB nodes in ExaDB-D,
    ExaDB-XS and ExaDB-C@C in the Database service
    * Support for additional coordinator node pools for OCI Search in the OpenSearch service
    * Support for multi-link organizations in the Organization Management service
    * The model `CustomerLoggingDetails` has been removed from the OpenSearch service
    * The model `ReviveWorkflowInstanceDetails` has been removed from the Organization
    Management service
  - from 2.178.0
    * Support for B200 shapes in dedicated AI clusters in the Generative AI service
    * Support for Oracle Managed Database Software Updates in the Database service
    * Support for scheduling preferences, version series selection, and readiness
    details in Oracle Managed Database Software Updates in the Database service
    * Support for rescheduling Oracle Managed Database Software Updates in the Database service
    * Support for Oracle-managed and customer-managed database home types in the Database service
    * Support for specifying VM cluster IDs when creating databases in the Database service
    * Support for Oracle Managed Software Updates delegation controls in the Delegate
    Access Control service
    * Support for Exadata Database VM Clusters in delegation controls in the Delegate
    Access Control service
    * Support for database IDs in delegated resource access requests in the Delegate
    Access Control service
    * Support for approval action timestamps and SSH access indicators in the Delegate
    Access Control service
    * Support for public connectivity add-ons in the OCI Streaming with Apache Kafka service
    * Support for listing, installing, updating, getting, and uninstalling Kafka cluster
    add-ons in the OCI Streaming with Apache Kafka service
    * Support for SASL and mTLS authentication mechanisms in public connectivity add-ons
    in the OCI Streaming with Apache Kafka service
    * Support for GPU memory fabric IDs and size details in GPU memory cluster summaries
    in the Compute service
    * Support for filtering GPU memory clusters by GPU memory fabric in the Compute service
    * Support for associated GPU memory cluster IDs in GPU memory fabric resources
    in the Compute service
    * Support for partner-provided OS licenses when launching and updating instances
    in the Compute service
    * Support for work request IDs and waiters when attaching volumes, detaching volumes,
    and terminating instances in the Compute service
    * Support for single-stack IPv6 in the Virtual Cloud Network service
    * Support for hostnames on IPv6 addresses during create, update, and bulk operations
    in the Virtual Cloud Network service
    * Support for IPv6 addresses on DB systems, read endpoints, read replicas,
    and snapshots in the MySQL HeatWave service
    * Support for IPv6 selection in replication channels on dual-stack DB systems
    in the MySQL HeatWave service
    * Support for X.509 identity propagation trusts and CA certificate chains in
    the Identity Domains service
    * Support for resource subject type, impersonating resources, claim validations,
    and claim propagation in identity propagation trusts in the Identity Domains service
    * Method `detach_volume_and_wait_for_state` was renamed to `detach_volume_and_wait_for_work_request`
    in the Compute service
    * Method `terminate_instance_and_wait_for_state` was renamed to
    `terminate_instance_and_wait_for_work_request` in the Compute service
  - from version 2.177.0
    * Support for Zero Trust Packet Routing (ZPR) security attributes for private endpoints
    in the Operations Insights service
    * Support for Zero Trust Packet Routing (ZPR) security attributes for private endpoints
    in the Database Management service
    * Support for multimodal image input and flagged modalities when applying guardrails
    in the Generative AI service
    * Support for filtering incidents by last update time in the Cloud Incident Management service
    * Support for Cloud Incident Management APIs without Customer Support Identifier (CSI)
    parameters in the Cloud Incident Management service
    * Support for site IDs when creating and updating VMware BYOL registrations in the
    Oracle Cloud VMware Provisioning service
    * Support for VMware Cloud Foundation (VCF) BYOL allocation IDs during ESXi host replacement
    and in-place upgrades in the Oracle Cloud VMware Provisioning service
    * Parameter `csi` is removed from the model `CreateIncident`, `CreateUserDetails` and `User`
    in the Customer Incident Management service
    * Parameter `customer_support_key` is removed from the model `TenancyInformation`
    in the Customer Incident Management service
  - from version 2.176.0
    * Support for calling Oracle Cloud Infrastructure services in the me-alrayyan-1 region
    * Support for Veridata deployment types in the GoldenGate service
    * Support for cloning ZeroETL pipelines in the GoldenGate service
    * Support for Object Storage initial load in ZeroETL pipelines in the GoldenGate service
    * Support for specifying CPU core count and autoscaling in ZeroETL pipelines in the GoldenGate service
    * Support for setting disaster recovery status during deployment creation in the GoldenGate service
    * Support for switchover and failover mode selection in disaster recovery peer switchovers
    in the GoldenGate service
    * Support for generating and retrieving disaster recovery precheck reports for
    standby peers in the GoldenGate service
    * Support for scheduling policies and scheduling windows as part of granular maintenance
    scheduling of Exadata Infrastructure components in the Database service
    * Support for specifying System Global Area (SGA) memory percentage and distributed
    algorithm configuration in Autonomous VM Clusters and Cloud Autonomous VM Clusters
    in the Database service
    * Support for Database Resident Connection Pooling (DRCP) in Autonomous Container Databases
    in the Database service
    * Support for creating additional VMs in Exadata Cloud Service and Exadata Cloud@Customer
    in the Database service
    * Support for selecting specific compute shapes during cluster placement group creation
    in the Cluster Placement Groups service
    * Support for compute target resource when creating and managing reusable managed compute
    capacity for workload deployments in the Data Science service
    * Support for managed compute cluster as a compute target type in the Data Science service
    * Support for creating model deployments and jobs that use a compute target as the deployment
    infrastructure in the Data Science service
    * Support for multi-inference endpoints in model deployments in the Data Science service
    * Support for flexible dense virtual machine shapes in the Compute service
    * Support for network firewall health status APIs in the Network Firewall service
    * Support for security attributes when creating or updating network firewalls
    in the Network Firewall service
    * Support for mapped secrets when creating or updating decryption rules in the Network Firewall service
    * Support for Zero Trust Packet Routing (ZPR) security attributes in the Kubernetes Engine service
    * The fields `availability_domain` and `subnet_id` were made required in `PlacementConfiguration`
    in the Kubernetes Engine service
    * The models `CreateIdcsAuthConfigurationDetails`, `CreateIdcsCustomServiceAuthConfigurationDetails`,
    `IdcsAuthConfiguration`, and `IdcsCustomServiceAuthConfiguration` were removed in the Data Science service
    * The enum values `IDCS` and `IDCS_CUSTOM_SERVICE` were removed from `AuthConfiguration.type`
    in the Data Science service
  - Refresh ops_relax-python-depends.patch
  - Update BuildRequires and Requires from setup.py

++++ python-opentelemetry-instrumentation-fastapi:

  - Add patch support-fastapi-0.137.patch:
    * Support fastapi 0.137 changes.

++++ python-pdm:

  - Update to 2.28.0:
    [#]# Breaking Changes
    * Update the minimum required Python version to 3.10.
    [#]# Features & Improvements
    * Add experimental workspace support for managing local member projects in
    a shared root lock file.
    * Defer startup-time imports for Python, virtualenv, and self-management
    commands.
    * Respect existing values of pyproject.toml when running pdm init or pdm
    new.
    * Move project plugin installations from .pdm-plugins under the project
    root to an isolated cache directory, and add a fixer to migrate existing
    plugin directories. (CVE-2026-47781, bsc#1268386)
    * Remove legacy importlib compatibility wrappers and use standard-library
    importlib.metadata and importlib.resources APIs directly.
    * Support exclude-newer in pyproject.toml in the [tool.pdm.resolution]
    table
    * pdm lock --exclude-newer now accepts relative durations in the format
    N{d|h|w}, such as 7d, 12h, and 3w, in addition to absolute UTC dates and
    timestamps.
    [#]# Bug Fixes
    * Fix pdm completion bash printing __ltrim_colon_completions: command not
    found (and a similar error for _get_comp_words_by_ref) when the generated
    script is sourced in a bash without the bash-completion package loaded,
    such as Git Bash on Windows or minimal Linux containers. The script now
    defines small fallbacks for both helpers when they are not already
    available.
    * Avoid forwarding duplicate SIGINT in pdm run on POSIX.
    * Fix a security issue with the installer to disallow installing to paths
    outside of the scheme directory. (CVE-2026-47764, bsc#1268385)
    * Refuse to write project-local config and state files (pdm.toml,
    .pdm-python, .python-version) when the destination is a symlink,
    preventing an untrusted repository from clobbering files outside the
    project root. (CVE-2026-47763, bsc#1268384)
    * Fix a regression issue that PDM_LOCKFILE env var is not respected.
    * Allow configuring the default lock --exclude-newer value with
    strategy.exclude-newer.
    * Preserve pylock package markers when refreshing lockfile hashes.
    * Fixed pdm add --frozen-lockfile --no-sync to skip dependency resolution
    and update only pyproject.toml without attempting to write the lockfile.
    * Fix [tool.pdm.options] being loaded from the current working directory
    instead of the target project when -p/--project is used.
    * Put make_file_executable into pdm.utils to replace the method of the same
    name in installer. To fix a breakage introduced by installer v1.
    * Fix pdm init <template> overwriting the template's additions to
    build-system.requires when build-system.build-backend matches the user's
    selection.
    * Fixed PySpecSet merging to handle impossible Python version ranges
    like >=3.6,<3.4 without crashing on empty or inverted gaps.
  - Drop patch support-installer-1.0.patch, merged upstream.

++++ python-pypdf:

  - Update to 6.14.0
    * Apply general limit for requested image size
    * Speed up recovery when reading broken cross-reference table
    6.13.3
    * Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well
    6.13.2
    * Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV
    6.13.1 (bsc#1268787, CVE-2026-54651)
    * Prevent infinite loops when processing threads/articles

++++ python-pytest-salt-factories:

  - Do not build for Python 3.14 as it is incompatible (bsc#1267022)

++++ python-pyvmomi:

  - Update to version 9.1.0.0
    Bindings
    * Updated bindings with support for the new vSphere 9.1 APIs.
    Changes
    * pyVmomi supports Python 3.10+ only.
    * When a request fails with a low-level exception the TCP
    connection is closed.
    * Fixed pyVim.task.WaitForTask() loop when the task life exceeds
    VIM API session.
    * Dependency on 'pyOpenSSL' is replaced with dependency on
    'cryptography'.
    Breaking changes
    * pyVmomi.Soapadapter.ParseHttpResponse() is removed.
    * pyVmomi.Soapadapter.HEADER_SECTION_END is removed.
    * pyvim.connect.VimSessionOrientedStub.makeExtensionLoginMethod()
    is removed.

++++ salt:

  - Fix the tests failing after switching to non-vendored tornado
  - Fix the default group in tests for new users in SLE 15.6
  - Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
  - Fix file fetching with cp module on non-vendored tornado
  - Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
  - Added:
    * fix-the-tests-failing-after-switching-to-non-vendore.patch
    * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
    * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
    * fix-file-fetching-with-non-vendored-tornado.patch
    * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch

++++ salt-test:

  - Fix the tests failing after switching to non-vendored tornado
  - Fix the default group in tests for new users in SLE 15.6
  - Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
  - Fix file fetching with cp module on non-vendored tornado
  - Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
  - Added:
    * fix-the-tests-failing-after-switching-to-non-vendore.patch
    * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
    * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
    * fix-file-fetching-with-non-vendored-tornado.patch
    * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch

++++ qqc2-breeze-style6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ quimup:

  - Update to version 2.1.2
    Fixed bugs:
    * Failed to detect if MPD is installed on some distros.
    * Failed to detect external apps on some distros.
    * Error checking when executing external apps.
    * Did not check if linked docs in 'About' tab existed.
    * Wrong # column width in playlist in recent QT versions.
    * Jittery / slow min-max transition (removed fading).
    Added features:
    * Link to changelog at the bottom of the 'About' tab.
    * Script for the (un)installation of binaries.
    Other:
    * Better conversion of QString for command line output.

++++ raspberrypi-firmware-dt:

  - Drop RP1 hog gpio node
    0001-arm64-dts-bcm2712-Remove-rp1-hog-gpio-node.patch-

++++ rqlite:

  - Update to version 10.2.4:
    * Fix some non-AWS S3-compatible stores
  - includes changes from 10.2.3
    * Check snapshot store integrity before first actual use
    * Disable HTTP timeout for boot and restore operations via the shell
    * HTTP layer ignores ErrNoWALToSnapshot when snapshotting
    * Close Snapshot Streamer ASAP when restoring to local node

++++ rubygem-agama-yast:

  - Do not take zypp lock (bsc#1268344).
  - Avoid calling to YaST software and configure products to include
    os-prober as optional package.

++++ sarg:

  - Modernize spec file:
    * drop the obsolete Group tag and the redundant %defattr
    * convert the gd and pcre2 devel dependencies to their
    pkgconfig() form
    * use https for the URL and Source

++++ sccache:

  - Update to version 0.15.0~17:
    * Add experimental concurrent cache support
    * Release 0.16.0
    * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)
    * Ignore empty-set environment values (#2639)
    * feat: all backends support making them as read-only (#2705)
    * Enable RE on Linux-aarch64 (#2668)
    * Slightly improve logging (#2734)
    * chore: encode jwt key and cert digest with base64 in logs (#2712)
    * chore: make clippy happy (#2727)
    * feat: avoid sccache wrapper when resolving compiler (#2720)
    * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)
    * remove too noisy bench
    * feat(nvcc): support argument: `--dependency-output` (#2708)
    * fix: add newline when printing dist-status to stdout
    * Revert "Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon…"
    * Don't wait depfiles for gcc/clang preprocessed inputs
    * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored

++++ sddm-kcm6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ selinux-policy:

  - fixed text output during package instalation (bnc#1268009)
  - enhance migration marker cleanup in /etc/selinux to properly
    delete markers when removing selinux-policy-FLAVOUR package

++++ spectacle:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * Set startupId to token received from notification on OpenUrlJob
    * InlineMessageModel: Support copyToClipboard with QUrl

++++ stackit-cli:

  - Update to version 0.65.0:
    * chore(loadbalancer): remove local interface (#1443)
    * fix(iaas): wrong encoding and decoding of user data attribute
    in server commands (#1439)
    * chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#1423)
    * fix(iaas): update examples and fix the payload for boot volumes
    (#1436)
    * chore(kms): migrate kms to new multi version sdk (#1437)
    * chore(load-balancer): sdk migration (#1432)
    * feat(vpn): basic connection commands (#1433)
    * fix(server): switch to flag for service account email (#1429)
    * chore(git): migrate to new SDK structure (#1435)
    * chore(iaas): migrate to multi version SDK
    * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1434)
    * chore(readme): fix mise command (#1425)
    * chore(deps): bump actions/checkout from 6 to 6.0.2 (#1428)
    * refac(cdn): Migrate to new SDK structure (#1421)

++++ systemsettings6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ talhelper:

  - Update to version 3.1.12:
    * docs: update CLI reference documentation (#1657)
    * chore(deps): update dependency siderolabs/talos to v1.13.5
    * chore(container): update ghcr.io/siderolabs/talosctl docker tag
    to v1.13.5
    * fix(genconfig): provide better error on bad secrets bundle
    * chore(schema): update talos-extensions.yaml JSON schema (#1655)
    * chore(github-action): update renovatebot/github-action action
    to v46.1.16
    * chore(schema): update talos-extensions.yaml JSON schema (#1650)
    * chore(schema): update talos-extensions.yaml JSON schema (#1649)
    * chore(github-action)!: Update actions/checkout action to v7
    * fix(deps): update module github.com/google/go-containerregistry
    to v0.21.7
    * chore(schema): update talos-extensions.yaml JSON schema (#1647)
    * chore(container): update alpine docker tag to v3.24.1
    * chore(schema): update talos-extensions.yaml JSON schema
    * fix(go): renovate didn't update validate v2 properly
    * chore(container): update
    mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest
    to 50f86fc (#1643)
    * chore(container): update registry.k8s.io/kubectl docker tag to
    v1.36.2
    * fix(deps)!: Update module github.com/gookit/validate to v2
    * fix(deps): update module github.com/budimanjojo/talhelper/v3 to
    v3.1.11
    * feat: update Scoop for talhelper version v3.1.11
    * feat: update flake (#1639)

++++ talosctl:

  - update to 1.13.5 (.4 had broken vendoring):
    https://github.com/siderolabs/talos/releases/tag/v1.13.5
    No talosctl-related changes
    * Dependency Changes
  - siderolabs/pkgs@7eed62d chore: bump containerd to 2.2.5 (cve
    patches)
  - github.com/ryanuber/columnize v2.1.2 new
  - github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.30
  - github.com/siderolabs/pkgs v1.13.0-28-g54ec9fc ->
    v1.13.0-36-g6b315f7
  - github.com/siderolabs/talos/pkg/machinery v1.13.4 -> v1.13.5
  - github.com/siderolabs/tools v1.13.0-4-ga06bb31 ->
    v1.13.0-6-g9b78252
  - k8s.io/api v0.36.1 -> v0.36.2
  - k8s.io/apiextensions-apiserver v0.36.1 -> v0.36.2
  - k8s.io/apimachinery v0.36.1 -> v0.36.2
  - k8s.io/apiserver v0.36.1 -> v0.36.2
  - k8s.io/client-go v0.36.1 -> v0.36.2
  - k8s.io/component-base v0.36.1 -> v0.36.2
  - k8s.io/cri-api v0.36.1 -> v0.36.2
  - k8s.io/kube-scheduler v0.36.1 -> v0.36.2
  - k8s.io/kubectl v0.36.1 -> v0.36.2
  - k8s.io/kubelet v0.36.1 -> v0.36.2
  - k8s.io/pod-security-admission v0.36.1 -> v0.36.2

++++ thermald:

  - Update to version 2.5.12.2.git+dd186d0 (snapshot of git master
    past the 2.5.12 release; the package tracks master to avoid the
    bogus upstream v2.15.10 tag, see upstream issue #487):
    * New hardware: add NovaLake U/P/H/Hx CPU IDs
    * Security hardening of the privileged daemon and its handling of
    firmware GDDV data vaults and dbus input:
    + open files with O_NOFOLLOW and restrict writes to /sys
    + canonical path resolution and proper error replies in the
    dbus helper; sanitize zone names supplied via dbus
    + sanitize the data vault from /lib/firmware and add bounds /
    range checks (GDDV, XML config, cpufreq/sysfs reads, max
    power, IDSP buffer); cap cooling devices, thermal zones,
    APCT conditions, segments, data-vault size and max exponent
    + force null termination; drop the /dev/mem workaround
    * Features: enable/disable features via a config file; virtual
    sensor support with per-trip min/max cdev state via XML;
    lockless power sensor read; ITMT hysteresis and table sanity
    check; store and restore the RAPL register at exit
    * Bug fixes: fix an infinite loop in update_highest_trip_temp;
    fix a stale mutex unlock and a missing thd_engine_mutex
    unlock; fix a regression in the rapl cdev; exception-safe
    unique_ptr for link_sensors; fix 32-bit compilation error
    * rapl: raise the max sane power limit from 100W to 1000W
    * Adaptive mode: support new platforms in adaptive mode only,
    exit adaptive mode when zones are not created
    * Drop references to the deprecated dptfxtract and ThermalMonitor
  - Drop power_user_cleanups.patch: upstream now removes the dbus
    "power group" machinery itself (the patch was a revert of that
    code and no longer applies)
  - Build on aarch64 as well: upstream 2.5.12 adds a generic ARM
    thermal backend (src/thd_platform_arm.cpp), so extend
    ExclusiveArch with aarch64
  - Drop the now-unused dptfxtract Suggests and hicolor-icon-theme
    BuildRequires (no GUI/icon is shipped), and the leftover
    sysusers machinery (%sysusers_requires plus the sysuser-shadow
    and sysuser-tools BuildRequires) since no system user is created

++++ thin-provisioning-tools:

  - Update to version 1.3.3:
    * thin_explore: fix a panic when navigating an empty top-level
    tree, and panics when navigating empty btrees
    * era_invalidate: fix missing era array traversal when no
    writesets exist
    * thin_metadata_pack/unpack: flush the output file before
    returning
    * update bundled dependencies to their latest patch releases

++++ union6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1
    * Guard data assignment in Color's assignment operator (kde#521578)
    * output/quick: Use the proper export macro for event type statics
    * Don't use `inline static` for event type defaults (kde#521637)
    * input/css: Support loading defaults from a different path than the main style
    * output/kirigami: Track window activation in PlatformTheme
    * output/quick: Ensure ComboBox uses font height for implicit height even if empty
    * output/quick: Ensure we get the right DPR for icons (kde#521331)
    * output/quick: Ensure QtQuick relocates the ComboBox popup if outside bounds
    * output/quick: Consider padding when determining implicit size of a combobox popup
    * qtwidgets: For pressed buttons, check for sunken instead
  - Delete unused 0001-Don-t-install-a-.so-link-for-internal-libraries.patch

++++ valgrind:

  - update to 3.27.1 (jsc#PED-15483):
    * 519574  valgrind 3.27 "--fair-sched=yes" does not work
    * 519613  Valgrind incorrectly unpacks the result of sys_port
    (port_getn)
    * on error, leading to a ~60s wallclock time delay on every
    call
    * n-i-bz  Update vg-lifespan (copyright) years
    * n-i-bz  Use SSizeT for VG_(readlink) result in VG_(realpath)

++++ valgrind-client-headers-source:

  - update to 3.27.1 (jsc#PED-15483):
    * 519574  valgrind 3.27 "--fair-sched=yes" does not work
    * 519613  Valgrind incorrectly unpacks the result of sys_port
    (port_getn)
    * on error, leading to a ~60s wallclock time delay on every
    call
    * n-i-bz  Update vg-lifespan (copyright) years
    * n-i-bz  Use SSizeT for VG_(readlink) result in VG_(realpath)

++++ virtui-manager:

  - version 3.1.1:
    * Export in XML; use a common modal for howto
    * Refactor provisioning and enhance documentation for automation
    (use osinfo-db)

++++ wacomtablet-kcm6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * Update version for new release 6.7.1

++++ warewulf4:

  - adding correct flag --update-overlays fixing  (bsc#1268790)

++++ xdg-desktop-portal-kde6:

  - Update to 6.7.1:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.1
  - Changes since 6.7.0:
    * clipboard: Check for inputcapture session everywhere
    * Update version for new release 6.7.1
    * clipboard: Fix crash after session is destroyed
    * accessdialog: Fix body label
    * settings: Explicitely set delayed reply when sending errors

++++ xh:

  - Update to 0.26.1:
    Features:
    * Pretty-print XML responses, see #450
    * Add experimental HTTP message signatures (RFC 9421) support, see #448
    Other:
    * Upgrade to reqwest v0.13, see #441

------------------------------------------------------------------
------------------  2026-6-22  -  Jun 22 2026  -------------------
------------------------------------------------------------------

++++ agama:

  - Unify cargo dependencies and move it to shared one in workspace
    for easier future updates (gh#agama-project/agama#3652)

++++ agama-web-ui:

  - Do not load the parts of the Monaco editor from an external 3rd
    party CDN server (bsc#1268433)
  - Update react router to fix CVE-2026-34077
    (bsc#1267500)
  - Apply UI language and keymap changes right away, without needing
    a page reload (gh#agama-project/agama#3657).

++++ apache-commons-dbcp:

  - Update to version 2.14.0
    * New features:
    + Add org.apache.commons.dbcp2.datasources
    .PooledConnectionManager.setPassword(char[])
    * Fixed Bugs
    + DBCP-597: Validation query not timing out on connections
    managed by SharedPoolDataSource
    + DBCP-597: Validation query not timing out on connections
    managed by PerUserPoolDataSource
    + DBCP-597:  KeyedCPDSConnectionFactory
    .validateObject(UserPassKey, PooledObject) ignores timeouts
    less than 1 second when there is no validation query
    + Modernize tests to use JUnit 5 features
    + Javadoc is missing its Overview page
    + Deprecate org.apache.commons.dbcp2.Jdbc41Bridge.Jdbc41Bridge(),
    constructor will be private in the next major release
    + Deprecate org.apache.commons.dbcp2.Constants.Constants(),
    constructor will be private in the next major release
    + Fix Javadoc warnings on Java 17
    + Fix Javadoc warnings on Java 21
    + Remove -nouses directive from maven-bundle-plugin. OSGi package
    imports now state 'uses' definitions for package imports, this
    doesn't affect JPMS (from org.apache.commons:commons-parent:80)
    + XAException thrown by LocalXAResource now all include a message
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "isSharedConnection" in one thread may not yield the value of
    the most recent write from another thread [org.apache.commons
    .dbcp2.managed.ManagedConnection]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "closed" in one thread may not yield the value of the most
    recent write from another thread [org.apache.commons.dbcp2
    .cpdsadapter.PooledConnectionImpl]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "closed" in one thread may not yield the value of the most
    recent write from another thread [org.apache.commons.dbcp2
    .DelegatingStatement] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "cacheState" in one thread may not yield the value of the most
    recent write from another thread [org.apache.commons.dbcp2
    .DelegatingConnection] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Operation on the
    "fatalSqlExceptionThrown" shared variable in
    "PoolableConnection" class is not atomic [org.apache.commons
    .dbcp2.PoolableConnection]
    AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "clearStatementPoolOnReturn" in one thread may not yield the
    value of the most recent write from another thread
    [org.apache.commons.dbcp2.PoolingConnection]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "maxTotal" in one thread may not yield the value of the most
    recent write from another thread [org.apache.commons.dbcp2
    .datasources.SharedPoolDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultBlockWhenExhausted" in one thread may not yield the
    value of the most recent write from another thread [org.apache
    .commons.dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultLifo" in one thread may not yield the value of the
    most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultMaxIdle" in one thread may not yield the value of the
    most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultMaxTotal" in one thread may not yield the value of the
    most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultMinIdle" in one thread may not yield the value of the
    most recent write from another thread [org.apache.commons.dbcp2
    .datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultNumTestsPerEvictionRun" in one thread may not yield
    the value of the most recent write from another thread
    [org.apache.commons.dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultTestOnBorrow" in one thread may not yield the value of
    the most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultTestOnCreate" in one thread may not yield the value of
    the most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultTestOnReturn" in one thread may not yield the value of
    the most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultTestWhileIdle" in one thread may not yield the value
    of the most recent write from another thread [org.apache.commons
    .dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultTransactionIsolation" in one thread may not yield the
    value of the most recent write from another thread [org.apache
    .commons.dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "rollbackAfterValidation" in one thread may not yield the
    value of the most recent write from another thread [org.apache
    .commons.dbcp2.datasources.InstanceKeyDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "loginTimeout" in one thread may not yield the value of the
    most recent write from another thread [org.apache.commons
    .dbcp2.cpdsadapter.DriverAdapterCPDS] At
    DriverAdapterCPDS.java:[line 644]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "maxIdle" in one thread may not yield the value of the most
    recent write from another thread [org.apache.commons.dbcp2
    .cpdsadapter.DriverAdapterCPDS] At DriverAdapterCPDS.java:
    [line 664] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "maxPreparedStatements" in one thread may not yield the value
    of the most recent write from another thread [org.apache
    .commons.dbcp2.cpdsadapter.DriverAdapterCPDS] At
    DriverAdapterCPDS.java:[line 673]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "numTestsPerEvictionRun" in one thread may not yield the value
    of the most recent write from another thread [org.apache
    .commons.dbcp2.cpdsadapter.DriverAdapterCPDS] At
    DriverAdapterCPDS.java:[line 722]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "poolPreparedStatements" in one thread may not yield the value
    of the most recent write from another thread [org.apache
    .commons.dbcp2.cpdsadapter.DriverAdapterCPDS] At
    DriverAdapterCPDS.java:[line 757]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "autoCommitOnReturn" in one thread may not yield the value of
    the most recent write from another thread [org.apache.commons
    .dbcp2.PoolableConnectionFactory-]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "cacheState" in one thread may not yield the value of the most
    recent write from another thread [org.apache.commons.dbcp2
    .PoolableConnectionFactory] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "clearStatementPoolOnReturn" in one thread may not yield the
    value of the most recent write from another thread
    [org.apache.commons.dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "defaultTransactionIsolation" in one thread may not yield the
    value of the most recent write from another thread
    [org.apache.commons.dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "autoCommitOnReturn" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons.dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "fastFailValidation" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons .dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "maxOpenPreparedStatements" in one thread may not yield the
    value of the most recent write from another thread
    [org.apache.commons.dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "poolStatements" in one thread may not yield the value of the
    most recent write from another thread
    [org.apache.commons.dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "rollbackOnReturn" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons.dbcp2.PoolableConnectionFactory]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "autoCommitOnReturn" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons.dbc-p2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "cacheState" in one thread may not yield the value of the most
    recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "clearStatementPoolOnReturn" in one thread may not yield the
    value of the most recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "autoCommitOnReturn" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "fastFailValidation" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "logExpiredConnections" in one thread may not yield the value
    of the most recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "registerConnectionMBean" in one thread may not yield the
    value of the most recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix SpotBugs [ERROR] Medium: Shared primitive variable
    "rollbackOnReturn" in one thread may not yield the value of
    the most recent write from another thread
    [org.apache.commons.dbcp2.BasicDataSource]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Fix a potential resource leak if an SQLException occurs during
    an attempt to obtain an XAConnection
    + Minor optimisations to the processing of the
    "connectionProperties" string
    * Changes
    + Update tests and CPDSConnectionFactory#invalidate to accomodate
    changed behavior in the fix for POOL-424.
    + Bump org.apache.commons:commons-parent from 78 to 93 #521, #537,
    [#538]
    + Bump org.apache.commons:commons-pool2 from 2.12.0 to 2.13.0 #474
    + Port site from Doxia 1 to 2
    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5
    + Bump org.slf4j:slf4j-simple from 2.0.16 to 2.0.17 #481
    + Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0
    [#506]
    * Removed
    + Removed internal constructors and methods from the
    package-private class CPDSConnectionFactory; this is binary
    compatible
    + Removed an internal constructor and methods from the
    package-private class KeyedCPDSConnectionFactory; this is
    binary compatible
  - Removed patches:
    * apache-commons-dbcp-javadoc.patch
    * apache-commons-dbcp-sourcetarget.patch
    + not needed with this version
  - Update to version 2.13.0
    * New features:
    + Add support for ignoring non-fatal SQL state codes #421
    + Add @FunctionalInterface to SwallowedExceptionListener
    + Add missing Javadoc comments and descriptions
    + Add tests, raise the bar for JaCoCo checks
    * Fixed Bugs
    + Avoid object creation when invoking
    isDisconnectionSqlException #422
    + DBCP-599: PoolableConnectionFactory.destroyObject() method
    behaves incorrectly on ABANDONED connection, issue with
    unhandled AbstractMethodError.
    DelegatingConnection.abort(Executor) should delegate to
    Jdbc41Bridge
    + DelegatingConnection.setSchema(String) should delegate to
    Jdbc41Bridge
    + Fix possible NullPointerException in PoolingConnection.close()
    + PerUserPoolDataSource.registerPool() incorrectly replacing a
    CPDSConnectionFactory into managers map before throwing an
    IllegalStateException
    + Fix PMD UnnecessaryFullyQualifiedName in AbandonedTrace
    + Fix PMD UnnecessaryFullyQualifiedName in
    PoolableCallableStatement
    + Fix PMD UnnecessaryFullyQualifiedName in
    PoolablePreparedStatement
    + Fix PMD UnnecessaryFullyQualifiedName in Utils
    + Fix PMD UnnecessaryFullyQualifiedName in
    LocalXAConnectionFactory
    + Fix SpotBugs MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in
    PerUserPoolDataSource
    + Fix SpotBugs MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in
    SharedPoolDataSource
    * Changes
    + Bump org.apache.commons:commons-parent from 66 to 78 #360,
    [#371], #395, #420, #426, #436, #441, #449
    + Bump commons-logging:commons-logging from 1.3.0 to 1.3.4 #368,
    [#399], #423
    + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0
    [#404], #412, #427
    + Bump org.hamcrest:hamcrest from 2.2 to 3.0 #410
    + Bump org.slf4j:slf4j-simple from 2.0.13 to 2.0.16 #413, #418
  - Update to version 2.12.0
    * New features
    + Add property project.build.outputTimestamp for build
    reproducibility
    + Add null guards in DelegatingDatabaseMetaData constructor #352
    + DBCP-473: Data source bean creation failed due to mismatched
    return type of setter and getter for connectionInitSqls in
    BasicDataSource: Add BasicDataSource.setConnectionInitSqls(List)
    * Fixed Bugs
    + DBCP-590: BasicDataSource#setAbandonedUsageTracking has no
    effect
    + DBCP-596: PoolingConnection.toString() causes
    StackOverflowError
    + PooledConnectionImpl.destroyObject(PStmtKey, PooledObject) can
    throw NullPointerException #312
    + PoolingConnection.destroyObject(PStmtKey, PooledObject) can
    throw NullPointerException #312
    + DBCP-477: Fix examples in
    src/main/java/org/apache/commons/dbcp2/package-info.java
    * Changes
    + Use ReentrantLock in PoolableConnection.close, #591
    + Bump commons-lang3 from 3.13.0 to 3.14.0
    + Bump commons-parent from 64 to 66
    + Bump org.slf4j:slf4j-simple from 2.0.9 to 2.0.12 #349
  - Update to version 2.11.0
    * Changes
    + Update call sites of deprecated APIs from Apache Commons Pool
    + Add DataSourceMXBean.getUserName() and deprecate getUsername()
    + Bump h2 from 2.2.220 to 2.2.224, #308
    + Bump commons-parent from 60 to 64
    + Bump org.slf4j:slf4j-simple from 2.0.7 to 2.0.9 #301
    + Bump org.apache.commons:commons-pool2 from 2.11.1 to 2.12.0
    + Bump jakarta.transaction:jakarta.transaction-api from 1.3.1
    to 1.3.3
  - Update to version 2.10.0
    * New features
    + Add and use AbandonedTrace#setLastUsed(Instant)
    ° Add and use Duration versions of now deprecated APIs that
    use ints and longs.
    ° Internally track durations with Duration objects instead of
    ints and longs.
    ° See the JApiCmp report for the complete list
    + Add PMD check to default Maven goal
    + Add Utils.getDisconnectionSqlCodes() and
    Utils.DISCONNECTION_SQL_CODES
    + Make BasicDataSource.getConnectionPool() public
    + Add github/codeql-action
    * Fixed Bugs
    + Fix StackOverflowError in PoolableConnection
    .isDisconnectionSqlException #123
    + PerUserPoolDataSourceFactory.getNewInstance(Reference) parsed
    defaultMaxWaitMillis as an int instead of a long
    + Reimplement time tracking in AbandonedTrace with an Instant
    instead of a long
    + Migrate away from deprecated APIs in Apache Commons Pool
    + Fix possible NullPointerException in BasicDataSourceFactory
    .validatePropertyNames()
    + Fix possible NullPointerException in BasicDataSourceFactory
    .getObjectInstance()
    + DBCP-585: Connection level JMX queries result in concurrent
    access to connection objects, causing errors #179
    + UserPassKey should be Serializable
    + LifetimeExceededException should extend SQLException
    + Replace Exception with SQLException in some method signatures
    (preserves binary compatibility, not source)
    + Don't leak Connections when PoolableConnectionFactory
    .makeObject() fails to create a JMX ObjectName
    + Performance: No need for map lookups if we traverse map
    entries instead of keys
    + Performance: Refactor to use a static inner class in
    DataSourceXAConnectionFactory
    + Reuse pattern of throwing XAException instead of
    NullPointerException in LocalXAConnectionFactory
    .LocalXAResource
    + SpotBugs: An overridable method is called from constructors in
    PoolableCallableStatement
    + SpotBugs: An overridable method is called from constructors in
    PoolablePreparedStatement
    + Wrong property name logged in ConnectionFactoryFactory
    .createConnectionFactory(BasicDataSource, Driver)
    + Throw SQLException instead of NullPointerException when the
    connection is already closed
    + CPDSConnectionFactory.makeObject() does not need to wrap and
    rethrow SQLException
    + PoolingDataSource.close() now always throws SQLException
    + [StepSecurity] ci: Harden GitHub Actions #282
    + Fixes typos, missing or misplaced characters, and grammar
    issues #299
    * Changes
    + Bump actions/cache from 2.1.6 to 3.0.8 #147, #176
    + Bump actions/checkout from 2.3.4 to 3.0.2 #139, #143, #173
    + Bump actions/setup-java from 2 to 3.6.0 #229
    + Bump actions/upload-artifact from 3.1.0 to 3.1.1 #231
    + Bump checkstyle from 8.44 to 9.3 #121, #130, #149, #158, #190
    + Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #210
    + Bump commons-pool2 2.10.0 to 2.11.1
    + Bump junit-jupiter from 5.8.0-M1 to 5.9.1 #125, #136, #157,
    [#203], #218
    + Bump spotbugs-maven-plugin from 4.3.0 to 4.7.3.0 #140, #154,
    [#161], #178, #192, #200, #204, #213, #234
    + Bump spotbugs from 4.3.0 to 4.7.3 #124, #133, #151, #164,
    [#177], #189, #214, #230
    + Bump org.mockito:mockito-core from 3.11.2 to 4.11.0, #128,
    [#138], #152, #175, #188. #193, #208, #215, #232, #235, #246,
    [#252]
    + Bump maven-javadoc-plugin from 3.3.0 to 3.4.1 #131, #184
    + Bump maven-pmd-plugin from 3.14.0 to 3.19.0 #132, #172, #195
    + Bump pmd from 6.44.0 to 6.52.0
    + Bump narayana-jta from 5.12.0.Final to 5.12.7.Final #134,
    [#156], #163, #185, #197
    + Bump japicmp-maven-plugin from 0.15.3 to 0.17.1 #137, #166,
    [#174], #211, #238
    + Bump h2 from 1.4.200 to 2.2.220 #153, #183, #196, #287. Update
    SQL for migration from H2 1.4.200 to 2.0.204 where "KEY" and
    "VALUE" are now reserved keywords
    + Bump jboss-logging from 3.4.2.Final to 3.4.3.Final #162
    + Bump slf4j-simple from 1.7.30 to 1.7.36 #169
    + Bump commons-parent from 52 to 60 #180, #219, #254, #278
    + Bump JaCoCo from 0.8.7 to 0.8.8
    + Bump maven-surefire-plugin 2.22.2 to 3.0.0-M7
    + Bump apache-rat-plugin 0.13 to 0.14
    + Bump commons-lang3 from 3.12 to 3.13.0
  - Update to version 2.9.0
    * New features
    + Add and reuse Constants.KEY_USER and Constants.KEY_PASSWORD
    + Add and reuse DataSourceMXBean
    + Add and reuse DriverAdapterCPDS
    .{get|set}DurationBetweenEvictionRuns(), deprecate
    {get|set}TimeBetweenEvictionRunsMillis(long)
    + Add and reuse DriverAdapterCPDS
    .{get|set}MinEvictableIdleDuration(), deprecate
    {get|set}MinEvictableIdleTimeMillis(int)
    + Add and reuse CPDSConnectionFactory
    .setMaxConnLifetime(Duration), deprecate
    setMaxConnLifetimeMillis(long)
    + Add and reuse KeyedCPDSConnectionFactory
    .setMaxConnLifetime(Duration), deprecate
    setMaxConnLifetimeMillis(long)
    + Add and reuse KeyedCPDSConnectionFactory
    .setMaxConnLifetime(Duration), deprecate
    setMaxConnLifetimeMillis(long)
    + Add and reuse InstanceKeyDataSource
    .{get|set}DefaultMaxWait(Duration), deprecate
    {get|set}DefaultMaxWaitMillis(long)
    * Fixed Bugs
    + DBCP-569: Fix test random failure on TestSynchronizationOrder
    .testInterposedSynchronization, #84
    + DBCP-568: ManagedConnection must clear its cached state after
    transaction completes, #75
    + Minor Improvements #78
    + DBCP-567: Use abort rather than close to clean up abandoned
    connections
    + Performance Enhancement: Call toArray with Zero Array Size #20
    + DBCP-562: Avoid exposing password via JMX #38
    + DBCP-575: Remove redundant initializers #98
    + DBCP-577: Simplify test assertions #100, #113
    + DBCP-573: DataSource implementations do not implement Wrapper
    interface correctly #93
    + Replace FindBugs with SpotBugs.
    + DataSourceConnectionFactory.getUserPassword() may expose
    internal representation by returning
    DataSourceConnectionFactory.userPassword.
    + DataSourceXAConnectionFactory.getUserPassword() may expose
    internal representation by returning
    DataSourceXAConnectionFactory.userPassword.
    + DriverAdapterCPDS.getPasswordCharArray() may expose internal
    representation by returning DriverAdapterCPDS.userPassword.
    + new org.apache.commons.dbcp2.managed
    .DataSourceXAConnectionFactory(TransactionManager,
    XADataSource, String, char[],
    TransactionSynchronizationRegistry) may expose internal
    representation by storing an externally mutable object into
    DataSourceXAConnectionFactory.userPassword.
    + org.apache.commons.dbcp2.managed.DataSourceXAConnectionFactory
    .setPassword(char[]) may expose internal representation by
    storing an externally mutable object into
    DataSourceXAConnectionFactory.userPassword.
    + org.apache.commons.dbcp2.PStmtKey.getColumnIndexes() may
    expose internal representation by returning PStmtKey
    .columnIndexes.
    + org.apache.commons.dbcp2.PStmtKey.getColumnNames() may expose
    internal representation by returning PStmtKey.columnNames.
    + DBCP-578: Use Collections.synchronizedList() Instead Of Vector
    [#101]
    + DBCP-576: Simplify and inline variables #99
    + Update PoolKey#toString() to avoid revealing a user name is
    here
    + Internal package private UserPassKey class stores its user
    name as a char[] as it already does the password
    + DBCP-579: Performance of DelegatingConnection
    .prepareStatement(String) regressed enormously in 2.8.0
    compared to 1.4. DelegatingConnection should also cache
    connection schema string to avoid calling the
    Connection#getSchema() for each key creation.
    DelegatingConnection should also cache connection catalog
    string to avoid calling the Connection#getCatalog() for each
    key creation
    + BasicDataSource should test for the presence of a security
    manager dynamically, not once on initialization
    * Changes
    + Bump mockito-core from 3.5.11 to 3.11.2 #66, #72, #77, #85,
    [#91], #105, #110, #116
    + Bump actions/checkout from v2.3.2 to v2.3.4 #65, #74
    + Bump actions/cache from v2 to v2.1.6 #90, #108
    + Bump commons-pool2 from 2.8.1 to 2.9.0
    + Bump actions/setup-java from v1.4.2 to v2 #69
    + Bump japicmp-maven-plugin from 0.14.3 to 0.15.2 #71, #82
    + Bump maven-pmd-plugin from 3.13.0 to 3.14.0 #76
    + Bump japicmp-maven-plugin from 0.14.4 to 0.15.3, #83
    + Bump Hamcrest 1.3 -> 2.2 #70
    + Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2 #88
    + Bump junit-jupiter from 5.7.0 to 5.8.0-M1, #89, #106
    + Bump narayana-jta from 5.10.6.Final to 5.12.0.Final #103, #111
    + Bump maven-javadoc-plugin from 3.2.0 to 3.3.0 #107
    + Bump commons.jacoco.version 0.8.6 -> 0.8.7
    + Bump jboss-logging from 3.4.1.Final to 3.4.2.Final #109
    + Bump org.jboss:jboss-transaction-spi from 7.6.0.Final to
    7.6.1.Final
    + Bump commons-pool2 from 2.9.0 to 2.10.0
    + Bump checkstyle to 8.44
    + Bump spotbugs from 4.2.3 to 4.3.0 #117
    + Bump spotbugs-maven-plugin from 4.2.3 to 4.3.0 #118
  - Update to version 2.8.0
    * New features
    + DBCP-564: Fix BasicManagedDataSource leak of connections
    opened after transaction is rollback-only #39
    + DBCP-566: Add clearStatementPoolOnReturn #42
    + DBCP-559: Add start, restart methods to BasicDataSource. #50
    * Fixed Bugs
    + DBCP-555: NPE when creating a SQLExceptionList with a null
    list
    + DBCP-558: Fix DelegatingConnection readOnly and autoCommit
    caching mechanism #35
    + Fix regression introduced by unreleased code clean-up #63
    * Changes
    + Update to PR#36 - PrepareStatement and prepareCall methods are
    extracted #37
    + Mask out user name and password from DriverAdapterCPDS
    .toString()
    + DBCP-650: Update Apache Commons Pool from 2.7.0 to 2.8.1, #48
    + Update tests from H2 1.4.199 to 1.4.200
    + Update tests from Mockito 3.0.0 to 3.5.11 #47, #60, #64
    + Update tests from jboss-logging 3.4.0.Final to 3.4.1.Final
    + Update tests from narayana-jta 5.9.5.Final to 5.10.6.Final,
    [#61]
    + Update tests from junit-jupiter 5.5.1 to 5.7.0 #62
    + Update tests from org.slf4j:slf4j-simple 1.7.26 to 1.7.30
    + Update build from
    com.github.siom79.japicmp:japicmp-maven-plugin 0.13.1 to
    0.14.3
    + Update build from maven-javadoc-plugin 3.1.1 to 3.2.0
    + Update build from maven-pmd-plugin 3.12.0 to 3.13.0
    + Update org.apache.commons:commons-parent from 48 to 51
    + Update jacoco-maven-plugin from 0.8.4 to 0.8.6
    + Update maven-checkstyle-plugin from 3.0.0 to 3.1.1
    + Update actions/checkout from v1 to v2.3.2, #44, #51
    + Update actions/setup-java from v1.4.0 to v1.4.2 #58
  - Update to version 2.7.0
    * New features
    + DBCP-539: ManagedDataSource#close() should declare used
    exceptions
    + DBCP-547: Add a ConnectionFactory class name setting for
    BasicDataSource.createConnectionFactory() #33
    + Add missing Javadocs
    * Fixed Bugs
    + DBCP-538: Wrong JMX base name derived in
    BasicDataSource#updateJmxName
    + DBCP-546: Avoid NPE when calling DriverAdapterCPDS.toString()
    + DBCP-550: java.util.IllegalFormatException while building a
    message for a SQLFeatureNotSupportedException in Jdbc41Bridge
    .getObject(ResultSet,String,Class)
    + Fix Javadoc link in README.md #21
    * Changes
    + DBCP-540: Close ObjectOutputStream before calling
    toByteArray() on underlying ByteArrayOutputStream #28
    + DBCP-541: Upgrade to JUnit Jupiter #19
    + DBCP-542: Fix tests on Java 11
    + DBCP-543: Update Apache Commons Pool from 2.6.1 to 2.6.2
    + DBCP-529: Add 'jmxName' property to web configuration
    parameters listing
    + DBCP-548: Update Apache Commons Pool from 2.6.2 to 2.7.0
    + DBCP-549: Make org.apache.commons.dbcp2.AbandonedTrace
    .removeTrace(AbandonedTrace) null-safe
    + DBCP-551: org.apache.commons.dbcp2.DelegatingStatement
    .close() should try to close ALL of its result sets even when
    an exception occurs
    + DBCP-552: org.apache.commons.dbcp2.DelegatingConnection
    .passivate() should close ALL of its resources even when an
    exception occurs
    + DBCP-553: org.apache.commons.dbcp2.PoolablePreparedStatement
    .passivate() should close ALL of its resources even when an
    exception occurs
    + DBCP-554: org.apache.commons.dbcp2.PoolableCallableStatement
    .passivate() should close ALL of its resources even when an
    exception occurs
    + Update tests from org.mockito:mockito-core 2.28.2 to 3.0.0
    + Update tests from H2 1.4.198 to 1.4.199
    + Update tests from com.h2database:h2 1.4.197 to 1.4.199
    + Update tests from org.jboss.narayana.jta:narayana-jta
    5.9.2.Final to 5.9.5.Final
    + Update tests from org.jboss.logging:jboss-logging 3.3.2.Final
    to 3.4.0.Final
    + Update tests from org.mockito:mockito-core 2.24.0 to 2.28.2
    + Update tests from org.mockito:mockito-core 2.28.2 to 3.0.0
  - Update to version 2.6.0
    * New features
    + DBCP-534: Allow for manual connection eviction
    + DBCP-514: Allow DBCP to register with a
    TransactionSynchronizationRegistry for XA cases
    + DBCP-519: Add some toString() methods for debugging (never
    printing passwords.)
    + DBCP-527: Add getters to some classes
    + DBCP-528: org.apache.commons.dbcp2.DriverManagerConnectionFactory
    should use a char[] instead of a String to store passwords
    * Fixed Bugs
    + DBCP-518: Allow DBCP to work with old Java 6/JDBC drivers
    without throwing AbstractMethodError
    * Changes
    + DBCP-517: Make defensive copies of char[] passwords
    + DBCP-515: Do not try to register synchronization when the
    transaction is no longer active
    + DBCP-516: Do not double returnObject back to the pool if there
    is a transaction context with a shared connection
    + DBCP-520: BasicManagedDataSource needs to pass the TSR with
    creating DataSourceXAConnectionFactory
    + DBCP-537: Update Apache Commons Pool from 2.6.0 to 2.6.1
  - Update to version 2.5.0
    * New features
    + DBCP-506: Support JDBC 4.2
    + DBCP-479: Support default schema in configuration
    * Fixed Bugs
    + DBCP-508: Prepared statement keys should take a Connection's
    schema into account
    + DBCP-512: Avoid exceptions when closing a connection in
    mutli-threaded use case
    * Changes
    + DBCP-505: Update Java requirement from version 7 to 8
    + DBCP-427: Examines 'SQLException's thrown by underlying
    connections or statements for fatal (disconnection) errors
    + DBCP-507: Change default for fail-fast connections from false
    to true
    + DBCP-504: Increase test coverage
    + DBCP-510: Update Apache Commons Pool from 2.5.0 to 2.6.0
  - Update to version 2.4.0
    * Fixed Bugs
    + DBCP-484: Connection leak during XATransaction in high load
    + DBCP-496: Add support for pooling CallableStatements to the
    org.apache.commons.dbcp2.cpdsadapter package
    * Changes
    + DBCP-492: Drop Ant build
    + DBCP-491: Ensure DBCP ConnectionListener can deal with
    transaction managers which invoke rollback in a separate
    thread
    + DBCP-494: org.apache.commons.dbcp2.PStmtKey should make copies
    of given arrays in constructors
    + DBCP-495: Remove duplicate code in org.apache.commons.dbcp2
    .cpdsadapter.PStmtKeyCPDS
    + DBCP-497: Deprecate use of PStmtKeyCPDS in favor of PStmtKey
    + DBCP-498: org.apache.commons.dbcp2
    .DataSourceConnectionFactory should use a char[] instead of a
    String to store passwords
    + DBCP-499: org.apache.commons.dbcp2.managed
    .DataSourceXAConnectionFactory should use a char[] instead of
    a String to store passwords
    + DBCP-500: org.apache.commons.dbcp2.cpdsadapter
    .DriverAdapterCPDS should use a char[] instead of a String to
    store passwords
    + DBCP-501: org.apache.commons.dbcp2.datasources
    .CPDSConnectionFactory should use a char[] instead of a String
    to store passwords
    + DBCP-502: org.apache.commons.dbcp2.datasources internals
    should use a char[] instead of a String to store passwords
    + DBCP-503: org.apache.commons.dbcp2.datasources
    .InstanceKeyDataSourceFactory.closeAll() does not close all
  - Update to version 2.3.0
    * Fixed Bugs
    + DBCP-476: AbandonedTrace.getTrace() contains race condition
    + DBCP-482: Avoid javax.management.InstanceNotFoundException on
    shutdown when a bean is not registered
    * Changes
    + DBCP-483: Make constant public: org.apache.commons.dbcp2
    .PoolingDriver.URL_PREFIX
    + DBCP-486: DriverAdapterCPDS.setUser(), setPassword(), and
    getPooledConnection() with null arguments throw
    NullPointerExceptions when connection properties are set
    + DBCP-487: Add API org.apache.commons.dbcp2.datasources
    .PerUserPoolDataSource.clear()
    + DBCP-488: NPE for org.apache.commons.dbcp2.cpdsadapter
    .DriverAdapterCPDS.setConnectionProperties(null)
    + DBCP-490: The method org.apache.commons.dbcp2.PoolingDriver
    .getConnectionPool(String) does not tell you which pool name
    is not registered when it throws an exception
  - Update to version 2.2.0
    * New features
    + DBCP-451: Add constructor DriverManagerConnectionFactory(String).
    + DBCP-462: Refactoring to prepare for a future patch to enable
    pooling of all prepared and callable statements in
    PoolingConnection
    + DBCP-458: Make it simpler to extend BasicDataSource to allow
    sub-classes to provide custom GenericObjectPool implementations
    + DBCP-474: Enable pooling of all prepared and callable
    statements inPoolingConnection
    * Fixed Bugs
    + DBCP-481: Update Apache Commons Pool from 2.4.2 to 2.5.0
    + DBCP-454: OSGi declarations contain multiple import headers
    for javax.transaction
    + DBCP-478: Wrong parameter name in site documentation for
    BasicDataSource Configuration Parameters
    + DBCP-452: Add jmxName to properties set by
    BasicDataSourceFactory. This enables container-managed pools
    created from JNDI Resource definitions to enable JMX by
    supplying a valid root JMX name
    + DBCP-446: NullPointerException thrown when calling
    ManagedConnection.isClosed()
    + DBCP-444: InvalidateConnection can result in closed connection
    returned by getConnection.
    + DBCP-449: Complete the fix for DBCP-418, enabling
    PoolableConnection class to load in environments (such as GAE)
    where the JMX ManagementFactory is not available
    + DBCP-455: Ensure that the cacheState setting is used when
    statement pooling is disabled
    + DBCP-453: Ensure that setSoftMinEvictableIdleTimeMillis is
    used when working with BasicDataSource
    + DBCP-456: Correct the name of the configuration attribute
    softMinEvictableIdleTimeMillis
    + DBCP-472: Avoid potential infinite loops when checking if an
    SQLException is fatal for a connection or not
    + DBCP-468: Expand the fail-fast for fatal connection errors
    feature to include managed connections
    + DBCP-463: Correct a typo in the method name
    PoolableConnectionFactory#setMaxOpenPreparedStatements. The
    old method remains but is deprecated so not to break clients
    currently using the incorrect name.
    + DBCP-459: Ensure that a thread's interrupt status is visible
    to the caller if the thread is interrupted during a call to
    PoolingDataSource.getConnection().
    + DBCP-457: When using a BasicDataSource, pass changes related
    to the handling of abandoned connections to the underlying
    pool so that the pool configuration may be updated dynamically

++++ apache-commons-net:

  - Upgrade to 3.13.0
    * New features
    + Add DatagramSocketClient.getDefaultTimeoutDuration() and
    deprecate getDefaultTimeout()
    + NET-741: Add subnet IPv6 handling with SubnetUtils6 #391
    * Fixed Bugs
    + DaytimeTCPClientTest now should now pass inside most VPNs
    + Migrate tests to JUnit5 #358, #359
    + Fix malformed Javadoc comments
    + IMAPExportMbox now restores the current thread's interrupt
    flag when catching InterruptedException
    + IOUtil.readWrite() now restores the current thread's interrupt
    flag when catching InterruptedException
    + TelnetInputStream now restores the current thread's interrupt
    flag when catching InterruptedException
    + NET-740: FTP fails to parse listings for Linux vsftpd in
    Chinese or Japanese #393
    + TelnetInputStream.read() doesn't preserve the original
    InterruptedException as the cause of its
    InterruptedIOException
    + FTPClient._storeFile(String, String, InputStream) doesn't
    always close it's internal socket when an exception is thrown
    early in processing
    + ListenerList.removeListener(T) now ignores null input to avoid
    a NullPointerException
    + ListenerList.addListener(T) now ignores null input
    + Fix typo in FTPConnectionClosedException message from FTP
    .getReply(boolean)
    + Reimplement Util.copyReader() with IOUtils.copyLarge()
    + Reimplement Util.copyStream() with IOUtils.copyLarge()
    + Reimplement Util.copyStream() with IOUtils.copyLarge()
    + Deprecate Util.copyReader(Reader, Writer) in favor of IOUtils
    .copyLarge(Reader, Writer)
    * Changes
    + Bump org.apache.commons:commons-parent from 85 to 97 #371,
    [#388], #389
    + Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0
    + Bump commons-io:commons-io from 2.20.0 to 2.21.0
    + Bump Util.DEFAULT_COPY_BUFFER_SIZE from 1 KiB to 8 KiB
  - Upgrade to 3.12.0
    * New features
    + Add org.apache.commons.net.nntp.Article#getChild()
    + Add org.apache.commons.net.nntp.Article#getNext()
    + Add private SubnetAddressStringIterable and private
    SubnetAddressStringIterator to implement
    SubnetInfo.iterableAddressStrings() and
    SubnetInfo.streamAddressStrings() #298
    + Add SubnetInfo.iterableAddressStrings()
    + Add SubnetInfo.streamAddressStrings()
    + Add FTPCmd.OPTS
    + Add FTP.opts(String, String)
    + Add FTP.opts(String...)
    + Add FTP.setControlEncoding(Charset)
    + Add --OPTS to FTPClientExample
    + NET-727: Add accessing options map for TFTP request packet and
    allow using 'blksize' option #331
    + Add org.apache.commons.net.util.ListenerList.isEmpty()
    + Add org.apache.commons.net.ftp.FTPClient
    .getSystemTypeOverride()
    + Add generics to ListenerList
    + Add module-info.class in the JAR file instead of an
    Automatic-Module-Name in MANIFEST.MF
    + Fixed Bugs
    + Increase message limit in IMAPReply.TAGGED_RESPONSE from 80 to
    500 characters
    + Increase message limit in IMAPReply.UNTAGGED_RESPONSE from 160
    to 500 characters
    + Remove InvalidKeySpecException from AuthenticatingIMAPClient
    .auth(AUTH_METHOD, String, String) never throws, it's not
    thrown
    + Remove InvalidKeySpecException from AuthenticatingIMAPClient
    .authenticate(AUTH_METHOD, String, String) never throws, it's
    not thrown
    + Remove InvalidKeySpecException from ExtendedPOP3Client
    .auth(AUTH_METHOD, String, String) never throws, it's not
    thrown
    + Remove InvalidKeySpecException from
    org.apache.commons.net.smtp.AuthenticatingSMTPClient
    .auth(AUTH_METHOD, String, String) never throws, it's not
    thrown
    + Fix SpotBugs RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE in
    SSLSocketUtils
    + Fix PMD UnnecessaryFullyQualifiedName
    + Fix PMD UnusedFormalParameter
    + Fix PMD AvoidBranchingStatementAsLastInLoop in org.apache
    .commons.net.bsd.RCommandClient
    + Fix PMD UselessOverridingMethod in org.apache.commons.net
    .telnet.TelnetClient
    + Fix PMD UnnecessaryModifier
    + Deprecate MLSxEntryParser default constructor in favor of
    MLSxEntryParser.getInstance()
    + Deprecate direct access to org.apache.commons.net.nntp.Article
    .kid and next fields
    + Fix SpotBugs CT_CONSTRUCTOR_THROW in Base64 by implementing
    finalize() as a noop to avoid finalizer attacks
    + Add missing Javadoc to ListenerList
    + Add missing Javadoc to SubnetUtils
    + Deprecate PrintCommandListeners.PrintCommandListeners()
    + Deprecate NtpUtils.NtpUtils()
    + Deprecate FTPFileFilters.FTPFileFilters()
    + Avoid multiple possible NullPointerException in SocketClient
    .verifyRemote(Socket)
    + PrintCommandListener.protocolReplyReceived(ProtocolCommandEvent)
    doesn't always use an end-of-line
    + FTPClientExample uses the wrong FTP system type to parse file
    lines
    + Base64 does not call super.finalize()
    + TFTPServer does not call super.finalize()
    + KeyManagerUtils.loadStore(String, File, String) shouldn't
    ignore an IOException closing a keystore stream; use
    try-with-resources
    + NNTPClient.readNewsgroupListing() can use an ArrayList instead
    of a Vector
    + Deprecate org.apache.commons.net.util.Charsets
    + Performance: NTFTPEntryParser.parseFTPEntry(String) doesn't
    need to parse timestamps if there is no name
    + Improve error handling in org.apache.commons.net.ftp.parser
    .DefaultFTPFileEntryParserFactory
    .createFileEntryParser(String, FTPClientConfig)
    + Fail-fast in org.apache.commons.net.PrintCommandListener
    .PrintCommandListener(PrintWriter, boolean, char, boolean) if
    the PrintWriter is null
    + Avoid NullPointerException in org.apache.commons.net
    .PrintCommandListener.protocolCommandSent(ProtocolCommandEvent)
    + Avoid NullPointerException in org.apache.commons.net
    .PrintCommandListener.protocolReplyReceived(ProtocolCommandEvent)
    * Changes
    + Bump org.apache.commons:commons-parent from 70 to 85 #261,
    [#278], #280, #285, #298, #293, #300, #345
    + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.18.0
    [#268], #273, #281, #354
    + Bump commons-io:commons-io from 2.16.1 to 2.20.0 #286, #308
    + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to
    4.5.0 #314
    + Bump org.apache.ftpserver:ftpserver-core from 1.2.0 to 1.2.1
  - Upgrade to 3.11.1
    * Fixed Bugs
    + Allow longer data in pattern IMAPReply.UNTAGGED_RESPONSE
    + Fix Reproducible Builds issues #259
  - Upgrade to 3.11.0
    * New features
    + NET-726: Add protected getters to FTPSClient #204
    + Add SubnetUtils.toString()
    + Add Maven property project.build.outputTimestamp for build
    reproducibility
    + Add FTP.DEFLATE_TRANSFER_MODE to support the "deflate"
    compression format in FTPClient.setFileTransferMode(int)
    + Add org.apache.commons.net.SocketClient.checkOpenOutputStream()
    * Fixed Bugs
    + Precompile regular expression in UnixFTPEntryParser
    .preParse(List<String>)
    + Guard against polynomial regular expression used on
    uncontrolled data in VMSVersioningFTPEntryParser.REGEX
    + Guard against polynomial regular expression used on
    uncontrolled data in IMAPReply.TAGGED_RESPONSE
    + Guard against polynomial regular expression used on
    uncontrolled data in IMAPReply.UNTAGGED_RESPONSE
    + NET-730: Cannot connect to FTP server with HTTP proxy
    + Base 64 Encoding with URL and Filename Safe Alphabet should
    not chunk per RFC 4648
    + Deprecate org.apache.commons.net.util.Charsets.Charsets() for
    removal
    + Deprecate org.apache.commons.net.util.TrustManagerUtils
    .TrustManagerUtils() for removal
    * Changes
    + Bump commons-parent from 62 to 70 #238
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to 3.2.0,
    [#221]
    + Bump commons-lang3 from 3.13.0 to 3.14.0
    + Bump commons-io from 2.15.0 to 2.16.1 #236, #240
  - Upgrade to 3.10.0
    * New features
    +  Add and use DatagramSocketClient.setDefaultTimeout(Duration)
    and deprecate DatagramSocketClient.setDefaultTimeout(int)
    + Add and use TFTP.DEFAULT_TIMEOUT_DURATION and deprecate
    org.apache.commons.net.tftp.TFTP.DEFAULT_TIMEOUT
    + Add and use DatagramSocketClient#getSoTimeoutDuration()
    + Add and use DatagramSocketClient#setSoTimeout(Duration)
    + Add and use DatagramSocketClient.checkOpen()
    + Add TelnetClient.sendAYT(Duration)
    + TFTPServer implements AutoCloseable
    + DatagramSocketClient implements AutoCloseable
    + Add IMAP package tests, include junit-jupiter-params artifact
    [#166]
    + Add Base64 missing tests and documentation fixes #161
    + Add FTPFile tests and fix Javadoc typos #162
    + Add IMAPReply tests and documentation fixes #165
    * Fixed Bugs
    + NET-650: Delegate host resolution to Socket.connect() #138
    + Fixes many grammar issues and typos in JavaDoc and code
    comments #141
    + Remove redundant (null) initializations and other clean ups
    [#155]
    + TFTPServer.setMaxTimeoutRetries() now throws
    IllegalArgumentException instead of RuntimeException
    + TFTPServer.setSocketTimeout() now throws
    IllegalArgumentException instead of RuntimeException
    + FTPCommand.checkArray() now throws IllegalStateException
    instead of RuntimeException
    + org.apache.commons.net.nntp.Threader now throws
    IllegalStateException instead of RuntimeException
    + POP3Command static initializer now throws
    IllegalStateException instead of RuntimeException
    + SMTPCommand static initializer now throws
    IllegalStateException instead of RuntimeException
    + SubnetUtils.SubnetInfo.getPreviousAddress() now throws
    IllegalStateException instead of RuntimeException
    + IMAPExportMbox.MboxListener.chunkReceived(IMAP) now throws
    UncheckedIOException instead of RuntimeException
    + IMAPUtils.imapLogin(URI, int, ProtocolCommandListener) now
    throws IOException instead of RuntimeException while
    maintaining method signature source compatibility
    + [StepSecurity] ci: Harden GitHub Actions #156
    + NET-722: Javadoc for FtpClient
    .setControlKeepAliveReplyTimeout(Duration) says timeout is in
    milliseconds
    + Change class org.apache.commons.net.ftp.parser
    .MVSFTPEntryParser to support more datasets #182
    + Bulletproof TFTPServerPathTest #173
    + Deprecate org.apache.commons.net.util.Base64 in favor of
    java.util.Base64
    + Replace use of org.apache.commons.net.util.Base64 with
    java.util.Base64 in org.apache.commons.net.ftp
    + Replace use of org.apache.commons.net.util.Base64 with
    java.util.Base64 in org.apache.commons.net.imap
    + Replace use of org.apache.commons.net.util.Base64 with
    java.util.Base64 in org.apache.commons.net.pop3
    + Replace use of org.apache.commons.net.util.Base64 with
    java.util.Base64 in org.apache.commons.net.smtp
    * Changes
    + Bump commons-parent from 54 to 62 #132, #137, #153
    + Bump commons-io from 2.11.0 to 2.14.0
    + Bump commons-lang3 from 3.12.0 to 3.13.0

++++ apache-commons-pool2:

  - Update to 2.13.1
    * Fixed Bugs:
    + POOL-427: The fix for POOL-425 introduced a regression where
    addObject fails when maxIdle is negative (indicating no limit)
  - Removed patch:
    * jakarta-commons-pool-build.patch
    + not needed with this version
  - Update to 2.13.0
    * New features:
    + Add org.apache.commons.pool2.PooledObject
    .nonNull(PooledObject)
    + Add org.apache.commons.pool2.PooledObject
    .getObject(PooledObject)
    + Made statistics collection optional in BaseGenericObjectPool
    [#429]
    * Fixed Bugs:
    + POOL-424: GenericObjectPool.invalidateObject() can leave other
    threads waiting to borrow hanging. The fix for this issue
    changes behavior of invalidateObject. This method now always
    tries to add a new instance to the pool to replace the
    invalidated and destroyed instance. As a result of this
    change, abandoned object removal now attemps to replace
    abandoned objects
    + POOL-425: GenericObjectPool addObject does not respect maxIdle
    + POOL-350: Make placement of calls to GKOP reuseCapacity
    configurable
    + POOL-290: TestSoftRefOutOfMemory (unit test) can loop
    infinitely on failure
    + POOL-419: GenericObjectPool counters and object collections
    can be corrupted when returnObject and invalidate are invoked
    concurrently by client threads on the same pooled object
    + POOL-421: GenericObjectPool addObject should return
    immediately when there is no capacity to add
    + POOL-420: The maximum wait time for GenericKeyedObjectPool
    .borrowObject(*) may exceed configured maximum wait time.
    This is the same issue as POOL-418, but for GKOP. Also included
    in this fix is a change to addObject that prevents it from
    waiting for capacity to create. That method now returns
    immediately when there is no capcity to add to the pool under
    the given key
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS
    (from org.apache.commons:commons-parent:80)
    + POOL-418: The maximum wait time for GenericObjectPool
    .borrowObject(*) may exceed expectations due to a spurious
    thread wakeup. he remaining duration was incorrectly
    calculated and the method did not end up waiting long enough.
    Recompute the remaining duration an additional time when we
    block when exhausted
    + Fix site link from the About page to the Download page, see
    also #387
    + Operation on the "idleHighWaterMark" shared variable in
    "ErodingFactor" class is not atomic
    [org.apache.commons.pool2.PoolUtils$ErodingFactor] At
    PoolUtils.java:[line 98]
    AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
    + org.apache.commons.pool2.impl.GenericObjectPool
    .create(Duration) should normalize a negative duration to zero
    + Fix potential ConcurrentModificationException in EvictionTimer
    thread clean-up
    + Fix potential ConcurrentModificationException in EvictionTimer
    tasks
    * Changes:
    + Bump org.apache.commons:commons-parent from 79 to 93
    + [test] Bump commons-lang3 from 3.17.0 to 3.20.0
  - Update to 2.12.1
    * Fixed Bugs:
    + Use java.time.Instant precision in org.apache.commons.pool2
    .impl.ThrowableCallStack.Snapshot throwable message
    + GenericObjectPool.borrowObject(Duration) doesn't obey its
    borrowMaxWait Duration argument when the argument is different
    from GenericObjectPool.getMaxWaitDuration()
    + POOL-418:  The maximum wait time for GenericObjectPool
    .borrowObject(*) may exceed expectations due to a spurious
    thread wakeup
    + Javadoc is missing its Overview page
    + Migrate site generation templates to
    https://maven.apache.org/xsd/xdoc-2.0.xsd
    * Changes:
    + Bump org.apache.commons:commons-parent from 62 to 79
    + [test] Bump commons-lang3 from 3.13.0 to 3.17.0
    + [site] Pickup org.apache.bcel:bcel version from parent POM
    + [test] Bump org.ow2.asm:asm-util from 9.5 to 9.7.1
  - Update to 2.12.0
    * New features:
    + Add PooledObject.getFullDuration()
    + Add GenericKeyedObjectPool.getKeys()
    + Add KeyedObjectPool.getKeys()
    + Add github/codeql-action.
    + Add BaseGenericObjectPool.Evictor.toString().
    + Make BaseGenericObjectPool implement AutoCloseable.
    + Add BaseGenericObjectPool methods that return Duration and
    deprecate equivalents that return milliseconds as long
    + Add BaseObjectPoolConfig.DEFAULT_DURATION_BETWEEN_EVICTION_RUNS
    and deprecate BaseObjectPoolConfig
    .DEFAULT_TIME_BETWEEN_EVICTION_RUNS
    * Fixed Bugs:
    + POOL-401: Ensure that capacity freed by invalidateObject is
    available to all keyed pools
    + POOL-391: Ensure capacity freed by clear is made available to
    GKOP borrowers
    + POOL-402: Check blockWhenExhausted in hasBorrowWaiters #116
    + Simplify test assertion with similar call but simpler. #131
    + POOL-405: NullPointerException GenericKeyedObjectPool
    .invalidateObject(GenericKeyedObjectPool.java:1343)
    + POOL-408: Fix a typo related to KeyedPooledObjectFactory on
    the site and Javadoc
    + Fail-fast on null input for DefaultPooledObjectInfo
    .DefaultPooledObjectInfo(PooledObject) with a
    NullPointerException
    + POOL-393: Improve BaseGenericObjectPool's JMX Register
    performance when creating many pools
    + Null-guard in GenericObjectPool.use(T) like other call sites
    of GenericObjectPool.getPooledObject(T)
    + POOL-411: Guard against NPE when deregistering a key at the
    end of borrow
    + Make private GenericKeyedObjectPool.ObjectDeque class static
    + Make private BaseGenericObjectPool.StatsStore class static
    + [StepSecurity] ci: Harden GitHub Actions #225
    + Fix possible NPE in DefaultPooledObjectInfo
    .getPooledObjectToString()
    + Fix possible NPE in DefaultPooledObjectInfo
    .getPooledObjectType()
    * Changes:
    + Bump actions/cache from 2.1.6 to 3.0.10 #117, #138, #158,
    [#174], #178
    + Bump actions/checkout from 2.3.4 to 3.0.2 #109, #112, #134
    + Bump actions/setup-java from 2 to 3.5.1
    + Bump spotbugs from 4.3.0 to 4.7.3 #94, #99, #106, #114, #122,
    [#129], #137, #155, #168, #187
    + Bump spotbugs-maven-plugin from 4.3.0 to 4.7.3.0 #102, #110,
    [#119], #125, #128, #139, #149, #157, #161, #169, #180, #190
    + Bump junit-bom from 5.8.0-M1 to 5.9.1 #96, #100, #103, #120,
    [#160], #172
    + Bump checkstyle from 8.45.1 to 9.3 #97, #104, #111, #121,
    [#126], #132
    + Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #166
    + Bump maven-pmd-plugin from 3.14.0 to 3.19.0 #101, #153, #170
    + Bump pmd from 6.44.0 to 6.52.0
    + Bump biz.aQute.bndlib from 5.3.0 to 6.4.1 #105, #118, #135,
    [#151], #154, #191, #223
    + Bump maven-bundle-plugin from 5.1.3 to 5.1.8 #127, #146, #148,
    [#159], #164
    + Bump maven-surefire-plugin from 3.0.0-M7 to 3.0.0-M6 #142,
    [#152]
    + Bump asm-util from 9.2 to 9.5 #141, #179, #220
    + Bump commons-parent from 52 to 58 #173, #195, #204, #222
    + Bump japicmp-maven-plugin from 0.15.3 to 0.16.0
    + Bump animal-sniffer-maven-plugin 1.20 to 1.21
    + Bump Apache Commons BCEL 6.5.0 to 6.7.0 #194
    + Bump commons-lang3 from 3.12.0 to 3.13.0
  - Update to 2.11.1
    * Fixed Bugs:
    + Getting a PooledObject's active duration returns a negative
    duration when the object is borrowed but not returned.
    Affects:
    ° PooledObject.getActiveDuration()
    ° PooledObject.getActiveTime()
    ° PooledObject.getActiveTimeMillis()
    + The default implementation of TrackedUse.getLastUsedInstant()
    uses seconds instead of milliseconds
    + This interface is not implemented within Apache Commons Pool
    but affects Apache Commons DBCP
    + DefaultPooledObject.getIdleTime() drops nanoseconds on Java 9
    and greater
    + Fix field label in BaseGenericObjectPool toString() builder:
    From timeBetweenEvictionRunsMillis to
    durationBetweenEvictionRuns
    + Fix field label in BaseObjectPoolConfig toString() builder:
    From maxWaitMillis to maxWaitDuration
    + Fix field label in NoSuchElementException message for
    GenericObjectPool.borrowObject(Duration): From
    borrowMaxWaitMillis to borrowMaxWaitDuration
    + Reimplement DefaultPooledObject.getIdleDuration() using
    Duration computation
    + Reimplement BaseGenericObjectPool.maxBorrowWait as a Duration
    instead of a long
    + Minors Changes #89
    * Changes:
    + Bump checkstyle from 8.45 to 8.45.1 #93
    + Bump spotbugs from 4.2.3 to 4.3.0 and ignore new medium
    warnings EI_EXPOSE_REP and EI_EXPOSE_REP2
  - Update to 2.11.0
    * New features:
    + Track timestamps with Instants instead of longs. There is
    currently no increased precision on Java 8, but starting with
    Java 9, the JRE SystemClock precision is increased usually
    down to microseconds, or tenth of microseconds, depending on
    the OS, Hardware, and JVM implementation.
    Add and use:
    ° DefaultPooledObject.getCreateInstant()
    ° DefaultPooledObject.getLastUsedInstant()
    ° PooledObject.getCreateInstant()
    ° PooledObject.getLastBorrowInstant()
    ° PooledObject.getLastReturnInstant()
    ° PooledObject.getLastUsedInstant()
    ° TrackedUse#getLastUsedInstant()
    + Add BaseObjectPoolConfig.setEvictorShutdownTimeoutDuration(Duration),
    deprecate setEvictorShutdownTimeoutMillis(Duration)
    + Add BaseGenericObjectPool.{get|set}MaxWaitDuration(Duration)
    and deprecate {get|set}MaxWaitMillis(long)
    + Add BaseObjectPoolConfig.{get|set}MaxWaitDuration(Duration)
    and deprecate {get|set}MaxWaitMillis(long)
    + Add and use Duration APIs instead of ints or longs.
    ° Add and use Duration APIs in BaseGenericObjectPool:
    getDurationBetweenEvictionRuns(),
    getEvictorShutdownTimeoutDuration(),
    getMinEvictableIdleDuration(),
    getSoftMinEvictableIdleDuration(), setMaxWait(Duration),
    setMinEvictableIdle(Duration),
    setSoftMinEvictableIdle(Duration)
    ° Add and use Duration APIs in BaseObjectPoolConfig:
    getDurationBetweenEvictionRuns(),
    getEvictorShutdownTimeoutDuration(),
    getMinEvictableIdleDuration(),
    getSoftMinEvictableIdleDuration()
    ° Add and use Duration APIs in EvictionConfig:
    getIdleEvictDuration(), getIdleSoftEvictDuration()
    ° Add and use Duration APIs in PooledObject: getIdleDuration(),
    getActiveDuration()
    ° No need to initialize instance variables to their default
    values
    ° Update Javadocs.
    ° Update toString() implementations with duration labels
    + POOL-396: Handle validation exceptions during eviction. #85
    + POOL-395: Improve exception thrown in GenericObjectPool
    .borrowObject when pool is exhausted. Added
    BaseGenericObjectPool.setMessagesStatistics(boolean)
    + Add and use AbandonedConfig.copy(AbandonedConfig) to fix CPD
    code duplication issues in GenericKeyedObjectPool and
    GenericObjectPool
    + Pull up AbandonedConfig and related methods from
    GenericKeyedObjectPool and GenericObjectPool to
    BaseGenericObjectPool (fix for CPD issues).
    ° BaseGenericObjectPool.getLogAbandoned()
    ° BaseGenericObjectPool.getRemoveAbandonedOnBorrow()
    ° BaseGenericObjectPool.getRemoveAbandonedOnMaintenance()
    ° BaseGenericObjectPool.getRemoveAbandonedTimeout()
    ° BaseGenericObjectPool.getRemoveAbandonedTimeoutDuration()
    ° BaseGenericObjectPool.isAbandonedConfig()
    ° BaseGenericObjectPool.setAbandonedConfig(AbandonedConfig)
    * Fixed Bugs:
    + Fix "[WARNING] Old version of checkstyle detected. Consider
    updating to >= v8.30." Update Checktyle to 8.44
    + Make Duration setters use their respective default values when
    null
    + Call swallowException(Exception) instead of printing
    exceptions to the console in GenericKeyedObjectPool
    .removeAbandoned(AbandonedConfig) and GenericObjectPool
    .removeAbandoned(AbandonedConfig)
    + Fix Javadoc link reference #91
    + No need to initialize to default values. #90
    + Bump org.ow2.asm:asm-util from 9.1 to 9.2
    + Bump com.github.spotbugs:spotbugs from 4.2.3 to 4.3.0
    + Bump checkstyle from 8.44 to 8.45 #92
  - Update to 2.10.0
    * New features:
    + Add and use java.time.Duration APIs timeouts instead of using
    ints for seconds.
    + Implement AbandonedConfig for GenericKeyedObjectPool #67
    * Fixed Bugs:
    + Simplify Assertions in tests #77
    + Replace C-style array declaration with Java style #80
    + Use Objects.equals(); Use Anonymous type; Use method reference
    instead Lambda; Replace Loop with Collection.removeIf(). #81
    + Use diamond operator. #82
    + Code clean ups. #83
    * Changes:
    + Bump spotbugs-maven-plugin from 4.0.4 to 4.2.1 #48, #53, #59,
    [#62]
    + Bump actions/setup-java from v1.4.2 to v2, #47
    + Bump junit from 4.13 to 4.13.1 #50
    + Bump biz.aQute.bndlib from 5.1.2 to 5.3.0, #51, #66
    + POOL-389: Migrate to JUnit 5 #57
    + POOL-389: Minor Improvements #58, #60
    + Bump actions/checkout from v2.3.3 to v2.3.4 #54
    + Bump maven-pmd-plugin from 3.13.0 to 3.14.0 #55
    + Update commons.japicmp.version 0.14.3 -> 0.15.3
    + Bump actions/cache from v2 to v2.1.6 #65, #75, #84
    + Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2 #61
    + Bump asm-util from 9.0 to 9.1 #64
    + Bump spotbugs from 4.2.1 to 4.2.3 #68, #73, #74
    + Bump junit-bom from 5.7.1 to 5.8.0-M1 #76
    + Bump maven-bundle-plugin from 5.1.1 to 5.1.2 #70
    + Bump animal-sniffer-maven-plugin from 1.19 to 1.20
  - Update to 2.9.0
    * Changes:
    + POOL-387: Object factory destroy method should carry
    information on activation context
    + Update spotbugs from 4.0.6 to 4.1.3, #37, #41, #46
    + Update actions/checkout from v2.3.1 to v2.3.3 #56, #45
    + Update actions/setup-java from v1.4.0 to v1.4.2 #42
    + Update optional asm-util from 8.0.1 to 9.0 #44
  - Update to 2.8.1
    * New features:
    + POOL-385: Added Automatic-Module-Name to support JPMS #31
    * Fixed Bugs:
    + POOL-386: Refactored EvictionTimer usage tracking to fix
    POOL-386 and handle abandoned pools. #32
    + [Javadoc] Add missing @throws comment in PoolUtils. #27
    * Changes:
    + POOL-384: Update optional library org.ow2.asm:asm-util from
    7.2 to 8.0.1
    + Update site reports from org.apache.bcel:bcel 6.4.1 to 6.5.0
    + Update site reports from maven-pmd-plugin 3.12.0 to 3.13.0
    + Update build from biz.aQute.bnd:biz.aQute.bndlib
    5.1.0 -> 5.1.2
    + Update actions/checkout from v1 to v2.3.1 #33
    + Update commons-parent from 50 to 51 #36
    + Update Checkstyle plugin from 3.0.0 to 3.1.1
    + Update JApiCmp from 0.14.1 to 0.14.3
    + Update animal-sniffer-maven-plugin from 1.16 to 1.19
  - Update to 2.8.0
    * New features:
    + POOL-378: Deprecate PoolUtils.prefill(ObjectPool, int) in
    favor of ObjectPool.addObjects(int)
    + POOL-379: Deprecate PoolUtils.prefill(KeyedObjectPool, K, int)
    in favor of KeyedObjectPool.addObjects(K, int)
    + POOL-380: Deprecate PoolUtils.prefill(KeyedObjectPool,
    Collection, int) in favor of KeyedObjectPool
    .addObjects(Collection, int)
    * Fixed Bugs:
    + POOL-374: org.apache.commons.pool2.impl.GenericKeyedObjectPool
    .returnObject(K, T) should throw IllegalStateException instead
    of NullPointerException when a key is not found in the pool
    map
    + POOL-376: Fixed regression from original fix for POOL-356
    which could result in NPE when destroying objects
    + POOL-326: Eliminated NPE / ISE exceptions due to keyed pools
    being prematurely removed
    + Close BufferedOutputStream in test before calling toString on
    underlying BufferedOutputStream #26
    + [Javadoc] Add missing @throws comment in
    SoftReferenceObjectPool. #28
    * Changes:
    + POOL-375: Update optional library cglib from 3.2.12 to 3.3.0
    + Update site build from Apache Commons BCEL 6.3.1 to 6.4.1
    + POOL-377: Update optional library org.ow2.asm:asm-util from
    7.1 to 7.2
  - Update to 2.7.0
    * New features:
    + POOL-370: Add org.apache.commons.pool2.PooledObject
    [#]getBorrowedCount()
    + POOL-371: Add org.apache.commons.pool2.PooledObject
    [#]setRequireFullStackTrace(boolean)
    * Fixed Bugs:
    + POOL-361: Move validation for newly created objects into
    create(). Fixes #23
    * Changes:
    + POOL-364: Update from Java 7 to Java 8
    + POOL-365: Update ASM from 7.0 to 7.1
    + POOL-366: Update optional library cglib from 3.2.10 to 3.2.12
    + POOL-367: Fix typo in package private method name
    stopEvitor() -> stopEvictor() #22
  - Update to 2.6.2
    * Fixed Bugs:
    + POLL-362: Always null out org.apache.commons.pool2.impl
    .BaseGenericObjectPool.evictionIterator to match
    org.apache.commons.pool2.impl.BaseGenericObjectPool.evictor
    + POLL-363: Evictor Thread prevents Spring Context shutdown in
    standalone app
    + POLL-348: The commons-pool-evictor-thread should run as a
    Deamon
  - Update to 2.6.1
    * Fixed Bugs:
    + POOL-340: Correct validateObject with concurrent borrowObject
    + POOL-356: Fix deadlock on massive concurrent requests
    + POOL-347: Method borrowObject waits for maxWaitMillis over in
    pool full
    + POOL-359: NullPointerException closing multiple
    GenericObjectPools
    + POOL-326: Threading issue, NullPointerException and
    IllegalStateException in GenericKeyedObjectPool
    + POOL-352: CallStackUtils mishandles security manager check
    (partial fix.)
    * Changes:
    + POOL-345: Update optional library cglib from 3.2.6 to 3.2.9
    + POOL-346: Move common configuration setter to
    BaseGenericObjectPool #9
    + POOL-349: Update optional library asm-util from 6.2 to 7.0
    + POOL-360: Update optional library cglib from 3.2.9 to 3.2.10
  - Update to 2.6.0
    * Fixed Bugs:
    + POOL-337: Ensure cancelled eviction tasks are removed from
    scheduler
    + POOL-338: GenericObjectPool constructor may throw an exception
    under OSGi
    + POOL-324: org.apache.commons.pool2.impl.GenericObjectPool
    .getFactoryType() throws java.lang.ClassCastException
    + POOL-344: Delete repeated call startEvictor
    * Changes:
    + POOL-336: GenericObjectPool's borrowObject lock if create()
    fails with Error
    + POOL-339: Update optional library cglib from 3.2.5 to 3.2.6
    + POOL-341: Update optional library asm-util from 6.0 to 6.1.1
    + POOL-342: Update optional library asm-util from 6.1.1 to 6.2
  - Update to 2.5.0
    * New features:
    + POOL-332: ObjectPool and KeyedObject pool should extend
    Closeable.
    + POOL-335: Make abandoned logging stack trace requirements
    configurable. This also reverts the default behavior
    introduced by POOL-320.
    * Changes:
    + POOL-331: Update from Java 6 to 7.
    + POOL-333: Update optional dependency asm-util from 5.2 to 6.0
    + POOL-334: org.apache.commons.pool2.impl.ThrowableCallStack
    .Snapshot is missing serialVersionUID
  - Update to 2.4.3
    * New features:
    + POOL-320: Use more efficient stack walking mechanisms for
    usage tracking when possible.
    * Fixed Bugs:
    + POOL-328: Documentation with repeated words (sources, tests,
    and examples)
    + POOL-317: Correction of default value of
    softMinEvictableIdleTimeMillis in BaseObjectPoolConfig
    + POOL-309: Fix misspellings from "destory" to "destroy"
    + POOL-306: Ensure BaseGenericObjectPool
    .IdentityWrapper#equals() follows the expected contract for
    equals()
    + POOL-303: Ensure that threads do not block indefinitely if
    more than maxTotal threads try to borrow an object at the same
    time and the factory fails to create any objects.
    + POOL-310: Ensure that threads using GKOP do not block
    indefinitely if more than maxTotal threads try to borrow
    objects with different keys at the same time and the factory
    destroys objects on return
    + Ensure that any class name used for evictionPolicyClassName
    represents a class that implements EvictionPolicy.
    + POOL-315: Add a configurable delay (default 10 seconds) to
    wait when shutting down an Evictor to allow the associated
    thread time to complete and current evictions and to terminate
    + Ensure that a call to GKOP preparePool() takes account of
    other threads that might create objects concurrently,
    particularly the Evictor.
    * Changes:
    + POOL-280: Small refactoring of borrowObject() to reduce code
    duplication
    + POOL-307: Replace inefficient use of keySet with entrySet in
    GKOP
    + POOL-322: Update optional cglib library from 3.1 to 3.2.5.
    + POOL-323: Update optional OW2 ASM from 5.0.4 to 5.2.

++++ apache-commons-validator:

  - Update to 1.10.1
    * Fixed Bugs
    + VALIDATOR-502: Circular dependency in static initialization
    causes NullPointerException in GenericValidator.isCreditCard()
    * Changes
    + Bump org.apache.commons:commons-parent from 85 to 92 #361,
    [#370]
    + Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0
    [#346]
    + Bump org.apache.commons:commons-csv from 1.14.0 to 1.14.0
  - Generate and adapt ant build system
  - Removed patches:
    * commons-validator-1.5.0-locale.patch
    * commons-validator-1.5.0-srcencoding.patch
    + not needed with this version
  - Update to 1.10.0
    * New features
    + VALIDATOR-497: Add org.apache.commons.validator.routines
    .IBANValidator.validate(String)
    + DomainValidatorTest: added Maven profile to simplify execution
    + IBANValidator: Add Honduras from the IBAN registry
    Release 99 – Dec 2024.
    + Improve IBANValidatorTest by using registry from SWIFT
    + VALIDATOR-495: IBANValidator: Add Yemen
    + Add IBANValidator.Validator.getIbanLength()
    + Add Validator.getFieldName()
    + Add Validator.getParameters()
    + Add Validator.getResources()
    * Fixed Bugs
    + Add IBANValidator/IBANCheckDigit to package documentation.
    + Locale-dependent tests: calculate expected results as output
    varies between JVMs.
    + Locale default tests: ensure original is restored on failure
    + Fix order of actual and expected parameters in assertEquals()
    [#246]
    + InetAddressValidator does not need its instance variable, so
    uses a touch less memory
    + Pick up maven-antrun-plugin version from parent POM
    org.apache:apache
    + Deprecate GenericTypeValidator.GenericTypeValidator()
    + Deprecate GenericValidator.GenericValidator()
    + Deprecate ValidatorUtils.ValidatorUtils()
    + Deprecate Validator protected instance variable access for
    getter methods
    + Remove '-nouses' directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS
    (from org.apache.commons:commons-parent:80)
    + Shared primitive variable "clientValidation" in one thread may
    not yield the value of the most recent write from another
    thread [org.apache.commons.validator.Field] At
    Field.java:[line 758] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Shared primitive variable "fieldOrder" in one thread may not
    yield the value of the most recent write from another thread
    [org.apache.commons.validator.Field] At Field.java:[line 785]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Shared primitive variable "page" in one thread may not yield
    the value of the most recent write from another thread
    [org.apache.commons.validator.Field] At Field.java:[line 818]
    AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Shared primitive variable "merged" in one thread may not yield
    the value of the most recent write from another thread
    [org.apache.commons.validator.FormSet] At
    FormSet.java:[line 302] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
    + Pick up exec-maven-plugin version from parent POM
    + Use a Calendar constant instead of a magic number in tests.
    Make the code understandable without comment
    * Changes
    + Bump org.apache.commons:commons-parent from 78 to 85, fix
    changes.xml format for new plugin version
    + Bump org.apache.commons:commons-parent from 70 to 78 #231,
    [#245], #253, #256, #262, #267, #272, #278
    + DomainValidator: Changes from 2025061000, Last Updated Tue Jun
    10 07:07:01 2025 UTC.
    + IBANValidatorTest: parameterize SWIFT registry version; update
    to v99
    + Bump commons-logging:commons-logging from 1.3.2 to 1.3.5 #238,
    [#254]
    + Bump org.apache.commons:commons-lang3 from 3.15.0 to 3.17.0
    [#248], #257
    + Bump org.apache.commons:commons-csv from 1.11.0 to 1.14.0
    [#264]
    + Bump org.codehaus.mojo:exec-maven-plugin from 1.2.1 to 3.5.0
    [#305]
    + Bump commons-beanutils:commons-beanutils from 1.9.4 to 1.11.0
  - Update to 1.9.0
    * New features
    + IBANValidator: #209 - add Falkland Islands, Mongolia,
    Nicaragua, Oman, Somalia Thanks to homebeaver.
    + ISINValidator: Add 9 additional exception country code #129
    + ISINValidator: Add all codes from ISO 3166-1 alpha-2 except
    unassigned code elements
    + Add validator CASNumberCheckDigit for Chemical Registry CAS
    Numbers and ECNumberCheckDigit #217
    + Add PMD check to default Maven goal
    * Fixed Bugs
    + VALIDATOR-492: ValidatorUtils.copyFastHashMap is broken
    + DomainValidator: Changes from Version 2024040200,
    Apr 2 07:07:02 2024 UTC
    + Fix PMD UnnecessaryFullyQualifiedName
    * Changes
    + Bump org.apache.commons:commons-parent from 65 to 70 #201
    + Bump commons-logging:commons-logging from 1.3.0 to 1.3.2 #199,
    [#221]
    + Bump org.apache.commons:commons-csv from 1.10.0 to 1.11.0 #214
  - Update to 1.8.0
    * New features
    + Add github/codeql-action
    + VALIDATOR-486: Add new countries to IBAN list: DJ, RU #88
    + Add IBANValidator.Validator.getRegexValidator()
    + Add RegexValidator.getPatterns()
    + Add country codes listed as other countries and territories in
    the IBAN registry for Finland: AX
    + Add country codes listed as other countries and territories in
    the IBAN registry for France: GF, GP, MQ, RE, PF, TF, YT, NC,
    BL, MF, PM, WF
    + Add country codes listed as other countries and territories in
    the IBAN registry for United Kingdom: IM, JE, GG
    + Add ValidatorAction.setClassName(String) and deprecate
    setClassname(String)
    * Fixed Bugs
    + Update Javadoc for InetAddressValidator isValid #76
    + VALIDATOR-479: Fix typo in /routines/package-summary.html #79
    + Use JUnit 5 assertThrows() #92, #93, #94, #95
    + [StepSecurity] ci: Harden GitHub Actions #136
    + Javadoc typos #144
    + Precompile regular expression in InetAddressValidator
    .isValidInet6Address(String)
    + Fix SpotBugs [ERROR] Medium: Class org.apache.commons
    .validator.routines.CreditCardValidator$1 defines
    non-transient non-serializable instance field ccr
    [org.apache.commons.validator.routines.CreditCardValidator$1]
    In CreditCardValidator.java SE_BAD_FIELD
    + Fix SpotBugs [ERROR] High: Class org.apache.commons.validator
    .ValidatorAction defines non-transient non-serializable
    instance field validationMethod [org.apache.commons.validator
    .ValidatorAction] In ValidatorAction.java SE_BAD_FIELD
    + Fix SpotBugs [ERROR] High: Found reliance on default encoding
    in org.apache.commons.validator.ValidatorAction
    .readJavascriptFile(String): new java.io
    .InputStreamReader(InputStream)
    + Fix SpotBugs [ERROR] Medium: Inconsistent synchronization of org
    .apache.commons.validator.ValidatorAction.jsFunction; locked
    62% of time
    + Port tests to JUnit 5. Exception: DomainValidatorStartupTest
    + Use singletons in org.apache.commons.validator
    .CreditCardValidator
    * Changes
    + Bump Java from 7 to 8
    + Bump actions/cache from 2 to 3.0.11 #71, #84. #90, #91
    + Bump actions/checkout from 2.3.1 to 3.0.2, #38, #47, #70
    + Bump actions/setup-java from 1.4.0 to 3.6.0 #42, #72, #98
    + Bump actions/upload-artifact from 3.1.0 to 3.1.1 #96
    + Bump junit from 4.13 to 5.9.1 Vintage #44
    + Bump maven-pmd-plugin from 3.13.0 to 3.19.0 #69, #77, #80, #81
    + Bump commons-parent from 52 to 65 #83, #107, #111, #132
    + Bump japicmp-maven-plugin from 0.15.3 to 0.15.7
    + Bump maven-antrun-plugin from 3.0.0 to 3.1.0 #74
    + Bump commons-csv from 1.6 to 1.10.0 #118
    + Bump japicmp-maven-plugin from 0.15.7 to 0.16.0
    + Bump commons-logging:commons-logging from 1.2 to 1.3.0
    * Removed
    + Remove FindBugs, SpotBugs is in use #87
  - Update to 1.7.0
    * New features
    + VALIDATOR-474: DomainValidator should allow local overrides
    + VALIDATOR-473: Allow Email- and UrlValidator to use specified
    DomainValidator
    + VALIDATOR-471: Allow DomainValidator overrides at run-time
    + VALIDATOR-423: Add ISINValidator
    + VALIDATOR-455: Add IBAN validator for VA – Vatican City State
    + VALIDATOR-446: ISSN Validator extract ISSN from EAN-13
    * Fixed Bugs
    + VALIDATOR-403: Accept Discover cards of 17 digits long that
    start with 6011
    + VALIDATOR-408: DISCOVER Card Validation Patterns
    + VALIDATOR-472: UrlValidator should not be more lax than
    java.net.URI
    + VALIDATOR-283: URLValidator should check for illegal Hex
    characters
    + VALIDATOR-445: Inet6Address may also contain a scope id
    + VALIDATOR-452: Validation of URL containing IPv4-mapped IPv6
    address
    + VALIDATOR-438: IBANValidator fails for El Salvador. Add
    definition
    + VALIDATOR-434: Field does not synchronize iteration on
    synchronized list
    + VALIDATOR-437: Update Apache Commons BeanUtils dependency
    from 1.9.2 to 1.9.3. This picks up BEANUTILS-482: Update
    commons-collections from 3.2.1 to 3.2.2 (CVE-2015-4852).
    + VALIDATOR-460: Update Apache Commons BeanUtils dependency
    from 1.9.3 to 1.9.4.  This picks up BEANUTILS-520: Mitigate
    CVE-2014-0114.
    + VALIDATOR-461: Generic .gmbh top level domain is considered
    invalid
    + VALIDATOR-444: LongValidator: numbers bigger than the maxvalue
    are Valid
    + VALIDATOR-416: CreditCardValidator default ctor disagrees with
    Javadoc
    + VALIDATOR-467: URL validator fails if path starts with double
    slash and has underscores
    + VALIDATOR-464: UrlValidator says
    "file://bad ^ domain.com/label/test" is valid
    + VALIDATOR-449: Leading and trailing spaces in EmailValidator
    should not be valid
    + VALIDATOR-302: EMailValidator: Addresses with leading spaces
    must not be accepted
    + VALIDATOR-468: DomainValidator.getTLDArray does not synch
    mutable arrays
    * Changes
    + Drop Clirr and Cobertura in favour of JApiCmp and JaCoCo
    + IANA TLD lists: Updated to Version 2020073100, Last Updated
    Fri Jul 31 07:07:01 2020 UTC
    + VALIDATOR-428: Update commons digester to 2.1

++++ apko:

  - Update to version 1.2.18:
    * build(deps): bump k8s.io/apimachinery from 0.36.1 to 0.36.2
    (#2279)

++++ arp-scan:

  - Add arp-scan-EACCES-as-ENOENT.patch: treat EACCES like ENOENT when
    stat'ing the MAC/vendor mapping file (ieee-oui.txt / mac-vendor.txt)
    in the current directory, so arp-scan falls through to the system
    datadir instead of failing with "Permission denied"
    (boo#1210703, gh#royhills/arp-scan#120)
  - Drop obsolete RPM group

++++ ast-grep:

  - Update to version 0.44.0:
    * 0.44.0 bump version
    * chore: move outline docs and benchmarks out of repo (#2763)
    * chore(deps): update dependency smol-toml to v1.7.0 (#2762)
    * Add JavaScript outline rules and stream JSON files (#2761)
    * fix: update edge case fallback behavior
    * fix: improve root multi meta var error
    * fix: reject root multi-metavariable patterns (#2727)
    * fix: don't leak metavar bindings across siblings in nthChild ofRule (#2677)
    * fix: extract python from-import modules in outline (#2758)
    * fix: match go outline types by declaration (#2759)
    * fix: skip empty files in outline (#2757)
    * feat: mark duplicate outline names (#2756)
    * refactor: inline outline member kind lookup (#2755)
    * refactor: make outline extract return iterator (#2754)
    * refactor: stream outline extraction items (#2753)
    * perf: use single traversal for outline extraction (#2751)
    * perf: cache transform replace regexes (#2750)
    * fix: don't leak metavar bindings from a negated `not` rule (#2676)
    * refactor: fold outline extract options into extractors (#2749)
    * refactor: split outline extract options and style (#2748)
    * fix: remove redundant ui
    * fix: remove unused (super) visibility
    * refactor: map outline cli to core options (#2747)
    * feat: apply outline extractor options (#2746)
    * feat: add outline extractor options (#2745)
    * fix: variable naming fix
    * fix: simplify some code (#2744)
    * fix: trailing ast-grep-ignore on a multi-line statement suppresses it (#2678)
    * chore(deps): update actions/checkout action to v7 (#2731)
    * fix: remove deadcode allow
    * fix: cover async rust outline rules (#2743)
    * feat: add bundled outline rules for more languages (#2739)
    * feat: add outline CLI command (#2738)
    * perf: use cursor-backed outline traversal (#2737)
    * feat: run outline extractors (#2729)
    * chore(deps): update oxlint monorepo to v1.70.0 (#2726)
    * refactor: rename outline runtime extractors
    * docs: document outline model design
    * feat: combine outline extractors
    * feat: parse outline item and member rules
    * feat: parse outline common rules
    * feat: add outline runtime rule types
    * refactor: move outline to separate crate
    * fix: simplify some call
    * refactor: split fixer variable validation (#2724)
    * refactor: validate rule core directly (#2723)
    * test: move matcher tests to rule core (#2722)
    * refactor: wrap rewriter config errors (#2721)
    * test: validate global rule fix vars via rule config (#2719)
    * fix: check undefined meta var in fix (#2718)
    * fix: remove fix from SerializableCore (#2717)
    * fix: preserve unused suppression fixer (#2716)
    * refactor: move optional fixer to RuleConfig (#2715)
    * fix: add fixer var check (#2714)
    * Refactor rule config (#2713)
    * refactor: mvoe rewriters into SerializableRuleCore (#2711)
    * refactor: move rewriter out (#2712)
    * feat: add outline rule schema (#2710)
    * docs: remove outline target alias fields (#2709)
    * chore(deps): update rust crate smallvec to v1.15.2 (#2701)
    * fix(deps): update rust-wasm-bindgen monorepo (#2704)
    * fix: remove unused trait/methods (#2708)
    * feat: add outline entry model (#2703)
    * refactor: remove legacy outline placeholders (#2702)
    * feat: add outline CLI shell (#2700)
    * fix(deps): update rust-wasm-bindgen monorepo (#2693)
    * chore(deps): update oxlint monorepo to v1.69.0 (#2692)
    * chore(deps): update rust crate regex to v1.12.4 (#2694)
    * chore(deps): update dependency @types/node to v24.13.2 (#2698)
    * doc: design outline command (#2699)
    * Outline first builtin rule (#2695)
    * chore(deps): update rust crate tree-sitter-swift to v0.7.3 (#2672)
    * chore(deps): update astral-sh/setup-uv action to v8.2.0 (#2680)
    * feat: add outline rule definition (#2691)
    * feat: add outline item model (#2690)
    * chore(deps): update codecov/codecov-action action to v7 (#2686)
    * feat: add outline command stub (#2689)
    * chore(deps): update dependency @types/node to v24.13.1 (#2682)
    * chore(deps): update rust crate ignore to v0.4.26 (#2683)
    * fix: remove all impl, start from scratch (#2688)
    * fix: remove all impl, start from scratch (#2687)
    * fix: address cr feedback
    * refactor: move benchmark related file to one single folder
    * benchmark: add outline benchmark
    * fix: update outline rule loading
    * feat: add auto level
    * feat: add --view
    * fix: rename option
    * docs: reorganize the doc
    * doc: update design for limit
    * refactor: update interface
    * update design doc
    * update command impl
    * doc: update design doc
    * vibe more
    * add benchmark
    * update outline
    * vibe more
    * vibe
    * fix: report unfixable scan hits with update-all (#2684)
    * Fix typos in comments and grammar in --help text (#2674)
    * chore(deps): update dependency oxlint to v1.68.0 (#2673)
    * fix: add comments for agg clone
    * fix: don't leak metavar bindings from ellipsis-end lookahead (#2670)
    * refactor: collapse nested ifs with let chains (#2671)
    * chore: bump rust edition ot 2024
    * chore(deps): update rust crate toml_edit to v0.25.12 (#2666)
    * chore(deps): update dependency oxlint to v1.67.0 (#2665)
    * chore(deps): update dependency @ast-grep/napi to v0.43.0 (#2664)

++++ bind:

  - Upgrade to release 9.20.24
    Removed Features:
    * Remove ineffective TCP fallback after repeated UDP timeouts.
    Feature Changes:
    * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
    * Limit the number of glue records cached from a referral.
    * Fix a resolver stall on a CNAME response to a DS query.
    Bug Fixes:
    * The resolver now removes other RRsets at the same name when
    caching a CNAME.
    * Fix nxdomain-redirect combined with dns64.
    * Fix DNS64 owner case after DNAME restart.
    * Clear REDIRECT flag when it isn't needed.
    * Disable output escaping in bind9.xsl.
    * Fix crash on badly configured secondary signer.
    * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
    * Reject RRSIG records covering meta-types.

++++ blog:

  - Update to version 2.42
    Fix possible memory leaks, eliminate type punning, and resolve I/O blocking
    This update implements a series of systemic improvements to stability,
    security, and performance:
    1. Memory Safety & Leak Resolution:
  - Implemented lcons_shutdown destructor to automatically purge the console
    list and close FDs on exit.
  - Fixed password buffer leak by using in closeIO, correctly matching
    the mmap allocation in shm_malloc.
  - Added cleanup for pwprompt in closeIO.
    2. Elimination of Dangerous Type Punning:
  - Replaced the unreliable &cons->node pattern with a type-safe list_t lcons
    sentinel across the codebase.
  - Added __attribute__((may_alias)) to list_t in listing.h to prevent
    compiler strict aliasing optimizations from corrupting list traversals.
    3. I/O Responsiveness & Stability:
  - Removed tcdrain() from the high-frequency epoll_console_in path to
    eliminate daemon freezes during heavy output.
  - Updated consinitIO to ensure CON_SERIAL devices remain in O_NONBLOCK
    mode, preventing freezes on slow serial lines.
  - Extended the tcdrain skip-list in closeIO to include CON_SERIAL, ensuring
    a hang-free shutdown.
    4. Architectural Improvements:
  - Redesigned shm_malloc to use a tiered mapping strategy: prefers
    file-backed shared memory in /dev/shm with a graceful fallback
    to MAP_ANONYMOUS.
  - Optimized listing.h with always_inline attributes, __builtin_prefetch
    for cache efficiency, and list poisoning for safer debugging.

++++ bottom:

  - Update to version 0.14.1:
    * other: mention memory/network alias in deprecation warnings.

++++ build-compare:

  - Package an archive instead of flat files

++++ caddy:

  - Update to version 2.11.4:
    * templates: Patch for GHSA-vcc4-2c75-vc9v (#7785)
    * httpcaddyfile: fix incorrect error message on duplicate matchers (#7780)
    * Merge commit from fork
    * encode: prioritize zstd and br over gzip in content negotiation (#7772)
    * caddytls: skip idna.ToASCII for pure ASCII SNI values (#7770)
    * perf(replacer): optimize memory allocation for file placeholders (#7773)
    * rewrite: prevent placeholder re-expansion in injected query (#7761)
    * Clarify policies for agents / LLM use
    * go.mod: update x/net (#7767)
    * go.mod: Update x/crypto
    * caddyhttp: normalize Windows backslashes in path matcher (#7763)
    * build(deps): bump the all-updates group across 1 directory with 9 updates (#7752)
    * caddytls: match IDN SNI in connection policies (#7742)
    * reverseproxy: wraps request body to prevent closing if not read (#7719)
    * caddyfile: preserve implicit TLS issuer semantics (#7743)
    * cmd: support caddy start on IPv6-only hosts (#7744)
    * caddyauth: add candidate placeholders for rejected identities (#7698)
    * reverseproxy: Add regression test for DialInfo network override (#7758)
    * chore: clean up wording and typo fixes (#7745)
    * caddytls: fix TLS state races and ECH rotation retry (#7756)
    * caddyhttp: omit Last-Modified for unusable mod times (#7740)
    * chore: deps upgrade (#7751)
    * caddytls: Fix client auth (fix #7724) (#7727)
    * reverseproxy: further prevent body closes from dial errors (#7715)

++++ checkmedia:

  - merge gh#openSUSE/checkmedia#24
  - fix compiler warning and make fragment calculation more efficient
  - use libcrypto for digest calculation (bsc#1268746)
  - adjust spec file
  - 7.0

++++ containerd:

  - update to 1.7.33 (bsc#1262266, CVE-2026-35469,
    bsc#1268355, CVE-2026-46680,
    bsc#1268430, CVE-2026-53488,
    bsc#1268441, CVE-2026-47262):
    * https://github.com/containerd/containerd/releases/tag/v1.7.33
    * https://github.com/containerd/containerd/releases/tag/v1.7.32
    * https://github.com/containerd/containerd/releases/tag/v1.7.31
    * https://github.com/containerd/containerd/releases/tag/v1.7.30
  - drop 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch (upstream)

++++ coolercontrol:

  - Update to version 4.3.1:
    * Release 4.3.1
    * fix: improve applied duty reverse mapping for calibrated fans
    * fix: issue where chart was not resized when applying filters
    * fix: stress test watchdog
    * feate: add dashboard and create mode options in their quick menus
    * fix: allow device plugins to use custom lighting modes
    * refactor: clarify log message
    * feat: add per row-hover highlighting
    * refactor: join rows for channels with multiple sensor data
    * fix: growable but limited stats columns
    * feat: text locales for reset
    * refactor: table view improvements
    * fix: handle collector sensors that have a 0 value at init
    * feat: UI changes for new table data
    * feat: add api endpoints
    * feat: prep for stats changes
    * fix: npm dep vuln
    * feat: update style with function ordering
    * refactor: remove unnecessary docs
    * refactor: docs and function ordering
    * refactor: move functions below core engine logic
    * refactor: rename to duty_writers_by_type for clarity
    * fix: remove unnecessary clone
    * refactor: improve calibration endpoints
    * fix: update comment about why this call is made at app startup
    * fix: npm dep issue
    * feat: text for boost walk down setting
    * feat: toggle for boost walk down
    * fix: slow boost walk down
    * feat: walk kick boost down to sustain duty
    * fix: increase kick boost
    * fix: reduce kick boot duty
    * fix: loosen tolerance for stable after-kick rpm
    * feat: update locales
    * refactor: kick duration to the time boost should be held
    * feat: calibration user overrides
    * refactor: allow overrides for kick behavior and cleanup
    * feat: additional tooltips for clarification
    * refactor: increase kick-in duty by percent of rpm range
    * fix: curve diagnosis for pumps
    * refactor: calibration tooltip in controls overview
    * fix: keep progress tooltip open on update
    * fix: text color
    * refactor: cleanup
    * refactor: remove tree menu icon for calibrated channels
    * feat: create calibration popover for channels in control view
    * refactor: diagnoser
    * refactor: curve cleanup
    * fix: clippy warnings
    * feat: add logs for calibration steps
    * fix: inconsistency at duty extremes
    * refactor: improve duty mapping
    * fix: spread the full true duty range out
    * fix: use min-rpm mean of up and down sweep for true duty floor
    * fix: use true rpm floor instead of min duty
    * fix: use up and down sweep data in max rpm calc
    * fix: re-apply settings on calibration curve clear
    * fix: compensation for stuck fans from killing the max rpm
    * fix: use kick decay to help measure sustained rpm after firmware kick
    * fix: kick duration
    * fix: improve handling of devices with auto-kick-in and response lag
    * chore: docs cleanup
    * chore: cleanup
    * refactor: fix multiple issues
    * refactor: improve handling of disconnected fans
    * fix: hanlde long running ioctl task and drive spin-up delay
    * feat: calibration translations
    * fix: formatting
    * feat: improve handling of calibration-enhanced rpm-only channels
    * feat: handle duty min/max after calibration
    * feat: handle low-rpm fan oscillation in fan diagnosis
    * fix: cali chart style
    * fix: clarify saturation/plateau duty
    * fix: duty floor with low sustain rpm
    * feat: Show information/warnings for fan-control issues
    * feat: add calibrated pill icon to calibrated channels
    * feat: add get-all calibration endpoint
    * fix: only show tooltip over info icon
    * fix: focus ring always showing on close button in modal dialogs
    * feat: use proper progress bar styling
    * feat: UI impl for calibration
    * fix: improve display-duty rounding
    * refactor: use different calibration step sizes at duty extremes for improved accuracy
    * refactor: tighter stability tolerance
    * refactor: use device-duty as the primary true duty mapping, and device-rpm when the diff is large
    * fix: clear all state
    * fix: progress percent
    * refactor: send calibration completion as notification
    * feat: allow fan rpm to stablilize for each step
    * fix: re-calibration false mapping and kick-in
    * fix: the scope pass with nested scopes creates a runtime panic due to moro limitations
    * fix: don't return 404 when no calibartion data present
    * feat: rest api for calibration endpoints
    * feat: diagnosis registry and base progress notifications
    * feat: diagnosisHost for Engine and entry points
    * feat: main calibration engine
    * docs: update nix steps
    * chore: add comments and tests
    * fix: formatting
    * fix: force a fan write when enabling manual control even if already at target duty
    * feat: use true-duty mapping for duty reads
    * docs: scope preference
    * feat: dispatch wired into engine and scope refactor
    * feat: base dispatch and state
    * feat: base calibration impl
    * chore: update openapi spec
    * fix: js error with legacy broswers: upstream dependency behavior has changed
  - Update to version 4.3.0:
    * Release 4.3.0
    * feat: theme code support
    * fix: formatting
    * docs: update instructions for new bump script
    * feat: improve bump coverage
    * feat: have release spec use versioned vendor tarball
    * fix: handle thinkpad dgpu temp sensor error when powered off
    * refactor: add cs note to function
    * fix: cve in npm dep
    * feat: EMA custom sensor
    * feat: use failsafe values in Custom Sensors
    * feat: add time average cs to UI
    * feat: TimeAverage custom sensor logic
    * fix: formatting
    * refactor: remove tooltip border for softer effect
    * refactor: align tooltips all to top
    * feat: improve tooltip styling
    * fix: missing alert settings in the wizards and style alignment
    * feat: bypass text translations
    * fix: tooltip orientation
    * refactor: use single-pix table cell separators
    * fix: word wrapping issue
    * feat: add allow bypass toggle to UI
    * feat: new bypass_min_at_extremes Function setting
    * refactor: improve handling of login-lockout edge cases
    * fix: formatting
    * feat: language text for limited curve points
    * feat: show max curve points hints appropriately
    * feat: add curve point info to wizard temp sources
    * feat: add info about fan curve point limits in Profile View
    * feat: show channel labels in disable-channel error message
    * feat: Check if device/channel is in use before disabling
    * fix: pedantic warnings
    * fix: show forgot password link when changing password
    * refactor: improve reset-password handling
    * refactor: increase session TTL
    * feat: refresh UI when sessin cookie has expired
    * fix: stacking emitters
    * refactor: remove no longer needed plugin path override
    * refactor: reorder paths
    * refactor: base plugins_dir on data_dir
    * fix: popover unmanaged style
    * fix: unused import
    * feat: add plugin overview tour step
    * refactor: cleanup helpful links
    * refactor: reorder tour steps
    * fix: home dashboard icon highlighting
    * refactor: startu-page route name
    * fix: new default route with settings
    * feat: translations for new tour steps
    * refactor: rewrite tour steps
    * feat: show Unmanaged as an extra setting, not as a Profile
    * refactor: rename Default Profile to Unmanaged
    * feat: unmanaged and read-only show have less visual prio
    * fix: read-only fan tooltip
    * feat: show Unmanaged/read-only for applicable fan settings in the main device menu
    * refactor: remove auto-created My Profile and My Function
    * feat: add more emphasis on Getting Started Link with basic starting steps
    * refactor: rename General to User Interface settings
    * feat: add link to Tutorial
    * feat: Choose startup page
    * fix: exclude disabled devices for new device detection (best effort)
    * feat: dedup for slow liquidctl devices with overlapping commands
    * fix: in-flight writes will also take at waiting writes and take the newest value
    * refactor: only keep one waiting write task per channel, with new duty targets superceding old waiting ones.
    * fix: do not log shutdown cancellations
    * refactor: trimmed comments
    * refactor: cleanup module docs
    * feat: on every tick, if a read is already in progress, tick staleness
    * feat: extend read permit and coalesce preload device requests
    * feat: cancelle pending operations on shutdown
    * feat: add hwmon raw read debug logs
    * feat: add runtime error logging for power and temp sensors
    * fix: log channel read errors if debug is enabled
    * feat: check preload duty for all devices to avoid unnecesary writes, and add a duty cache for slow devices.
    * feat: round-robin sensor reading
    * feat: use a permit for each read operatin, enabling write operations to interweave with reads instead of being blocked
    * feat: coalece queued fan writes
    * feat: apply startup and wakeup device settings concurrently
    * feat: apply startup settings concurrently during initialization
    * fix: make sure overlay and mix profiles output a duty when applied to a new channel.
    * chore: update minor cargo deps
    * chore: update npm deps
    * fix: show aqua log once
    * refactor: simplify after refactorings
    * fix: increase log level for regularly output info log
    * fix: revert snapshot timeout and add additional docs on how these timeouts work together
    * refactor: improve handling of detected channels at startup, so that they appear even if the first read fails
    * refactor: do not let sleep handling bind the daemon loop
    * refactor: place quicker and more important chanel extractions first
    * refactor: improve hmwon shutdown resilience
    * refactor: add timeout to hwmon initialization
    * refactor: do not block the completion of the status preload operation with the command delay
    * refactor: improve handling of blocking ioctl commands for drivetemp
    * chore: add asserts
    * fix: formatting
    * refactor: improved handling of staleness per channel
    * feat: staleness ticks per channel, instread of for the whole device (only applicable for hwmon devices)
    * feat: handle streaming responses for hwmon devices
    * feat: streaming extractors
    * chore: update log message
    * fix: missing fan duty/rpm should return cached and failed values, not none.
    * feat: add an info log on recovery
    * refactor: use one-time calculated timeout values
    * refactor: adjust all timeouts based on poll rate
    * refactor: add some a little buffer to fit with the other timeout systems
    * fix: handling of failsafe values for failed reads for hwmon devices
    * chore: post release
  - Update to version 4.2.1:
    * Release 4.2.1
    * chore: post release
    * fix: formatting
    * refactor: cover edge cases where stress-ng could hang
    * refactor: handle possible edge case where dbus doesn't respond
    * feat: add note about stress-ng gpu capabilities
    * refactor: add watchdogs to make sure processes are cleanly killed if anything should happen
    * fix: do not clear cache on version mismatch
    * refactor: do not check stress-ng capabilities and have the user decide what to use when
  - Update to version 4.2.0:
    * Release 4.2.0
    * fix: use wildcard to pull versioned vendor file as well
    * feat: clear-cache CLI option for Qt app
    * fix: policy should not be cached forever
    * fix: close no longer does anything
    * fix: only display service controls for integration plugins
    * fix: allow inline scripts
    * fix: use hard coded speed channels
    * feat: add support for ga2lcd liquidctl device driver

++++ coredns:

  - Exclude flaky unit test on build

++++ coturn:

  - Update to version 4.14.0
    New
    * No more dependency on prometheus-client-c
    * HTTPS support for prometheus client (optional)
    * TLS support for redis - now compatible with managed redis
    (optional).
    * Rate limiting "401 Unauthorized" responses - reduces
    reflection attacks off the coturn server. This is an
    experimental feature - not fully tested on production scale
    deployment and massive DDoS attacks. New prometheus counters
    should help shed some light on real life behavior and
    performance. The feature is off by default.
    What's Changed
    * validate hmackey length in sqlite_get_user_key before hex
    decode.
    * Add out-of-tree patch to restore deprecated OpenSSL 1.1.1.
    * Add optional TLS transport for Redis connections.
    * Fix relay threads override.
    * Flush prometheus hot-path counters once per second to kill
    lock contention.
    * fix signed-char index out-of-bounds read in base64_decode.
    * Build Prometheus exporter from vendored local sources.
    * Prom https.
    * Fix realm quota data race and warnings.
    * Add per-source rate-limiting of UDP 401 Unauthorized responses

++++ crash:

  - Require kernel-rt-devel on suse_version >= 1610, while
    keep pulling in kernel-syms-rt on >= 1500 < 1600 (RT KMP is
    only built in 16.1+, so 16.0 is excluded)
  - Ensure we still have an upper version limit for Factory, as
    there is no -rt kernel there

++++ crmsh:

  - Update to version 5.1.0+20260622.f844a5ab:
    * Chore: unittests: reduce output verbosity and stop printing coverage report

++++ glibc-cross-aarch64-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ glibc-cross-hppa-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ glibc-cross-loongarch64-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ glibc-cross-ppc64le-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ glibc-cross-riscv64-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ glibc-cross-s390x-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ darktable:

  - Update to 5.6.0:
    * https://www.darktable.org/2026/06/darktable-5.6.0-released/

++++ engauge-digitizer:

  - Replace dependency on broken log4cpp package, add
    0001-Replace-log4cpp-with-Qt-categorized-logging.patch
  - Add 0001-Fix-noreturn-syntax.patch
  - Fix crash on PDF import, add
    0001-Fix-ownership-of-Poppler-Document-for-Qt6.patch

++++ featherpad:

  - Update to 1.6.4:
    * Fixed syntax highlighting for JSON when whitespaces were not shown.
    * Fixed tab middle clicking for Qt ≥ 6.11 (it stopped working correctly after
    a backward-incompatible change in Qt — and just with FeatherPad).
    * Activated the session dialog under Wayland too when it's called by another window.
    * Fixes for Hunspell spell checking.
    * Bumped the minimum version of Qt to 6.5 and silenced new compilation warnings.
    * Other small fixes and enhancements.

++++ fence-agents:

  - Update to version 4.17.0+git.1781703439.0804740:
    * fence_openstack: fix list-action to avoid timeout when there are 100+ VMs on the hypervisor
    * fence_ibm_vpc: set proxy when token has expired as well
    * fence_openstack: add auth-plugin support for clouds.yaml (#651)
    * fencing.py: change from Bash "source" to POSIX-compliant "."

++++ file-roller:

  - Update to version 44.7:
    + Bugfixes:
  - New Archive Dialog: allow input of an absolute path directly.
  - Check line length when parsing command output.
  - Java Utils: make sure the package name respects the max size.
  - Metainfo: Add screenshot caption.
  - Flatpak Improvements: remove zstd module; improve cleanup
    command; replace p7zip with 7zip; reduce libportal features;
    modernize manifest.
    + Updated translations.

++++ fuc:

  - Update to version 3.1.7:
    * Fix a bug copying the dir mode bits
    * Upgrade vendored dependencies

++++ llamacpp:

  - Update to version 9760:
    * Server and API work added model-load progress reporting, improved
    batch construction, and fixed several long-context and KV-cache
    correctness issues.
    * Vulkan gained several matmul, Flash Attention, and buffer-transfer
    optimizations plus better memory-property handling, which should
    mainly help prompt processing for quantized models.
    * Additional multimodal, router, and WebUI updates landed upstream.
    * Full commit log:
    https://github.com/ggml-org/llama.cpp/compare/b9553...b9760

++++ git-annex:

  - Apply "0001-Build-with-ram-instead-of-memory-package-to-support-.patch"
    to allow building with our patched version of aws. [bsc#1268157,
    CVE-2026-9648]

++++ glibc:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ glibc-utils-src:

  - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in
    ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033)
  - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop
    failure in ns_sprintrrf
  - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in
    ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069)

++++ golang-github-prometheus-promu:

  - update to 0.20.0:
    * [FEATURE] crossbuild: add --env flag to forward env vars to build
    containers #399

++++ gtk-vnc:

  - bsc#1268264 - virt-manager crash when connecting to instance
    using VNC
    009-fix-error-handling-in-main-thread-context.patch
  - bsc#1258497 - virt-manager segfault error 4 in libgvnc-1.0.so.0.0.1
    Renamed 009-let-GLib-manage-the-lifecycle-of-VncDisplay-GObject.patch to
    010-let-GLib-manage-the-lifecycle-of-VncDisplay-GObject.patch

++++ haproxy:

  - Update to version 3.4.0+git31.fc300e9f2:
    * BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp (bsc#1268557) VUL-0: CVE-2026-55203
    * BUG/MEDIUM: http-act: Make a copy of the sample expr in (set/add)-headers-bin
    * BUG/MEDIUM: mux_quic: fix freeze transfer after QCS rxbuf realign
    * BUG/MINOR: hpack-tbl: add missing NULL check after hpack_dht_defrag() (bsc#1268558) VUL-0: CVE-2026-55204
    * BUG/MEDIUM: ssl: Don't free the early data buffer too early
    * BUG/MINOR: quic: fix rxbuf settings on backend side
    * BUG/MINOR: mux-h1: Properly resolve file path for 'h1-case-adjust-file'
    * BUG/MEDIUM: http-ana: Don't ignore L7 retry errors
    * BUG/MINOR: http-ana: Remove a debugging memset on redirect
    * BUG/MINOR: server: fix add server with consistent hash balancing
    * BUG/MEDIUM: h3: Properly handle PUSH_PROMISE on backend connections
    * BUG/MINOR: cpu-topo: use ha_diag_notice() to report thread creations
    * MINOR: errors: add ha_diag_notice() to report diag-level notifications
    * BUG/MEDIUM: ktls: defer enabling TLS ULP on a socket until connected
    * BUG/MEDIUM: acme: stuck ACME task when authz is already "valid"
    * BUG/MINOR: quic: fix Initial length value in sent packets
    * REGTESTS: Fix log matching in healthcheck-section.vtc
    * BUG/MEDIUM: checks: Dequeue checks on purge
    * BUG/MINOR: acl: report "ACL" not "map" in ACL ID lookup failures
    * CLEANUP: sessions: simplify the sess_priv_conns pool name
    * BUG/MEDIUM: xprt_qmux: implement ->get_ssl_sock_ctx() to get the SSL laye
    * BUG/MEDIUM: threads: Fiw build when using no thread
    * BUG/MEDIUM: regex: initialize the match array earlier during boot
    * REGTESTS: checks: Add script for external healthchecks
    * BUG/MINOR: tcpcheck: Override external check if healthcheck section is set
    * BUG/MINOR: mux_quic: do not interrupt recv on error/incomplete data
    * BUG/MEDIUM: mux_quic: prevent risk of infinite loop on recv
    * BUG/MEDIUM: server/checks: Support healtcheck keyword on default-server lines
    * MINOR: check: Don't dump buffers state in check traces for external checks
    * BUG/MEDIUM: check: Ignore small-buffer option when starting an external check
    * BUG/MEDIUM: check: Skip tcpcheck post-config for external checks
  - Update otel to version ce86d09:
    * DOC: otel: dropped source-artifact counts from the prose
    * DOC: otel: reconciled the docs with the current filter code
    * BUILD: otel: added a .gitignore for build and scratch artifacts
    * MINOR: otel: added an 'exception' span directive
    * MINOR: otel: extended the location check to otel-group actions
    * MINOR: otel: warned when a condition is unusable at the scope's event
    * MINOR: otel: warned when a fetch is unusable at the scope's event
    * MINOR: otel: set the fetch-validity bits, and fixed on-client-session-start
    * DOC: otel: documented the flush, instruments and scopes CLI commands
    * DOC: otel: documented HTTP/TCP proxy modes and the TCP event set
    * MINOR: otel: test: sampled the system CPU during the speed test
    * DOC: otel: described the metric instrument types in 'instrument'
    * DOC: otel: documented the export-pipeline status in 'flt-otel status'
    * MINOR: otel: showed export-pipeline state in 'flt-otel status'
    * MINOR: otel: added a TCP-mode test configuration
    * DOC: otel: documented TCP-mode tracing and byte counting
    * MINOR: otel: extended tracing to TCP-mode proxies
    * DOC: otel: documented periodic gauges via the on-idle-timeout event
    * MINOR: otel: warned about documented limitations at config load
    * MINOR: otel: added an 'otel.context' sample fetch
    * MINOR: otel: logged a reused span as a reference, not referenceless
    * CLEANUP: otel: referenced the span keyword by enum in the ID check
    * CLEANUP: otel: initialized argc in the config-line check
    * BUG/MINOR: otel: cast the name byte to uint8_t for the ctype check
    * MINOR: otel: skipped a missing extract context with a debug note
    * Revert "BUG/MINOR: otel: did not hard-fail a stream that initiates a trace"
    * MINOR: otel: added a 'scopes' CLI introspection command
    * MINOR: otel: added an 'instruments' CLI introspection command
    * MINOR: otel: added a 'flush' CLI command to force an export
    * BUG/MINOR: otel: did not reject the documented 'no log' directive
    * DOC: otel: aligned the error-mode help text with the CLI
    * MINOR: otel: gated the group action on flag_used like the scope dispatch
    * DOC: otel: documented group_data smp_val as reserved for fetch validation
    * DOC: otel: documented smp_val_fe/be as reserved for fetch validation
    * BUG/MINOR: otel: rejected HTTP header injection at on-http-end-request
    * DOC: otel: aligned event docs with code, documented inject limits
    * DOC: otel: documented keyword multiplicity and closed reference gaps
    * BUG/MINOR: otel: rejected a duplicate 'idle-timeout' in a scope
    * CLEANUP: otel: reformatted the FLT_OTEL_KW_MAP macro definition
    * CLEANUP: otel: unified the keyword-to-code table lookups
    * MINOR: otel: allowed several conditional status lines per span
    * MINOR: otel: test: defaulted the path to the sibling haproxy executable
    * CLEANUP: otel: unified the out-of-memory error message
    * CLEANUP: otel: made the debug output consistent and unambiguous
    * CLEANUP: otel: deduplicated the filter error handlers
    * BUG/MINOR: otel: corrected the debug-only diagnostics
    * BUG/MINOR: otel: did not hard-fail a stream that initiates a trace
    * BUG/MINOR: otel: corrected the log-record body error handling
    * BUG/MINOR: otel: did not leak injected pairs when the injection failed
    * BUG/MEDIUM: otel: drove the idle timer from the stream task expiry
    * BUG/MINOR: otel: did not format a NULL detail in the var registration
    * BUG/MINOR: otel: made the bounds qsort comparator transitive
    * BUG/MINOR: otel: rejected duplicate span 'parent' and 'kind' arguments
    * BUG/MINOR: otel: hardened the group action error paths
    * CLEANUP: otel: refreshed stale function doc comments
    * DOC: otel: corrected stale facts across the documentation
    * BUG/MINOR: otel: hardened the string buffer handling
    * BUG/MINOR: otel: did not dereference NULL when removing headers
    * MINOR: otel: improved the CLI status output and command access
    * MINOR: otel: gated the 'unset-var' keyword on a condition
    * MINOR: otel: gated the 'set-var-ctx' keyword on a condition
    * CLEANUP: otel: centralized the 'if'/'unless' condition detection
    * MINOR: otel: gated the 'log-record' keyword on a condition
    * MINOR: otel: gated the 'instrument' keyword on a condition
    * BUG/MINOR: otel: skipped set_status() for the 'ignore' status code
    * DOC: otel: clarified that only the 'error' status carries a description
    * MINOR: otel: guarded the deinit callback against a NULL configuration
    * DOC: otel: reconciled the documentation with the parser
    * BUG/MINOR: otel: allowed any valid address in the 'log' keyword
    * MINOR: otel: gated the 'set-var' keyword on a condition
    * MINOR: otel: gated the 'baggage' keyword on a condition
    * MINOR: otel: gated the 'status' keyword on a condition
    * MINOR: otel: gated the 'event' keyword on a condition
    * MINOR: otel: gated the 'attribute' keyword on a condition
    * MINOR: otel: added a shared helper for an optional if/unless condition
    * DOC: otel: documented that telemetry delivery is best-effort
    * MINOR: otel: added attributes to the standalone 'link' keyword
    * MINOR: otel: added a per-event timestamp to the 'event' keyword
    * BUG/MINOR: otel: kept the span timestamp when a 'time' sample is empty
    * MINOR: otel: added the 'kind' keyword to set the span kind
    * MINOR: otel: started the SDK once via an atomic claim, not the HTX flag
    * BUG/MINOR: otel: read the attach rate limit from one snapshot
    * MINOR: otel: traced spans and contexts as the runtime context is freed
    * BUG/MINOR: otel: allowed a span status without a description
    * CLEANUP: otel: unified config keyword synopsis placeholders
    * DOC: otel: documented which callback raises each scope event
    * MINOR: otel: added the on-http-tarpit-request scope event
    * BUG/MEDIUM: otel: stopped the idle timer from clobbering analyse_exp
    * CLEANUP: otel: named the link target a reference instead of a span
    * MINOR: otel: added set-var/set-var-ctx/unset-var scope directives
    * MINOR: otel: always compiled vars.o and added by-name variable helpers
    * MINOR: otel: added an 'otel-stop' keyword to end tracing for a connection
    * CLEANUP: otel: factored the scope ACL test into flt_otel_cond_pass()
    * DOC: otel: corrected the stale flt_otel_is_disabled() description
    * MINOR: otel: test: added log-record 'time' coverage to the full test
    * MINOR: otel: recorded the wall-clock as the log record's observed time

++++ kernel-firmware-mediatek:

  - Update to version 20260619 (git commit 37976b9ded44):
    * linux-firmware: update firmware for MT7986
    * linux-firmware: update firmware for MT7981
    * linux-firmware: update firmware for MT7996
    * linux-firmware: update firmware for MT7992
    * linux-firmware: update firmware for MT7990

++++ kernel-firmware-qcom:

  - Update to version 20260619 (git commit 37976b9ded44):
    * qcom: Add qdsp6sw firmware for shikra platform
    * qcom: Update ADSP firmware for Kaanapali platform
    * qcom: update ADSP firmware for glymur platform

++++ resource-agents:

  - Update to version 4.18.0+git51.4e6bf13c5:
    * azure-sap-zone: add Azure cloud environment support (#2175)
    * ganesha-nfs: add enable_nlm, grace_period and lease_lifetime parameters
    * ganesha-nfs: add server_scope parameter
    * ganesha-nfs: add anonuid/anongid parameters
    * ganesha-nfs: use RecoveryRoot for the recovery directory
    * nfsserver: monitor nfs-mountd.service for failed states
    * iSCSILogicalUnit: apply fileio write cache mode at create time
    * nfsserver: monitor nfsdcld.service for failures or stopped state
    * nfsserver: dont try to stop fsidd when not present
    * ganesha-nfs: add generated mode (render config from parameters) (#2169)
    * portblock: fix IPv6 rule detection in the iptables backend
    * doc: Fix links after master->main rename (#2171)
    * conntrackd: fix monitor/start logic
    * Low: nfsserver: Correction of magic numbers and log output.
    * sybaseASE: dont report error about missing sybaseASE env during probe-action
    * nfsserver: Fixes the incorrect indentation
    * Mid: IPaddr2: To allow Pacemaker to handle error handling, it returns NOT_RUNNING even when down.
    * Merge pull request #2148 from ryan-ronnander/rr/iscsi-block-size
    * nfsserver: Stop fsidd when stopping nfs-server
    * Mid: nfsserver: Change the log level for probe and process checks at startup to info.
    * IPaddr2: fix interfaces named with keywords like primary, secondary, etc
    * OCPBUGS-83333: podman-etcd: Add learner in notify to prevent start deadlock (#2157)
    * OCPBUGS-82190: podman-etcd: Fixed etcd learner deadlock during machine deletion (#2156)
    * nfsserver/nfsnotify: use chown : to avoid warnings with newer versions of chown
    * Filesystem: always return OCF_ERR_GENERIC when another device is mounted on mountpoint to ensure relocation after trying to restart (default behaviour)
    * podman-etcd: fix port 2380 binding race during install transition (#2152)
    * oraasm: Avoid false positive start/monitor operation when critical processes are offline
    * ganesha-nfs: new resource agent (#2154)
    * azure-sap-zone: new resource agent for Azure SAP zone alignment (#2122)
    * portblock: add IPv6 support to iptables and nft backends
    * db2: Avoid promotion in STANDBY/REMOTE_CATCHUP_PENDING state
    * db2: do not use db2stop, as it sends truncation messages, which in some cases are not delivered
    * build: update ChangeLog for 4.18.0
  - Remove implemented patch: bsc-1241692.patch

++++ mbedtls-3:

  - Build as mbedtls-3 to provide the library for packages that are not
    compatible with version 4

++++ neko:

  - Require mbedtls-devel < 4 since newer versions are not supported

++++ openjph:

  - Update to 0.30.1:
    * Add accelerated PowerPC64 (little-endian) subroutines
    * Fix many strict aliasing violations
    * Fix undefined behaviour in ojph_block_encoder_avx2
    * Improve CI

++++ libphonenumber:

  - update to 9.0.33:
    * Update phone metadata for region code(s):
    BF, KE, MC, MW, NO, SG, SI, UG, VN
    * Update geocoding data for country calling code(s): 47 (en)
    * Update carrier data for country calling code(s):
    36 (en), 40 (en), 65 (en), 84 (en), 232 (en), 235 (en), 250
    (en), 256 (en), 265 (en), 386 (en), 503 (en), 1868 (en)
  - includes changes from v9.0.32:
    * Update phone metadata for region code(s): DZ, JP, NO, SJ, SO, UG
    * Update carrier data for country calling code(s):
    33 (en), 47 (en), 233 (en), 252 (en), 256 (en)

++++ libssh2_org:

  - CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO
    Handler (boo#1268530) libssh2-1.11.1-CVE-2026-55199.patch
  - CVE-2026-55200: out-of-Bounds write via Unchecked packet_length
    in transport.c (boo#1268531) libssh2-1.11.1-CVE-2026-55200.patch
  - CVE-2026-7598: integer overflow in function userauth_password of
    file src/userauth.c (boo#1263890)
    libssh2-1.11.1-CVE-2026-7598.patch
  - CVE-2025-15661: out-of-bounds heap read vulnerability in the
    sftp_symlink() function in src/sftp.c (boo#1268546)
    libssh2-1.11.1-CVE-2025-15661.patch

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1082
  - updated swig template definitions
  - 4.5.334

++++ xar:

  - Switch to the maintained Apple xar lineage (build 503, versioned
    1.8.0.0.503): the mackyle 1.6.1 fork this package tracked has been
    dead since 2012, and Debian, Fedora and Gentoo all moved to Apple's
    xar (apple-oss-distributions/xar). This resolves the long-standing
    NULL-pointer dereferences in xar_get_path() and xar_unserialize()
    when parsing malformed archives:
    * CVE-2017-11124 (boo#1047875)
    * CVE-2017-11125 (boo#1047874)
    * CVE-2018-17093 (boo#1108595)
    * CVE-2018-17094 (boo#1108596)
  - Drop the obsolete mackyle-fork patches: ext2.patch,
    openssl-checks.patch, xar-fix-prototype.patch
  - Add the Gentoo-tracked Linux build patch set for the Apple lineage:
    xar-1.6.1-ext2.patch, xar-1.8-safe_dirname.patch,
    xar-1.8-arm-ppc.patch, xar-1.8-openssl-1.1.patch,
    xar-1.8.0.0.452-linux.patch, xar-1.8.0.0.487-non-darwin.patch,
    xar-1.8.0.0.487-variable-sized-object.patch,
    xar-1.8.0.0.498-impl-decls.patch
  - Add xar-1.8.0.0.503-linux-F_GETPATH.patch: resolve an fd's path via
    /proc/self/fd on Linux, where the macOS-only F_GETPATH fcntl used by
    the new xar_fdopen_digest_verify() is unavailable

++++ mesheryctl:

  - update to 1.0.45:
    * General
  - Bump go.mongodb.org/mongo-driver from 1.17.6 to 1.17.7 in
    /server/policies/wasm @dependabot[bot] (#20154)
    * Meshery CLI
  - [uuid] Restore gofrs/uuid (reverse 3384af4); pin schemas
    v1.3.13 + meshkit v1.0.16 @ritzorama (#20177)
    * Maintenance
  - Bump github.com/containerd/containerd from 1.7.32 to 1.7.33
    @dependabot[bot] (#20156)
  - update to 1.0.44:
    * General
  - Bump github.com/containerd/containerd from 1.7.32 to 1.7.33
    in /server/policies/wasm @dependabot[bot] (#20153)
  - refactor(server): remove obsolete WASM filter startup seeding
    @ishwar170695 (#20057)
  - fix:[UI]resolve missing logo for AWS API Gateway model
    @aprv10 (#19498)
    * Meshery CLI
  - refactor: migrate UUID library from gofrs/uuid to google/uuid
    @leecalcote (#20166)
  - refactor: consolidate ownership property naming to 'owner'
    @leecalcote (#20147)
    * Maintenance
  - Bump undici in /ui @dependabot[bot] (#20152)
  - refactor: consolidate ownership property naming to 'owner'
    @leecalcote (#20147)
  - ci(docs): pin peaceiris/actions-gh-pages to v4.0.0 to fix
    intermittent deploy failures @copilot-swe-agent[bot] (#20111)
  - Bump form-data from 4.0.5 to 4.0.6 in /provider-ui
    @dependabot[bot] (#20106)
  - Bump js-yaml from 4.1.1 to 4.2.0 in /provider-ui
    @dependabot[bot] (#20107)
  - Bump form-data from 4.0.5 to 4.0.6 in /ui @dependabot[bot]
    (#20105)
  - [CI] Recreate Discussion Forum data sync workflow
    @PragalvaXFREZ (#20101)
    * Documentation
  - refactor: consolidate ownership property naming to 'owner'
    @leecalcote (#20147)
  - [docs]: update meshery-academy hyperlink and wording
    @banana-three-join (#20126)
  - Create index.md @YASHMAHAKAL (#20128)
  - docs: fix make docker target to docker-build @Daniel-1600
    (#20093)
  - [Docs] Bringing Back Discussion Forum Shortcodes
    @PragalvaXFREZ (#20100)
  - Fix wording for clarity in Artifact Hub tutorial @chellej
    (#20095)

++++ netbird:

  - Update to 0.73.2
  - [misc] Bump the actions group across 1 directory with 9 updates
    by @dependabot[bot] in #6451
  - [client] Surface DNS forwarder upstream failures via Extended
    DNS Errors by @lixmal in #6441
  - [misc] Add TARGETPLATFORM build argument to Docker build
    commands by @mlsmaycon in #6499
  - [client] Add Auth.Stop() to cancel an in-progress interactive
    login by @pappz in #6486
  - [client] Fix engine lifecyrcle race by @pappz in #6443
  - [client] fix WaitStreamConnected test call after ctx signature
    change by @pappz in #6503
  - [misc] Add enterprise getting-started and migrate script by
    @bcmmbaga in #6501
  - [management] do not use meta diff for login by @pascal-fischer
    in #6502
  - [management] validate meta change against posture checks by
    @pascal-fischer in #6510
  - [management] empty file check in nmap on other posturechecks by
    @pascal-fischer in #6511

++++ netperfmeter:

  - Update to version 2.0.6
    * Changed pdftocairo to mutool, due to bugs in Fedora.
    * Code clean-up.

++++ newsboat:

  - Update to 2.44:
    Added:
    * Table with `*-title-format` specifiers in the manpage
    * List of available text attributes in the manpage
    * Ability to specify initial text for `cmdline` command. This allows one to
    write macros or new-style `bind`s to run common command-line commands
    * Ability to open urls file at the current feed, e.g.
    `bind E feedlist,articlelist,searchresultslist edit-urls "vim +%L %f"`
    This is **not** enabled by default. See `edit-urls` docs for details.
    (#1262, #3338, https://github.com/akrennmair/newsbeuter/issues/258 )
    * Import feed titles from OPML when using `opml-url`
    Changed:
    * Bumped minimum supported Rust version to 1.92.0
    * Updated translations
    Fixed:
    * OPML import mangling `exec:` and `filter` lines in the urls file (#3115)
    * Build failure on macOS 26
    * Build failure on OpenBSD
    * Cursor jumping to unrelated article when `purge-deleted` is called (#1445)
    * Applying an incorrect filter hiding all articles. Now the filter would not be
    applied, and an error message would be shown (#2857)
    * Missing tags if feed URL is used multiple times. Now the tags would be merged
    (#2233)
    * Authentication error (`"error": "INCORRECT_USAGE"`) with TT-RSS (#3373)

++++ openCryptoki:

  - Updated the .spec file (bsc#126874)
    * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`

++++ openQA:

  - Update to version 5.1782133597.39cd80e0:
    * refactor: Calculate module category headings in frontend
    * chore(deps): Dependency cron 2026-06-20
    * test: Make parallel execution of the fullstack test more reliable
    * ci: disable Mergify interactive queue controls in PR comments
    * feat(worker): enable direct execution with podman
    * fix(worker): add --init and --rm flags for containerized engine
    * feat(worker): support containerized os-autoinst worker engine
    * test: refactor archive download tests for maintainability
    * feat: implement category-specific ZIP downloads for jobs
    * chore(deps): Dependency cron 2026-06-19

++++ openSUSE-build-key:

  - use the modification time for key2rpname

++++ os-autoinst:

  - Update to version 5.1782140090.fe34efb:
    * fix: exclude virt-firmware on older Leap ppc64
    * style: enforce signatures in anonymous subroutines
    * fix: stop deepening when repo is no longer shallow
    * ci: disable Mergify interactive queue controls in PR comments
    * style(perlcritic): Add Modules::ProhibitConditionalUseStatements
    * refactor: improve t/01-test_needle.t structure and style

++++ partclone:

  - Fix build with nilfs-utils >= 2.3
    add partclone-0.3.47-fix-nilfs-utils-2.3.patch from #300

++++ patterns-base:

  - Disambiguate 32bit patterns and x11 patterns summaries
    (bsc#1267854)

++++ patterns-fonts:

  - Disambiguate fonts and fonts_opt pattern summaries (bsc#1267854)

++++ patterns-kde:

  - Disambiguate kde_utilities and kde_utilities_opt pattern summaries
    (bsc#1267854)

++++ perl-Business-ISBN-Data:

  - updated to 20260617.1.0 (20260617.001)
    see /usr/share/doc/packages/perl-Business-ISBN-Data/Changes
    20260617.001 2026-06-21T17:26:07Z
    * data update for 2026-06-17

++++ perl-DBD-CSV:

  - updated to 0.630.0 (0.63)
    see /usr/share/doc/packages/perl-DBD-CSV/ChangeLog
    0.63	- 2026-06-22, H.Merijn Brand
    * It's 2026
    * New test for DBI-1.648 CVE fix
    * Minor typo in doc
    * Raise recommended versions for fixed CVE's

++++ perl-MCP:

  - updated to 0.130.0 (0.13)
    see /usr/share/doc/packages/perl-MCP/Changes
    0.13  2026-06-22
  - Switched from JSON::Valdiator to JSON::Schema::Tiny for better portability.
    0.12  2026-06-19
  - Fixed bug in MCP::Server::Transport::Stdio where the server could disconnect when reading from Windows pipes,
    such as when spawned by Claude Desktop.
    0.11  2026-06-19
  - Added OAuth scope support, so MCP servers can act as OAuth 2.0 resource servers.
  - Added scopes attribute to MCP::Primitive, and therefore to MCP::Tool, MCP::Prompt, and MCP::Resource.
  - Added scopes and insufficient_scope attributes, and a has_scope method, to MCP::Server::Context.
  - Added auth and metadata_url attributes to MCP::Server::Transport::HTTP.
  - Added headers attribute to MCP::Client.
  - Added oauth_metadata method to MCP::Server.
  - Added INSUFFICIENT_SCOPE constant to MCP::Constants.

++++ archmage:

  - Add archmage-fix-bytes-regex.patch: fix "archmage -c pdf" crashing
    with "cannot use a string pattern on a bytes-like object" by using
    bytes regex patterns on the bytes content (boo#1178542)
  - Register the archmage.1 man page as an update-alternatives slave so
    the shipped /usr/share/man/man1/archmage.1.gz symlink is managed
    (boo#1202977)

++++ python-fastapi:

  - update to 0.138.0:
    * Add support for `app.frontend("/", directory="dist")` and
    `router.frontend("/", directory="dist")`.
    * Fix typo in release notes.
    * Add `app.frontend()` instructions to Agent Library Skill.
    * Update release notes link.
    * Update white space characters in bigger apps.
    * Fix grammar, typos, and broken links in docs.
    * Enable Hindi docs translations.
    * Fix failing test, update format for raised errors.
    * Fix test-alls-green.
    * Enable checking `release-notes.md` for typos.
    * Tweak wording about deploying to FastAPI Cloud.
    * Use `gpt-5.5` model in `translate.py`, specify `-chat` to
    avoid warnings.
  - update to 0.137.2:
    * Add `iter_route_contexts()` for advanced use cases that
    used to use `router.routes` (e.g. Jupyverse).
    * Fix broken Markdown in Korean custom response docs.

++++ python-librouteros:

  - Update to version 4.1.1
    * Drop python 3.9 support.
    * Fix parse_word edge case.

++++ python-pandas:

  - Add upstream pandas-pr62863.patch and pandas-pr63143.patch to
    fix testsuite failures with GCC 16

++++ python-py7zr:

  - Update to 1.1.3 (fixes CVE-2026-23879 (bsc#1268669),
    CVE-2026-55195 (bsc#1268665), CVE-2026-55206 (bsc#1268666))
    * CVE-2026-23879: Arbitrary File Write Vulnerability in py7zr (high severity)
  - Harden check of path traversal and enhance test cases to reproduce many
    attack scenarios.
    * CVE-2026-55206: O(n^2) algorithmic complexity DoS in PackInfo._read() in
    py7zr
  - Enforced variation of the parameter with a limit and optimized
    calculation algorithm to prevent excessive CPU consumption.
    * CVE-2026-55195: py7zr <= 1.1.2: Decompression bomb (zip bomb) denial of
    service via unchecked extraction size
  - Added check of extraction size and introduced max_extract_size as
    constructor parameter to guard against excessive decompression.

++++ python-pydantic-settings:

  - Update 2.14.2 (fixes bsc#1268680)
    * Prevent NestedSecretsSettingsSource from following symlinks outside
    secrets_dir

++++ python-zeep:

  - Update to 4.3.3 (fixes bsc#1268679)
    * Wire up the forbid_external setting (previously defined but unused since
    the move off defusedxml in 4.0). When enabled, zeep refuses to transitively
    fetch http/https resources via xsd:import, xsd:include, wsdl:import or lxml
    entity resolution, raising zeep.exceptions.ExternalReferenceForbidden. The
    user-supplied entry-point WSDL/schema URL is still loaded. The default
    remains False to preserve existing behaviour; enable it when loading WSDLs
    from untrusted sources to mitigate SSRF via attacker-controlled import
    targets.

++++ rootlesskit:

  - Update to version 3.0.1:
    * v3.0.1
    * CI: update test deps
    * port/builtin: fix UDP forwarding for non-loopback clients (#592)
    * net/gvisor-tap-vsock: allow 169.254.169.254
    * Build(deps): Bump golang.org/x/sys from 0.44.0 to 0.45.0
    * Build(deps): Bump github.com/containers/gvisor-tap-vsock
    * docs/network.md: lxc-user-nic seems to work with detach-netns
    * Build(deps): Bump golang.org/x/sys from 0.43.0 to 0.44.0
    * Build(deps): Bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0
    * v3.0.0+dev

++++ rpmlint:

  - Update to version 2.9.0+git20260622.4dc32f49:
    * sysctl-whitelist: adjusted 50-coredump.conf digest for systemd (bsc#1267504)
    * configs/openSUSE/users-groups.toml: Replace group 'singularity' by 'apptainer'

++++ rpmlint-strict:

  - Update to version 2.9.0+git20260622.4dc32f49:
    * sysctl-whitelist: adjusted 50-coredump.conf digest for systemd (bsc#1267504)
    * configs/openSUSE/users-groups.toml: Replace group 'singularity' by 'apptainer'

++++ rpmlint-test:

  - Update to version 2.9.0+git20260622.4dc32f49:
    * sysctl-whitelist: adjusted 50-coredump.conf digest for systemd (bsc#1267504)
    * configs/openSUSE/users-groups.toml: Replace group 'singularity' by 'apptainer'

++++ rubygem-nokogiri:

  - 1.19.4:
    see included CHANGELOG.md

++++ s390-tools:

  - Applied a patch (bsc#1268516)
    * s390-tools-pvebc-Log-services-to-journal-plus-console.patch
  - Re-vendor-ed vendor.tar.zst

++++ tar:

  - Fix CVE-2026-5704.patch causing errors when extracting certain archives
    generated by rpm2archive which contain hard links
  - Refresh fix-dereference.patch

++++ tarix:

  - Add tarix-fuse3.patch: port the FUSE filesystem (fuse_tarix) from
    libfuse2 to libfuse3 (boo#1242192) - bump FUSE_USE_VERSION to 31,
    update the getattr/readdir operation signatures and fuse_fill_dir_t
    calls for the fuse3 API, and build against pkg-config fuse3
  - Switch BuildRequires from pkgconfig(fuse) to pkgconfig(fuse3)

++++ trufflehog:

  - Update to version 3.95.6 (.5 is on the same commit hash as .4):
    * S3: surface bucket listing failures and fix multi-role object count (#5035)
    * close todo - embed small HTTP test fixtures (#5001)
    * add filetype=sdist param so we get the correct response code (#4988)
    * fix(dropbox): prevent long sl.u. tokens from being truncated before verification (#5012)
    * Fix: Resolve known dedup issues in notifierWorker (#5028)
    * [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration (#5007)
    * Fix Renovate lookup: update setup-captain version comment (#4999)
    * [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag (#5005)
    * GitHub finegrain analyzer was improperly handling errors (#4498)
    * set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it (#5027)
    * Replace Renovate config with shared preset (high-risk tier) (#4992)
    * Restructure Klaviyo detector pattern tests (#5026)
    * Updating Klaviyo PK new format (#5009)
    * [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic (#5008)
    * [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic (#5006)
    * [INS-465] Add datadogapikey detector to defaults.go (#4969)
    * Re-host pkg/handlers JSON fixtures under the org (#5023)
    * Update test containers dependency (#4978)
    * fix: avoid terminal probes before CLI output (#4994)
    * Move to github.com/moby/moby/client from docker/docker (#4987)
    * fix(postgres): honor ignore tags for default port URLs (#4968)
    * fix: scan files with lines exceeding bufio's default 64 KB token limit (#5022)
    * Enigma detector enhance verification to prevent false verified findings (#5011)

++++ ttyplot:

  - Update to version 1.7.5
    * Fix CI failure on maybe-uninitialized compiler warning.
    * Avoid division by zero on small windows.
    * Work on smaller windows with no clock display.

++++ wolfictl:

  - Update to version 0.39.19:
    * build(deps): bump github.com/anchore/stereoscope from 0.1.23 to
    0.2.1 (#1993)
    * build(deps): bump the chainguard group with 3 updates (#1992)
    * build(deps): bump chainguard-dev/actions from 1.6.21 to 1.6.24
    (#1997)

++++ xkeyboard-config:

  - update to 2.48
    * ca(multix): Fixes to match the standard
      * symbols/pl: add colemak_dh_ortho variant
      * symbols/es: Better placement for dead_caron/doubleacute
      * Add Old Hung. Rudimenta UE to Carpth. Hl. variants
      * symbols: add Mara (mrh) keyboard layout
      * Add new layout for br thinkpad with nodeadkeys
      * ci: Fix xkbcommon job
      * inet: Update latest keysyms from xorgproto
      * keycodes: Add Linux 7.0 key
      * inet: Update latest keysyms from xorgproto
      * vt(vt105): Fix <DELE> mapping
      * triage: Use bug report template by default
      * triage: Improve issue & MR templates
      * triage: Add bugbot tags to handle non-actionable reports
      * triage: Close stale “Needs information” report earlier
      * triage: Fix default issue template
      * triage: Fix tag addition
      * rules: Add new generator
      * rules: Remove old generator
      * build: Drop support for Python 3.9-3.10
      * rules: Remove $nonlatin group
      * types: Fix default KEYPAD
      * types: Make numpad(microsoft) an alias of numpad(pc)
      * types: Fix FOUR_LEVEL_X and numpad(shift3)
      * types: Fix pc(default)
      * types: Fix FOUR_LEVEL_KEYPAD and FOUR_LEVEL_MIXED_KEYPAD
      * types: Fix typo
      * chore: Remove spaces before `xkb_symbols`
      * prerelease for translation updates
      * updated translations
      * removed whitespace

++++ xwpe:

  - Drop the redundant download_url _service: the release tarball is referenced via Source0 and shipped in the package (matches the upstream asset, sha256 36b4c546...). Avoids a second, drifting fetch path.
  - Refresh 1.6.6 tarball after the final upstream retag (adds the cross-platform test harnesses to the tag).
  - Own the hicolor/scalable icon directories (fix unowned-directory build check).

++++ zathura-plugin-pdf-mupdf:

  - Build against the shared MuPDF library instead of the static
    libmupdf.a: the plugin failed to load with "undefined symbol:
    jpeg_resync_to_restart" because openSUSE builds MuPDF against system
    codec libraries (jpeg, openjpeg, jbig2dec, brotli) which the static
    archive does not pull in; the shared library carries them in its own
    NEEDED. Switch BuildRequires from mupdf-devel-static to
    pkgconfig(mupdf) so upstream's meson links the shared library
    (boo#1165273).

------------------------------------------------------------------
------------------  2026-6-21  -  Jun 21 2026  -------------------
------------------------------------------------------------------

++++ apache-commons-logging:

  - Upgrade to 1.4.0
    * Fixed Bugs
    + Use the new Apache oak leaf logo
    + Fix broken URLs in website links
    + Add support for Jakarta servlets, see org.apache.commons
    .logging.jakarta.ServletContextCleaner #419
    * Changes
    + Bump org.apache.commons:commons-parent from 97 to 102
    + Bump log4j2.version from 2.25.3 to 2.26.0
    + Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18

++++ asl:

  - Update to version 142-bld309
    * Explicitly report non-existing local symbols that are refrenced
    backwards.

++++ bitcoin:

  - Reference the tracking bugs for CVEs already fixed in current bitcoin
    (the affected versions all predate the shipped release):
    * CVE-2018-20587 (boo#1125092)
    * CVE-2019-15947 (boo#1149711)
    * CVE-2020-14198 (boo#1181786)
    * CVE-2021-3195 (boo#1181784)
    * CVE-2023-37192 (boo#1217678)
    * CVE-2024-35202 (boo#1231507)

++++ bottom:

  - Update to version 0.14.0:
    Bug Fixes
    * #2093: Fix memory collection using cgroup v1 sentinel max as
    total.
    Other
    * #2052: Update minimum Rust version to 1.95.0.
  - Update to version 0.13.0:
    Bug Fixes
    * #2035: Fix panic when deleting unicode words in search..
    * #2042: Address possible memory usage growth for AMD GPU stat
    gathering on Linux.
    * #2069: Fix issue in process search with parsing quoted
    delimiters.
    Features
    * #1938, #1980: Report average packet size and packet rate.
    * #2003: Configurable default sort column for temperature and
    disk table widgets.
    * #1979: Add a global bg_colour config option to set widget
    background colour.
    * #2039: Add a config option for drawing a line separator
    (table_gap) between the column headers and data..
    * #1948: Add support for both an != operator and ! negation
    prefixes in query searches.
    * #2045: Add support for showing a decimal place for CPU usage.
    * #2046: Add a show_table_scroll_bar config option to show a
    scroll bar on table widgets.
    * #2048: Add support for a temperature graph to show sensor
    temperature change over time.
    * #2053: Add a configurable default sort column for the process
    widget.
    * #2066: Add search support in the help dialog.
    * #1791, #2072: Add support for using a short name for the GPU
    in memory usage.
    * #2073: Add disk I/O time series graph.
    * #2088: Add option to show unmounted disks on Linux.
    Changes
    * #2031: Tweak display/hiding logic for a graph widget's legend.
    * #2039: Replace hide_table_gap with table_gap.
    * #2061: Take cgroup into account for RAM/swap usage.
    * #2062: Rename [network] to [network_graph] in the config file;
    [network] remains valid as an alias.
    * #2062: Move network and memory graph config file options from
    [flags] to be under [network_graph] and [memory_graph].
    * #2063: Move process config file options from [flags] to be
    under [processes].
    * #2064: Move CPU config file options from [flags] to be under
    [cpu].
    * #2064: Move memory config file options from [flags] to be under
    [memory_graph].
    * #2066: Take cgroup into account for CPU usage% calculations.
    * #2074: Treat uppercase 'Q' as a quit shortcut.
    Other
    [#1958]: Fix cosmetic banner issue on docs page.
    [#2037]: Update AMD GPU names list.
    .

++++ chirp:

  - Update to version 20260619:
    * Add Baofeng BF-5RH as alias of UV-5RH
    * locale: Added Czech translation
    * generic_csv: Fix ImmutableValueError when exporting special memories

++++ flameshot:

  - Update to 14.0.0:
    * New approach to Multi-Monitor / Scaling (when a screenshot is
    taken, the user will be prompted to select which monitor to
    capture).
    * Legacy X11 Screenshot Fallback
    * Tray Menu to select screen: If you typically launch flameshot
    from the tray menu, there is a new dropdown that will
    directly let you select which monitor to capture and bypass
    the monitor selection widget.
    * Capture Active Monitor (X11 & Windows): When this is enabled
    Flameshot will skip the monitor selection dialog entirely and
    will automatically capture whichever monitor your cursor is on.
    * D-Bus Capture Method (Linux): A new captureScreen() D-Bus
    method lets scripts and external applications trigger
    Flameshot's GUI capture programmatically
    * Screen Subcommand Redesign: The flameshot screen CLI
    subcommand has been reworked to support a per-screen capture
    paradigm. A new --edit/-e flag enables the user to specify
    which screen to capture. Users can use this to bind custom
    hotkeys to screenshot specific monitors to bypass the monitor
    selection widget.
    * Removed Startup Delay: The 500ms arbitrary delay on the
    desktop entry's "Take Screenshot" action has been removed
    * The launcher dialog is now significantly smaller: monitor
    selection is hidden on single-screen setups, layout margins
    are tighter, and the window auto-fits its content.
    * QPainter crashes on KDE Plasma Wayland (Qt 6): Added safety
    checks across 9 widget files to prevent "Paint device
    returned engine == 0" crashes when the backing store isn't
    ready.
    * Clipboard runtime detection: A single binary now works on
    both Wayland and X11 — the clipboard backend is selected at
    runtime instead of compile time.
    * GNOME clipboard copy failure: Worked around GNOME's
    requirement for a visible window during clipboard operations.
    The capture window now stays briefly alive until the
    compositor fetches the data. (Fixes #4116, #4298)
    * Cosmic Desktop: Fixed capture window not going fullscreen on
    Cosmic DE.
    * X11 / GNOME: Fixed crash caused by Qt::
    BypassWindowManagerHint on X11 GNOME.
    * D-Bus hang fix: Flameshot no longer hangs on systems without
    a org.freedesktop.Notifications service registered. (Fixes #4353)
    * D-Bus race condition: Fixed a race condition where a
    temporary QApplication could corrupt Wayland connections,
    causing subsequent portal calls to hang.
    * Double right-click segfault: Fixed a crash caused by double
    right-clicking in the capture window.
    * Last region on scaled displays: Saved region coordinates now
    correctly account for the device pixel ratio on HiDPI screens.
    * Layout warning fix: Removed a duplicate layout parent
    assignment that printed a Qt warning on every capture.
    * 19 translation updates via Weblate, including improvements to
    Spanish, Finnish, and many other languages.

++++ frei0r-plugins:

  - Update to version 3.2.2:
    + fix(tint0r): build with SSE4 failing on incompatible types
    + chore: fix typo in cmake for WITHOUT_CAIRO
    + docs: make generated api links external
  - Replace gcc-c++ with generic c++_compiler BuildRequires

++++ gap-alnuth:

  - Update to release 4.0.2
    * Updated OSCAR integration for enhanced compatibility with the
    latest OSCAR version.

++++ ghc-aeson-pretty:

  - Update aeson-pretty to version 0.8.11.
    Upstream has edited the change log file since the last release in
    a non-trivial way, i.e. they did more than just add a new entry
    at the top. You can review the file at:
    http://hackage.haskell.org/package/aeson-pretty-0.8.11/src/CHANGELOG.markdown

++++ ghc-servant:

  - Update servant to version 0.20.3.0 revision 4.
    Upstream has revised the Cabal build instructions on Hackage.

++++ git-town:

  - Update to version 23.0.3:
    * Bug Fixes
  - git town continue now works with faulty Git pre-commit hooks
    (#6242).
  - git town ship now works from a Git worktree (#6237).

++++ godot:

  - Update to 4.7
    * migration guide: https://docs.godotengine.org/en/4.7/tutorials/migrating/upgrading_to_godot_4.7.html
    * AreaLight3D for rectangular light sources
    * Asset Store instead of  Asset Library
    * Offset transform of Control nodes
    * 2D scene painter tool
    * HDR output
    * Option for Path3D to snap to colliders
    * 3D vertex snapping
    * Follow moving objects in the 3D editor
    * MeshLibrary editor
    * Initial touch support for Wayland
    * GDExtensions are now displayed in the Project Settings
    * Add ability for Area3D to detect/influence SoftBody3D with Jolt Physics
    * One-way collision direction for CollisionShape2Ds
    * Jolt SoftBody3D: Make default mass 1 kg and fix stiffness conversion
    * and much more: https://godotengine.github.io/godot-interactive-changelog/#4.7
  - use bundled mbedtls while factory currently does not have expected version

++++ hamlib:

  - Update to 4.7.2:
    * Fix IC-7600/IC-7610 clock commands
    * Icom: Add CWR to modes eligible for DSP filtering
    * Kenwood: New model Hamgeek uSGX
    * Various fixes for Skywatcher, DX-SR8, FT-710, FTX-1, IC-705, X6100
    * rigctld: Fix send_raw stack out-of-bounds write and
    uninitialized memory CVE-2026-54634 (boo#1268628)
    * rigctld: Fix stack/heap overflow primitive in
    read_string_generic + auth bypass in rigctld + weak password
    handling (boo#1268629)

++++ hawk-apiserver:

  - Version 0.1.1+git.1782032932.309de44:
    * Add XInputsKvGroup (bsc#1267910)
    * Enable other Primitive-Operation attributes

++++ typst:

  - Update to 0.15.0
    https://typst.app/docs/changelog/0.15.0/
    https://github.com/typst/typst/releases/tag/v0.15.0
  - Remove upstreamed fix-gcc16-build-in-libdeflate-boo1260948.patch

++++ hcloud-upload-image:

  - Update to version 1.5.0:
    * BREAKING CHANGES
  - new write-to-disk command (#178)
    * Features
  - new write-to-disk command (#178) (d65441f), closes #157
    * Bug Fixes
  - update hcloudimages module path for v2 (#184) (f4fd485)
    * Miscellaneous Chores
  - deps: update module
    github.com/apricote/hcloud-upload-image/hcloudimages to
    v2.0.1 (#186) (1b1e1af)
    * Dependencies
  - chore(deps): update actions/checkout action to v7 (#188)
  - chore(main): release hcloudimages 2.0.1 (#185)
  - chore(main): release hcloudimages 2.0.0 (#181)
  - chore(deps): update dependency rust-lang/mdbook to v0.5.3
    (#175)
  - chore(deps): update go toolchain directive to v1.26.4 (#179)
  - chore(deps): update actions/checkout digest to df4cb1c (#180)

++++ intel-media-driver:

  - Update to version 26.2.2:
    + [Encode] Fix AV1 temporal MV buffer and SavedOrderHints for
    deduplication
  - Changes from version 26.2.1:
    + [Encode] Add DDI ETW trace and API sticker for new encode codec
    + Add ETW-based DDI tracing and API sticker instrumentation for a
    new encode codec on the APO D3D11 path, mirroring the existing
    HEVC DDI trace pattern.
    + Reserve four new encode DDI event slots in the public
    MEDIA_EVENT
    + enum: status report, caps, picture parameters, and API sticker.
    + Add internal trace helpers for the new caps and
    picture-parameter structures, and reuse the existing shared
    status-report serializer.
    + Instrument every DDI entry point in the new encode class with
    API sticker start/stop events. The instrumentation uses an RAII
    scope guard so the stop event is emitted automatically on every
    return path (including the early returns driven by
    DDI_CODEC_CHK_*_RETURN macros), guaranteeing matched start/stop
    pairs in captured ETW traces. Explicit returns capture the
    actual HRESULT.
    + Extend the internal ETW manifest and MediaAnalyzer metadata
    with the corresponding tasks, events, templates, and API value
    map so the new events are decodable end-to-end.
    + This makes the new encode DDI observable for debugging,
    capture, and post-processing without changing any runtime
    behavior.

++++ jq:

  - Update to version 1.8.2
    Security fixes
    * CVE-2026-32316: Fix heap buffer overflow in jvp_string_append
    and jvp_string_copy_replace_bad.
    * CVE-2026-33947: Limit path depth to prevent stack overflow in
    jv_setpath, jv_getpath, jv_delpaths.
    * CVE-2026-33948: Fix NUL truncation in the JSON parser.
    * CVE-2026-39956: Fix _strindices missing runtime type checks.
    * CVE-2026-39979: Fix out-of-bounds read in jv_parse_sized().
    * CVE-2026-40164: Randomize hash seed to mitigate hash collision
    DoS attacks.
    * CVE-2026-40612: Limit containment check depth to prevent stack
    overflow in contains.
    * CVE-2026-41256: Fix NUL truncation in program files loaded
    with -f.
    * CVE-2026-41257: Fix signed-int overflow in stack_reallocate.
    * CVE-2026-43894: Reject numeric literals longer than
    DEC_MAX_DIGITS (999999999).
    * CVE-2026-43895: Reject embedded NUL bytes in module import
    paths.
    * CVE-2026-43896: Limit recursive object merge depth to prevent
    stack overflow.
    * CVE-2026-44777: Detect circular module imports to prevent
    stack overflow.
    * CVE-2026-47770: Guard deep structural equality and comparison
    recursion.
    * CVE-2026-49839: Fix heap-buffer-overflow in raw file loading.
    * CVE-2026-54679: Tighten string length bounds and propagate
    invalid jv in implode.
    * GHSA-gf4g-95wj-4q4r: Fix use-after-free in args2obj() array
    argument path.
    * GHSA-hj52-j2c9-r8r4: Fix signed-int overflow in tokenadd to
    prevent buffer overflow.
    * Limit the number of function parameters and definitions to
    prevent SEGV.
    * Pre-allocate tokenbuf for string parser to avoid undefined
    behavior.
    * Avoid stack overflow when freeing deeply nested values.
    * Fix memory leaks and double frees.
    Releasing
    * Update GPG signing key.
    CLI changes
    * Improve error message truncation with closing delimiters.
    * Remove extra space from die function output.
    * Fix raw input flag not to corrupt multi-byte characters.
    * Fix crash when importing a module with errors twice.
    * Increase the maximum printing depth from 256 to 10000.
    Changes to existing functions
    * Fix rtrimstr("") always outputting "".
    * Fix infinite loop and undefined behavior in del(.[nan]).
    * Refactor @uri and @urid to fix multi-byte UTF-8 corruption.
    * Fix tonumber and toboolean to reject strings with embedded
    null bytes.
    * Fix undefined behavior in modulo operator.
    * Fix reversed pointer subtraction in f_env bounds check.
    * Fix missing validity check in f_strflocaltime after
    f_localtime.
    * Fix year 2038 problem on 32-bit platforms.
    * Use // instead of //= in from_entries definition.
    Build and test changes
    * Drop strptime test using non-portable %F.
    * Limit oniguruma depth to 1024 in jq_fuzz_execute.
    * Fix localization test for time formatting functions.
    * Fix expected value assertion.
    * Fix typo in tests/jq.test.
    * Refactor tm2jv to handle fractional seconds.
    * Fix jq_fuzz_parse_stream: use iterative parser API for
    streaming mode.
    * Fix crashes and resource leaks in jq_testsuite.
    * Support building with --disable-maintainer-mode and
    source != build dir.
    * Respect SOURCE_DATE_EPOCH while generating man page.
    * Fix undefined pointer arithmetic in UTF-8 helpers.
    * Fix one-byte over-read in BASE64_DECODE_TABLE.
  - Drop not longer needed patches:
    * CVE-2026-32316.patch
    * CVE-2026-33947.patch
    * CVE-2026-33948.patch
    * CVE-2026-39956.patch
    * CVE-2026-39979.patch
    * CVE-2026-40164.patch
    * CVE-2026-40612.patch
    * CVE-2026-41256.patch
    * CVE-2026-41257.patch
    * CVE-2026-43894.patch
    * CVE-2026-43895.patch
    * CVE-2026-43896.patch
    * CVE-2026-44777_0.patch
    * CVE-2026-44777_1.patch

++++ kernel-default:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-source:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-docs:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-kvmsmall:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-obs-build:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-obs-qa:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-syms:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ kernel-vanilla:

  - Linux 7.1.1 (bsc#1012628).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1012628).
  - driver core: faux: fix root device registration (bsc#1012628).
  - driver core: reject devices with unregistered buses
    (bsc#1012628).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1012628).
  - arm64: cputype: Add C1-Premium definitions (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1012628).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1012628).
  - Rename to
    patches.kernel.org/7.1.1-009-HID-Input-Add-battery-list-cleanup-with-devm-ac.patch.
  - Rename to
    patches.kernel.org/7.1.1-010-drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_.patch.
  - Update config files.
  - commit 937e122

++++ libcpath:

  - Update to release 20260621
    * Testsuite updates

++++ libresidfp:

  - Updated to 1.1.0
    * https://github.com/libsidplayfp/libresidfp/releases/tag/v1.1.0

++++ mbedtls-2:

  - Reference the tracking bugs for the already-listed CVE fixes:
    * CVE-2024-45157 (boo#1230310)
    * CVE-2025-27809 (boo#1240051)
    * CVE-2025-27810 (boo#1240052)

++++ mbedtls:

  - Reference the tracking bug for the previously-listed CVE fix:
    * CVE-2022-35409 (boo#1201581)

++++ libmpdclient:

  - Updated to 2.25
    * https://raw.githubusercontent.com/MusicPlayerDaemon/libmpdclient/v2.22/NEWS
    * Supported MPD protocol 0.25.0
    * stringnormalization
    * song properties "RealUri", "start_ms", "end_ms"
    * tag "DiscSubtitle"
    * Switched to C11.

++++ nilfs-utils:

  - update to 2.3.1 (bsc#1268553, CVE-2026-55392):
    * Backport a fix for a potential overflow in the library function that
    determines if a superblock is valid (CVE-2026-55392):
  - lib/sb: validate s_log_block_size in nilfs_sb_is_valid()
    * Backport a cleanerd fix:
  - cleanerd: apply missing fix for swapped segment count reduction
    * Backport a minor correction to a footnote in the README file:
  - README: mention libselinux-dev as a newer package name
    * New Features:
  - Support file/directory arguments for utilities (lscp, lssu,
    nilfs-clean, etc.) to automatically resolve backing devices.
  - nilfs-clean: Automatically adjust GC speed by default, eliminating
    manual tuning.
    * GC Daemon (cleanerd) Improvements:
  - Cap segments per cleaning step by available free segments to
    prevent stalling when free space is running out.  Also, cap
    the number of segments per cleaning step to prevent theoretical
    size_t overflow on 32-bit systems.
  - Improve signal handling (exit cleanly on SIGINT, ignore SIGUSR2).
  - Add state dump feature (SIGUSR1).
    * Build System Updates:
  - Support generating pkg-config information for shared libraries.
  - Support pkg-config for finding dependencies (libuuid, libmount,
    libblkid, libselinux).
  - Do not install static libraries by default.
  - Gather system programs directly below sbin source directory.
    * Library Refactoring and API Changes:
  - Reorganize APIs in libnilfs and libnilfsgc:
  - Add/update APIs for segment I/O, resize, and freeze/thaw.
  - Unify type definitions (use standard uint32_t/uint64_t).
  - Remove obsolete APIs and internal structures from public headers.
    * Other Utilities Updates:
  - mkfs.nilfs2: Set "block_count read-only compat" flag by default.
  - Align help message output and exit codes with standard conventions
    (e.g. nilfs-tune).
  - nilfs-resize: Use new library API for layout information.
  - drop nilfs-utils-validate-s_log_block_size.patch (upstream)
  - add nilfs-utils-validate-s_log_block_size.patch (bsc#1268553,
    CVE-2026-55392)

++++ openbabel:

  - Reference the tracking bugs for the security issues already fixed in
    the 3.2.0 update:
    * CVE-2022-* OSS-Fuzz/TALOS batch (boo#1217676)
    * CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507),
    CVE-2026-3408 (boo#1259041)

++++ libsidplayfp:

  - Updated to 3.0.2
    * https://github.com/libsidplayfp/libsidplayfp/releases/tag/v3.0.2

++++ libtar:

  - Add upstream-pending security fixes (backported via Fedora):
    * libtar-1.2.20-CVE-2021-33643-CVE-2021-33644.patch: fix
    out-of-bounds read in gnu_long{name,link}
    (CVE-2021-33643, boo#1202316; CVE-2021-33644, boo#1202317)
    * libtar-1.2.20-CVE-2021-33645-CVE-2021-33646.patch: free memory
    allocated by the gnu_long{name,link} fields, fixing the memory
    leaks (CVE-2021-33645, boo#1202319; CVE-2021-33646, boo#1202320)
    without re-introducing the use-after-free that an incorrect leak
    fix otherwise causes (CVE-2021-33640, boo#1206547)
  - Modernize spec: drop RPM groups, use pkgconfig(zlib) and
    %ldconfig_scriptlets

++++ vapoursynth:

  - Extend vapoursynth-fhs-install.patch to also fix vapoursynth.pc:
    with the headers and library relocated to FHS locations, the
    generated pkgconfig file still derived includedir from the .pc
    location (${pcfiledir}/../include -> /usr/lib64/include) and
    carried no Libs, so consumers got the wrong -I path. Configure
    prefix/includedir/libdir from meson and emit
  - I%{_includedir}/vapoursynth plus -L%{_libdir} -lvapoursynth.
    Fixes the pkgconfig breakage that stops dependent software (e.g.
    mpv) from building (boo#1268226; the separate vspipe/meson-build
    issue in that report is not addressed here).

++++ lrzip:

  - Update to version 0.660:
    * Do not clean up thread structures in decompression failure
    conditions, fixing a use-after-free in lzma_decompress_buf() and a
    NULL pointer dereference in ucompthread() on corrupt/malicious
    archives (CVE-2025-15570, boo#1258016; CVE-2025-15571, boo#1258023)
    * Handle -L given without a parameter, fixing a NULL pointer
    dereference (CVE-2025-9396, boo#1248598)
    * Add write bounds checking in libzpaq and sanity checks for
    maliciously encoded headers and oversized allocations
    * Various STDIO, portability and build fixes (OpenBSD support,
    non-x86 zpaq, autoconf warnings); drop Doxygen doc build
  - Switch Source to the upstream GitHub release tarball (0.660 is not
    published on ck.kolivas.org) and run autoreconf at build time
  - Drop fixasmstack.patch (merged upstream)

++++ miller:

  - Update to version 6.19.0+git20260621.299636038:
    * Shell tab-completion for bash and zsh (#2096)
    * Add new tail -n +N, head -n -N options (#2071)
    * typofix
    * typofix
    * Add PNG graphics to perf docs for issue-2084 perf mods (#2095)
    * Post-6.19.0 release: back to 6.19.0-dev
    * docs/src/release-docs.md
    * Prepare 6.19.0 release
    * Fix exponential memory use when chaining seqgen (#2072) (#2094)
    * doc tweak
    * update ubuntu/python versions in .readthedocs.yaml (#2092)
    * docs: add "Allocation/GC optimizations: June 2026" performance section (#2091)
    * Bind scalar locals/params by reference, not by copy (~4-9% on DSL) (#2090)
    * Drop redundant deep-copy of UDF return values (~3-16% perf on UDFs in `mlr put`) (#2089)
    * Pool DSL stack-frame sets across UDF/subroutine calls (~31% perf on function-heavy `mlr put`) (#2088)
    * Pool DSL stack frames across records (~8-9% perf on `mlr put`) (#2086)
    * Batch-allocate per-record objects; reuse CSV writer field buffer (#2083)
    * Batch-arena field allocation for line-based readers (#2082)
    * Lazy per-record hashing: ~15-30% faster on common workloads (#2081)
    * Bump actions/checkout from 6 to 7 (#2080)
    * Bump github.com/cloudflare/circl from 1.6.2 to 1.6.3 (#2079)
    * Bump pault.ag/go/debian from 0.20.0 to 0.21.0 (#2078)
    * Bump pault.ag/go/debian from 0.19.0 to 0.20.0 (#2077)
    * Bump golang.org/x/sys from 0.45.0 to 0.46.0 (#2075)
    * Bump golang.org/x/term from 0.43.0 to 0.44.0 (#2074)
    * Bump golang.org/x/text from 0.37.0 to 0.38.0 (#2073)
    * Bump github/codeql-action from 4.36.1 to 4.36.2 (#2070)
    * Bump github/codeql-action from 4.36.0 to 4.36.1 (#2069)
    * Allow empty-string keys in JSON and YAML input (#2068)
    * Bump golang.org/x/sys from 0.44.0 to 0.45.0 (#2067)
    * Bump github/codeql-action from 4.35.5 to 4.36.0 (#2066)
    * Bump github.com/lestrrat-go/strftime from 1.1.1 to 1.2.0 (#2065)
    * Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#2064)
    * Fix PPRINT alignment with multi-character OFS (#1819) (#2063)
    * Apply join prefixes/rename to unpaired records (#1821) (#2062)
    * Default to "cat" verb when none is supplied (#2060)
    * Fix column alignment for wide and combining Unicode chars (#1520, #379) (#2061)
    * Fix data dropped from ragged implicit-header TSV/CSV-lite input (#1749) (#2059)
    * Fix mlr -s shebang doc and reject arrays/maps in contains/index (#1658) (#2058)
    * Add `--omd-aligned` flag for column-padded markdown output (#2057)
    * Bump github/codeql-action from 4.35.4 to 4.35.5 (#2056)
    * Bump golang.org/x/text from 0.36.0 to 0.37.0 (#2054)
    * Bump golang.org/x/term from 0.42.0 to 0.43.0 (#2055)
    * Bump github/codeql-action from 4.35.3 to 4.35.4 (#2052)
    * Bump github/codeql-action from 4.35.2 to 4.35.3 (#2051)
    * Bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#2050)
    * Bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 (#2048)
    * Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#2047)
    * Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 (#2045)

++++ mpclient:

  - Added mpc-0.35.tar.xz.sig and mpclient.keyring for source validation.
  - Updated to 0.24.12
    * https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.10/NEWS
    * protocol: fixed path traversal bug and allow empty URI
    * playlist: do not allow newlines in song URIs
    * decoder
    * pcm: fixed stack buffer overflow
    * sidplay: added fall back to SIDLiteBuilder if ReSIDfpBuilder is unavailable

++++ nekobox:

    Update to 5.11.23
  - Allow digits in URI scheme so hysteria2/hy2 (and socks5/socks4)
    links import (thanks @warmpain9)
  - Add start/stop button
  - Update sing-box

++++ netperfmeter:

  - Update to version 2.0.5
    * Fixed includes.
    * Manpage update.
    * Minor clean-up.
    * Added option to configure the separator.
    * Improved shell completions.
    * Improved vector counting.
    * Options handling improvements.
    * Using C++ memory allocation, instead of malloc() and calloc().
    * CreateSummary: improved options handling and updated manpage.
    * Further improvements of runtimeestimator.
    * Improved byteswap handling.
    * Fixed missing exit() call after usage message.
    * Added strict compiler options.
    * Set pipefail option in scripts.
    * Added new QUIC client and server handshake functions, to
    properly handle custom TLS root CA.
    * Fixed controllocal option handling.
    * Improved scripts and manpage.
    * Using ggplot2 for plotting.
    * Also using only TAB as separator in per-flow vector output.
    * Now consistency using TAB as separator in vector output; no
    more mix of space, spaces and TAB.
    * Line number handling fix for CombineSummaries.
    * Improved plotting script.
    * Improved Wireshark configuration example.
    * Some improvements, including option to turn off line numbering.
    * Flow handling fix.
    * MPTCP socket initialisation fix.
    * Merge branch 'dreibh/tcp-graceful-shutdown'
    * SCTP socket only needs to be closed when it has been created.
    * Added Wireshark "Decode As" configuration.
    * Made RetransmissionTrials configuration more readable.
    * Added server-side QUIC stream reception.
    * Some testing with multi-stream QUIC connection.
    * Started multi-stream support for QUIC.
    * One-stream QUIC connection is working now!
    * AddFlow message's Protocol fields needs to be 16 bits. For
    backward compatibility with NetPerfMeter 1.x, it is in Little
    Endian.
    * Added QUIC parameter configuration handling.
    * Added QUIC socket to passive side.
    * Added option parsing for QUIC.
    * Got rid of Linux-specific PR-SCTP code for old Linux SCTP
    versions. Linux SCTP now supports the same API as FreeBSD.
    * Improved control channel options handling.
    * Improved configuration of control channel protocols.
    * Updated runtimeestimator and getabstime.
    * Fixed control socket initialisation, to properly handle TCP or
    MPTCP.
    * Improved PDF fonts embedder script.
    * Further clean-ups to remove obsolete MPTCP options code used
    for MPTCP development version.

++++ nfpm:

  - Update to version 2.47.0:
    * New Features
  - 5c2f7ca: feat: RiscV64 support (#1091) (@ahqsoftwares)
  - 64b788a: feat: add Requires(Post) for RPMS (#1085)
    (@teddelin)
  - dc96073: feat: add fang support for styled CLI output (#1068)
    (@caarlos0)
    * Security updates
  - 060af04: sec(deps): update golang.org/x/crypto (@caarlos0)
  - f769631: sec(deps): update golang.org/x/net (@caarlos0)
    * Bug fixes
  - 3118ec1: fix: tolerate empty overrides packager clause
    (#1080) (@dleske)
    * Dependency updates
  - a2d9ce5: feat(deps): go1.26.4 (@caarlos0)
  - 9b16218: fix(deps): bump alpine from 3.23.3 to 3.23.4 (#1075)
    (@dependabot[bot])
  - e3102b3: fix(deps): bump alpine from 3.23.3 to 3.23.4 in
    /testdata/acceptance (#1076) (@dependabot[bot])
  - 62c555e: fix(deps): bump alpine from 3.23.4 to 3.24.0 (#1098)
    (@dependabot[bot])
  - 071ae18: fix(deps): bump alpine from 3.23.4 to 3.24.0 in
    /testdata/acceptance (#1099) (@dependabot[bot])
    * Build process updates
  - 4c62d34: ci(deps): bump github/codeql-action in the actions
    group (#1083) (@dependabot[bot])
  - 38a05de: ci(deps): bump the actions group across 1 directory
    with 3 updates (#1096) (@dependabot[bot])
  - 6fe4da4: ci(deps): bump the actions group across 1 directory
    with 7 updates (#1095) (@dependabot[bot])
  - cd95f9f: ci(deps): bump the actions group with 2 updates
    (#1078) (@dependabot[bot])
  - 8f9cbef: ci(deps): bump the actions group with 3 updates
    (#1090) (@dependabot[bot])
  - 9ff0e2f: ci(deps): bump the actions group with 4 updates
    (#1086) (@dependabot[bot])
  - 2ce1832: ci(deps): bump the actions group with 5 updates
    (#1074) (@dependabot[bot])
  - 1bd2fed: ci: fix docs build test (@caarlos0)
  - 4695cdc: ci: fix license check (@caarlos0)
  - a40b461: ci: update build (@caarlos0)
    * Other work
  - d16d75f: docs(deps): update hextra (@caarlos0)
  - c6a6a27: docs: update cmd docs (@caarlos0)

++++ ofono:

  - Reference the tracking bugs for the SMS/STK/USSD decoder security
    fixes applied upstream across the 2.14-2.17 updates:
    * SMS decoder stack buffer overflows: CVE-2023-2794 (boo#1218292),
    CVE-2023-4232 (boo#1218293), CVE-2023-4233 (boo#1218294),
    CVE-2023-4234 (boo#1218295), CVE-2023-4235 (boo#1218296)
    * SMS PDU / message-list parsing overflows and OOB read:
    CVE-2024-7537 (boo#1228903), CVE-2024-7547 (boo#1228917)
    * AT-command / USSD response parsing overflows: CVE-2024-7538
    (boo#1228904), CVE-2024-7539 (boo#1228905)
    * Uninitialized-memory information disclosure: CVE-2024-7540
    (boo#1228906), CVE-2024-7541 (boo#1228907), CVE-2024-7542
    (boo#1228908)
    * STK command PDU heap overflows: CVE-2024-7543 (boo#1228910),
    CVE-2024-7544 (boo#1228913), CVE-2024-7545 (boo#1228914),
    CVE-2024-7546 (boo#1228916)

++++ perl-Graphics-Toolkit-Color:

  - updated to 2.220.0 (2.22)
    see /usr/share/doc/packages/perl-Graphics-Toolkit-Color/Changes
    2.22   2026-06-20   lichtkind
  - ------
    * = minor fix release
    * ! fix hash in scalar context bug while arg splitting in new
    * ? various POD fixes
    2.21   2026-06-20   lichtkind
  - ------
    * = minor fix release
    * ? various POD fixes
    2.20   2026-06-19   lichtkind
  - ------
    * = big feature release: +3 spaces, +8 methods, +7 args, new docs, error handling
    * * add methods lighten / darken, saturate / desaturate,
    * * add methods tint (white) / shade (black) / tone (grey)
    * * new 16 Page doc in GTC::Manual with Reference, Topics, CookBook, CheatSheet
    * + spaces: 'OKHSL', 'OKHSV', 'OKHWB'
    * + color space property: 'family', 'role'
    * + method 'analogous' with args: 'to', 'in', 'steps' and 'tilt'
    * + method alias 'tone_curve' for 'apply'
    * + argument 'in' to method 'complement' (selectable cylindrical space)
    * + argument 'in' to method 'new' disambiguate color spaces
    * + argument 'skew' to method 'complement' (move circle along color-target axis)
    * + argument 'by' as alias of 'amount' argument for 'mix'
    * + reestablish optional Carp error messages + 4 other modes
    * + format: 'nested_array'
    * ~ change default color space for most methods to 'OKLAB' or 'OKHSL'
    * ~ change name and name alias in 'YUV' space now 'YPbPr' space
    * ~ change default argument of 'invert' from 'in' to 'only'
    * ~ rename method 'apply' to 'tone_curve', keeping 'apply' as alias til 3.0
    * ~ amount argument has now 0 .. 1 range, instead of 0 .. 100
    * ~ reduce arguments of the 'color' routine to work like the 'color' argument of 'new'
    * - reduce arguments of 'is_in_gamut' to 1 ('in') in method mode and 1 as routine ('color')
    * ! HSB constraints removal was mistake, constraint was reestablished

++++ perl-YAML-LibYAML:

  - updated to 0.908.0 (v0.908.0)
    see /usr/share/doc/packages/perl-YAML-LibYAML/Changes

++++ python-biopython:

  - cleanup doc

++++ python-bitarray:

  - Update to version 3.8.2
    * clarity/wording improvements throughout project.
    * add 'new_allocation()' to simplify 'resize()'.
    * drop Python 3.6 support.

++++ python-json5:

  - update to 0.15.0:
    * Fix #113: parsing of signed hexadecimal literals such as
    "-0x1f" and "+0xff" was raising a ValueError instead of being
    allowed.
    * Fix #111: docstring typo fix/improvement in loads().
    * Add explicit return type annotations to loads() and parse().

++++ python-uv:

  - update to 0.11.23
    * Bug fixes
  - Revert "Fix transparent Python upgrades in project environments" to mitigate unintended breakage in pre-commit-uv
  - Restore old behavior where workspace members "hidden" by an intermediate pyproject.toml would be treated as standalone projects

++++ rizin:

  - Use %fdupes in %install
  - Update to version 0.9.0:
    * Add architecture support for TMS320C54x, cBPF, SH-3, RS08,
    HCS12X, MCS96 variants, Infineon C166, MIL-STD-1750, and
    DEC VAX
    * Migrate RISC-V and HPPA to Capstone 6 and add M68k ColdFire
    support
    * Continue RzArch migration: remove RzAsm from the public API,
    isolate ESIL into its own namespace, and continue ESIL→RzIL
    migration work
    * Expand RzIL support with x86 SSE/SSE2 floating-point lifting,
    a SPARC lifter, TMS320C5x uplifting, exception halting, and
    improved UI integration
    * Rework pf format syntax and implementation
    * Add statistical and entropy histograms and the new Marks
    subsystem
    * Improve visual bit editor mode and add the "underwater"
    color theme
    * Extend binary format support with STABS, Lua/LuaJIT, CaRT,
    Amiga Hunk, MDT, PEF, bootimg v1-v4, expanded iH coverage,
    additional ELF coredump support, and Python 3.14 bytecode
    support
    * Reorganize debugger heap inspection commands into
    allocator-specific namespaces (dmhg*, dmhw*, dmhj*)
    * Add variable constraints, C++ virtual-call devirtualization,
    and typeclass support
    * Add new commands for marks, histograms, gadget searches,
    RzIL output, ASN.1/PKCS#8 parsing, and type management
    * Add new configuration options and rename rop.* settings to
    gadget.*
    * Remove ESIL-based search, pg* visual ROP support, /cc
    checksum collision search, rz-asm -r, rz-bin -X, obsolete
    I/O backends, GPL-derived plugins, and deprecated APIs
    * Improve performance and thread safety through RzGraph,
    container, and gadget-cache optimizations
    * Update to Capstone 6.0.0-alpha9, switch Swift demangling to
    rz-libswift, update rz-libdemangle, and bump project format
    version from 19 to 25

++++ rocksndiamonds:

  - Update to version 4.4.2.2
    * added checkbox to use fast opening and closing exits and gates.
    * added support for non-masked drawing for game elements info
    screen.
    * added truncating text if it does not fit into the playfield
    viewport.
    * added flags for DC style behavior to fix a few old tapes.
    * fixed visual bug with adjusting scrollbar while dragging it.
    * fixed running program in headless mode.

++++ rz-ghidra:

  - Update to version 0.9.0
    * Updated used Ghidra code to 12.1
    * Various changes to use updated Rizin APIs

++++ sidplayfp:

  - Update to version 3.1.0
    * Allow disabling colors when ANSI configuration is false or
    when NO_COLOR env var is defined.
    * Fix error message when no suitable engine found.
    * Update fmt to 12.2.0

++++ texstudio:

  - Update to TeXstudio 4.9.5
    * fix crash when setting explicit root doc #4469
    * improve handling collaboration with teamtype #4454,#4466
    * workaround win11 style, invisible red background when text not
    found in searchpanel
    * keep folder structure of imported macros if more than one
    macro is imported #4484
    * highlight more tex symbol as keyword #4465
    * fix addresource bibfile when using citation-style-language
    [#4477]
  - Change package build system to use Qt6 instead of Qt5

++++ trivy:

  - update vendored containerd to 2.3.2:
    + CVE-2026-50195 (bsc#1268399)
    + CVE-2026-53488 (bsc#1268400)
    + CVE-2026-53492 (bsc#1268403)
    + CVE-2026-53489 (bsc#1268404)
    + CVE-2026-47262 (bsc#1268440)

++++ uftpd:

  - Update to version 2.16
    Changes
    * Issue #40: IPv6 support. uftpd now opens separate IPv6
    listeners for both FTP and TFTP, alongside the IPv4 ones. The
    FTP data channel works over IPv6 using EPSV and EPRT (EPRT was
    previously unimplemented); the legacy PASV/PORT commands stay
    IPv4 only, as the protocol requires.
    Build with configure --disable-ipv6 to leave IPv6 out
    Fixes
    * Fix #32: a session failing during setup (e.g. chroot or the
    writable root check) returned into the parent's accept loop
    instead of exiting, becoming a rogue listener that forked
    endless sessions and left defunct (zombie) processes behind
    until the system ran out of PIDs.
    * Fix #41: a retransmitted TFTP WRQ reopened the destination
    file, leaking a descriptor on every retry until "Too many open
    files", and truncating already-received data; duplicate WRQs
    are now re-acknowledged instead.
    * Fix #42: bogus file size in FTP MLST/MLSD listings on 32-bit
    platforms, st_size was not cast to the type expected by the
    %PRIu64 format.
    * Fix #43: malformed TFTP OACK, the option acknowledgment
    included extra trailing NUL bytes that strict clients (e.g.
    Cisco switches, U-Boot) reject.
    * Fix #44: TFTP server ignored the ACK block number; a lost DATA
    packet is now detected and the missing block retransmitted,
    instead of streaming past it.
    * Fix TFTP ACK packets padded with four stray NUL bytes (8-byte
    instead of 4-byte ACK), sent when receiving an upload (WRQ).
    * Fix #45: TFTP transfers larger than 65535 blocks failed at the
    16-bit block number rollover; the wrapped block is now mapped
    back to its absolute position so large files (or small block
    sizes) transfer fully.

++++ xmlstarlet:

  - Add xmlstarlet-fix-fo-exit-code.patch: "xml fo" (format) returned
    the byte count from xmlOutputBufferClose() as its exit status
    instead of 0 on success, so it exited with (bytes written % 256)
  - most visible with --omit-decl (boo#1231165)
  - Backport two fixes collected in the Debian package:
    * xmlstarlet-fix-unesc-dquot.patch: unesc now handles &quot; and
    &apos; correctly (off-by-one on the entity name length,
    Debian bug 837122)
    * xmlstarlet-fix-format-security.patch: pass string-literal format
    arguments to satisfy -Werror=format-security
  - Modernize spec: drop RPM group and use pkgconfig() BuildRequires
  - Drop xmlstarlet-rpmlintrc: its only filter (package-with-huge-docs)
    no longer matches and was flagged as an unused filter

++++ xwpe:

  - Refresh 1.6.6 tarball after upstream v1.6.6 retag (OpenBSD/reentrant-ncursesw build fixes + macOS console mouse).
  - Update to 1.6.6 (BSD portability; LSP truecolor semantic tokens; e_d_quit_basic return-type build fix for -Werror=return-type).
  - Initial openSUSE package (version 1.6.5).
    xwpe is the revived Borland-style console/X11 IDE: a single binary
    (wpe/we console, xwpe/xwe X11) with a syntax-highlighting editor,
    project management, multi-language compiler integration and
    source-level debugging (gdb/jdb/pdb), plus LSP and DAP clients.
    New upstream at https://codeberg.org/mendezr/xwpe ; Debian sid already
    tracks this fork.

++++ zizmor:

  - Update to version 1.26.1:
    This is a small corrective release for 1.26.0.
  - Update to version 1.26.0:
    * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
    * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
    * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
    * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
    * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
    * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)

------------------------------------------------------------------
------------------  2026-6-20  -  Jun 20 2026  -------------------
------------------------------------------------------------------

++++ alpine:

  - Make the build recipe compatible with POSIX sh

++++ python-awkward-cpp:

  - update to 53:
    * Add iostream wrapper
    * Add Jsonx example for converting JSON into JSONx (a XML
    format)
    * Add optional unresolvedTokenIndex parameter to Pointer::Get()
    * Add encoding validation option for Writer/PrettyWriter
    * Add Writer::SetMaxDecimalPlaces()
    * Support {0, } and {0, m} in Regex
    * Add Value::Get/SetFloat(), Value::IsLossLessFloat/Double()
    * Add stream position check to reader unit tests
    * Add Templated accessors and range-based for
    * Add (Pretty)Writer::RawValue()
    * Add Document::Parse(std::string), Document::Parse(const
    char*, size_t length) and related APIs.
    * Add move constructor for GenericSchemaDocument
    * Add VS2010 and VS2015 to AppVeyor CI
    * Add parse-by-parts example
    * Support parse number as string
    * Add kFormatSingleLineArray for PrettyWriter
    * Added optional support for trailing commas
    * Added filterkey and filterkeydom examples
    * Added npm docs
    * Allow options for writing and parsing NaN/Infinity
    * Add std::string overload to PrettyWriter::Key() when
    RAPIDJSON_HAS_STDSTRING is defined

++++ blockout:

  - Make build recipe compatible with POSIX sh

++++ btrfsprogs:

  - Modernize building of Python bindings, to generate binary
    subpackages for each Python interpreter in the distro.

++++ clpeak:

  - Update to version 2.0.13:
    * Vulkan: reworked coopmat shaders (independent/explicit accumulator
    chains for ILP, specialization constants for the tile shape)
    * Treat absent-driver / no-device init errors as success across the
    Vulkan/CUDA/ROCm backends (real errors are still surfaced)
    * ROCm: int8_dp4a and hipBLASLt FP4 probe stability on gfx942
    * OpenCL: create the backend scope before the platform query so the
    header is always printed
    * CPU backend: print L2 numbers for all cores, mixed-precision kernel
    refinements, gate NEON to AArch64, drop the redundant memcpy
    bandwidth test
    * Removed the Thread dispatch latency (CPU) and Atomic throughput tests

++++ forgejo-runner:

  - Update to version 12.12.0:
    + feat: per-label container platform specification
    + feat(jobparser): add support for run-name
    + fix(exec): Fix event_name/FORGEJO_EVENT_NAME not being set
    + fix: expression evaluation fixes discovered while refactoring 'if' detection
  - Update to version 12.11.1:
    + fix(docker): honour DOCKER_TLS_VERIFY and DOCKER_CERT_PATH when DOCKER_HOST is set
  - Update to version 12.11.0:
    + feat(jobparser): implement jobparser capability to evaluate 'if' clauses
    + feat: identify runner by its UUID in workflow logs
    + feat(jobparser): provide detection capability for permissions being defined
    + fix: evaluate if conditions of inner jobs before combining results
    + fix: make look-up of matrix values case-insensitive when expanding workflows

++++ fresh-editor:

  - Update to version v0.4.1:
    * Mostly bugfix release. https://github.com/sinelaw/fresh/releases/tag/v0.4.1

++++ gh:

  - Update to version 2.95.0:
    * feat(skills): list available skills when install runs non-interactively (#13548)
    * fix(skills): stage updates in a temp dir and swap in-place (#13449)
    * feat: add `repo read-file` and `repo read-dir` (#13580)
    * Bump Go in devcontainer
    * Make filtering by bot authors more discoverable (#13642)
    * chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
    * chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
    * chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4
    * chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1
    * chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
    * test(skill): fix test case name
    * test(skill): merge isolated test into table
    * Potential fix for pull request finding
    * docs(discussion): polish help docs
    * chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2
    * fix test
    * support custom CLAUDE_CONFIG_DIR in install

++++ vim:

  - Actually apply vim-9.1.1732-fix-inc-detection.patch (add the missing
    Patch16 / %patch entries): the patch was committed and documented but
    never wired into the spec, so the fix for bsc#1262395 (scientific
    parameter files misdetected as bitbake recipes) was not being built

++++ headscale:

  - Update to version 0.29.1:
    + Minimum supported Tailscale client version: v1.80.0
    + Fix nodes with tags='null' losing their assigned user on upgrade
  - Update to version 0.29.0:
    + Tailscale ACL compatibility improvements
    + SSH check action
    + Policy tests (beta)
    + SSH policy tests (beta)
    + SSH rule validation
    + Grants
    + Node attributes (nodeAttrs)
    + Taildrive
    + Hostname sanitisation
    + HA subnet router health probing

++++ helm3:

  - update to 3.21.2:
    * chore(deps): bump the k8s-io group with 2 updates 1259634
    (dependabot[bot])
    * fixes b52e276 (Matheus Pimenta)
    * chore(deps): bump the k8s-io group across 1 directory with 2
    updates 3342dbf (dependabot[bot])

++++ ipp-usb:

  - Update to version 0.9.34:
    +  Remove HP X677 quirks
    + Yet another workaround for HP LaserJet Enterprise M406 devices
    + Added disable-scan quirk (required for HP LaserJet Enterprise M406)

++++ just:

  - Update to version 1.53.0:
    + Add recipe_name() function
    + Support markdown justfiles
    + Allow omitting assert() message
    + Preserve bare [arg] long key when formatting
    + Add list concatenation operator
    + Do not export empty lists
    + Add split() function
    + Make which() require set lists
    + Make env() functions work with lists
    + Make + and / work with lists
    + Allow lists as regex operands of =~ and !~
    + Allow multiple --dotenv-filename and --dotenv-path options
    + Load multiple .env files
    + Flatten interpreter settings
    + Make [env] work with lists
    + Join lists in assert() and [confirm] messages
    + Join lists in interpolations
    + Using lists in string contexts is an error
    + assert(condition) evaluates to condition
    + Make assert() evaluate to "true" when set lists is enabled
    + Make =~ and !~ work with lists
    + if without else evalutes to [] when false
    + Check structural equality in != and ==
    + Add flag [arg] attribute
    + Make show() require set lists
    + Add bool() function
    + Add negation operator !
    + Allow conditions to be used in arbitrary expressions
    + Add show() function
    + Print lists in --evaluate
    + Reform booleans
    + Add list literals
    + Allow mapping dependencies over lists
    + Forwards lists to dependencies
    + Map append() and prepend() over lists
    + Map absolute_path() over lists
    + Add set lists
    + Preserve variadic arguments as lists of strings
  - Update to version 1.52.0:
    + Add [shell] attribute to override default-script setting
    + Add default-script setting
    + Add --default-list flag
    + Add default-list setting
    + Disable aliases that depend on absent modules
    + Print formatted justfile to stdout when source is stdin
    + Allow search directory with more subcommands
    + Disable recipes that depend on absent modules
    + Improve absent optional module error messages
    + Alphabetize Attribute derive macro order
    + Include UTF-8 byte-order mark in PowerShell scripts
    + Remove options from --list output
    + Switch from ansi_term to nu_ansi_term
    + Remove redundant argument parser attributes

++++ kquickimageeditor6:

  - Update to 0.6.2
    * Fix blur cache being recreated every time
    * Traits::ImageEffects::Blur::image: Remove unnecessary format
    conversion
    * Add alpha channel support with non-OpenCV stack blur
    (kde#519107)
    * Add option to build with OpenCV (kde#519107)
    * Reset crop rectangle on canvasRectChanged
    * {annotation/image}document: Use QImageReader to respect
    image transformation (kde#516546)

++++ liblo:

  - Update to version 0.36
    * Fixed handling of connection closure for multiple TCP servers.

++++ mariadb-connector-c:

  - Update to release 3.4.9
    * private_library.patch rebased onto the restructured libmariadb
    install block (NAMELINK_COMPONENT)
  - Drop patches fixed/superseded upstream:
    * mariadb-connector-c-3.4.5-const-correctness.patch
    * mariadb-connector-c-3.4.5-const-correctness-2.patch (upstream now
    uses a mutable copy instead of casting strchr)
    * mariadb-connector-c-2.3.1_unresolved_symbols.patch (upstream links
    the dialog plugin against ${CMAKE_DL_LIBS})

++++ mozjs140:

  - Update to 140.12.0:
    + Various security fixes
    + See https://www.firefox.com/en-US/firefox/140.12.0/releasenotes/
    https://www.firefox.com/en-US/firefox/140.11.0/releasenotes/

++++ librespeed-cli:

  - Update to version 1.0.13:
    * Add --insecure option to force unencrypted HTTP (#115)
    * New output package for clean stdout/stderr separation; dropped the
    logrus dependency
    * Fix critical concurrency bugs, replace go-ping with pro-bing and
    improve performance
    * Fix server selection based on ping results (#106)
    * Gracefully handle an empty rawIspInfo string in GetIPInfo
    * Fix CSV newline handling

++++ vmaf:

  - Update to release 3.2.0
    * Removed VIF (Visual Information Fidelity) as a core VMAF
    feature. VIF is computationally complex and did not
    meaningfully improve accuracy after updating the other
    features.
    * Introduced a few CAMBI-specific optimizations, both algorithmic
    and software.
    * The single-threaded processing speed improved by 70% and more,
    and still 44%+ for 16-threaded.
    * Measured the chroma feature at a lower scale, which does not
    hurt accuracy.

++++ xmlrpc-c:

  - Update to the current super-stable release 1.64.03
    * skip-expat.patch extended to fix xmlrpc-c-config.test.main, whose
    libxml2-backend LIBXML used Makefile syntax (empty in the shell
    script) and broke linking the test suite against -lxml2
    * upstream dropped the "-c" from the tarball/directory name
    (xmlrpc-%{version})

++++ meld:

  - Update to version 3.24.0:
    + Features:
  - Add support for building Meld as a Python wheel
  - Add screenshot-and-exit behaviour for CI testing
    + Fixes:
  - Avoid leaking file descriptors during matcher shutdown
  - Fix opening version control conflict with a single file
    argument
  - Fix crash when right-clicking on notebook
  - Don't discard all sides when one side changed on disk
  - Fix diff updating in auto-merge comparisons
  - Allow intl-8 in addition to libintl-8 on windows, to support
    conda
  - Fix opening comparison from folder compare with missing left
    file
  - Metadata fixes
    + Updated translations.

++++ mistral-vibe:

  - Update to 2.17.1:
  - Commands in `/help` are now listed alphabetically in both the
    CLI and ACP
  - `/teleport` is now always available and shows an explicit
    error when its prerequisites aren't met, instead of being
    hidden
  - Update to 2.17.0:
  - Added
  - `/mcp login`, `/mcp logout`, and `/mcp status` commands to
    authenticate OAuth-backed MCP servers from the TUI
  - `vibe --check-upgrade` to force an immediate update check
    and exit
  - `--yolo` as an alias for `--auto-approve`
  - ACP now accepts inline image content blocks
  - Changed
  - API keys are now stored in the OS keyring instead of plain
    text
  - Edit diff view now shows all replaced occurrences instead
    of just the first
  - Completion popup now uses a two-column layout
  - Chat messages now have right padding so text no longer
    collapses into the scrollbar
  - Faster CLI shutdown by deferring resource cleanup on exit
  - Fixed
  - Skill autocomplete popup now dismisses after Tab completion
  - Stdio MCP connections now persist across tool calls
  - Retryable 5xx responses from the Mistral backend are now
    retried instead of failing
  - Add no_terminal.patch for building in OBS, where /dev/tty is
    not available.

++++ obs-studio:

  - Use mbedtls-2-devel instead of mbedtls-devel.
    * OBS 32.1.2 bundled librtmp is incompatible with newer
    mbedTLS API changes present in Factory, causing build
    failures during obs-outputs compilation.
    * Restrict builds to supported architectures (aarch64, x86_64).
    OBS Studio no longer supports i586.

++++ pnpm:

  - update to 11.8.0:
    * Minor Changes
  - c112b61: Added a --dry-run option to pnpm install. It runs a
    full dependency resolution and reports what an install would
    change, but writes nothing to disk (no lockfile, no
    node_modules) and always exits with code 0. This mirrors the
    preview semantics of npm install --dry-run #7340.
  - 179ebc4: pnpm run --no-bail now exits with a non-zero exit
    code when any of the executed scripts fail, while still
    running every matched script to completion. This makes the
    exit-code behavior of --no-bail consistent between recursive
    and non-recursive runs (recursive runs already failed at the
    end). Previously, a non-recursive pnpm run --no-bail always
    exited with code 0, even when a script failed #8013.
  - 0474a9c: Added support for generating Node.js package maps at
    node_modules/.package-map.json during isolated and hoisted
    installs. Added the node-experimental-package-map setting to
    inject the generated map into pnpm-managed Node.js script
    environments, and the node-package-map-type setting to choose
    between standard and loose package maps.
  - dcededc: pnpm sbom now marks components reachable only
    through devDependencies with CycloneDX scope: "excluded" and
    the cdx:npm:package:development property. The excluded scope
    documents "component usage for test and other non-runtime
    purposes", which matches the semantics of a devDependency;
    the property is the CycloneDX npm-taxonomy marker emitted by
    @cyclonedx/cyclonedx-npm, so both modern (scope) and existing
    (property) consumers are covered. Components reachable at
    runtime (including installed optionalDependencies) omit scope
    and default to required.
  - 1495cb0: Added per-package SBOM generation with --out and
  - -split flags. Use --out out/%s.cdx.json to write one SBOM
    per workspace package to individual files, or --split for
    NDJSON output to stdout. When --filter selects a single
    package, the SBOM root component now uses that package's
    metadata. Workspace inter-dependencies (workspace: protocol)
    and their transitive dependencies are included. Author,
    repository, and license fall back to the root manifest when
    the package doesn't define them.
  - 293921a: feat(view): support searching project manifest
    upward when package name is omitted When running pnpm view
    without a package name, the command now searches upward for
    the nearest project manifest (package.json, package.yaml, or
    package.json5) and uses its name field.  If the manifest
    exists but lacks a name field, an error is thrown.  This
    change also replaces the find-up dependency with empathic for
    improved performance and consistency across workspace tools.
    * Patch Changes
  - 29ab905: Fixed pnpm update overriding the version range
    policy of a named catalog whose name parses as a version
    (e.g. catalog:express4-21). The catalog: reference carries no
    pinning of its own, so the prefix from the catalog entry
    (such as ~) is now preserved instead of being widened to ^
    [#10321].
  - bee4bf4: Security: validate config dependency names and
    versions from the env lockfile (pnpm-lock.yaml) before using
    them to build filesystem paths. A committed lockfile with a
    traversal-shaped configDependencies name (such as
    ../../PWNED) or version (such as ../../../PWNED) could
    previously cause pnpm install to create symlinks or write
    package files outside node_modules/.pnpm-config and the
    store. Names must now be valid npm package names and versions
    must be exact semver versions; the same validation is applied
    to optional subdependencies of config dependencies, and to
    the legacy workspace-manifest format before any lockfile is
    written. See GHSA-qrv3-253h-g69c.
  - 96bdd57: Fix link: workspace protocol switching to file:
    after pnpm rm is run from inside a workspace package whose
    target workspace dependency has its own dependencies, when
    injectWorkspacePackages: true is set. Follow-up to #10575,
    which fixed the same symptom for workspace packages without
    dependencies.
  - 302a2f7: No longer warn about using both packageManager and
    devEngines.packageManager when the two fields pin the same
    package manager at the same version with the same integrity
    hash (e.g. both pnpm@11.5.1+sha512.…). Previously the hash
    was stripped from the legacy packageManager field but not
    from devEngines.packageManager, so even identical
    specifications looked like a mismatch #12028.
    The warning still fires on any genuine divergence, and
    several cases now state the specific reason instead of a
    single generic message: a different package manager, a
    different version, or contradictory integrity hashes for the
    same version.
  - 3f0fb21: Fixed the progress line showing leftover characters
    from external processes that write to the terminal between
    progress updates (e.g. an SSH passphrase prompt would leave a
    fragment like added 0sa':). The interactive reporter now
    redraws each frame in place, erasing to the end of the
    display before reprinting, so any such remnants are cleared
    [#12350].
  - 564619f: Fixed pnpm approve-builds reporting "no packages
    awaiting approval" when a build-script dependency whose
    approval was revoked (e.g. after git stash drops the
    allowBuilds from pnpm-workspace.yaml) is re-added. The
    revoked packages are now correctly recorded in .modules.yaml
    so approve-builds can find them. #12221
  - 3d1fd20: Skip the redundant "target bin directory already
    contains an exe called node" warning on Windows when the
    existing node.exe already matches the target (same hard link
    or identical content) pnpm/pnpm#12203.
  - 1b02b47: Fix macOS Gatekeeper blocking native binaries
    (.node, .dylib, .so) by removing the com.apple.quarantine
    extended attribute after importing them from the store.
    When pnpm imports files from its content-addressable store
    into node_modules, macOS preserves extended attributes,
    including com.apple.quarantine. If this xattr is present on a
    store blob (e.g. it was first written under a
    Gatekeeper-enabled app such as a Git client), it propagates
    to node_modules, and Gatekeeper blocks the native binary from
    loading even though pnpm already verified the file's
    integrity against the lockfile.
    After importing a package, pnpm now strips
    com.apple.quarantine from its native binaries, matching
    Homebrew's behaviour of dropping quarantine from verified
    downloads. The cleanup is macOS-only, runs in a single
    batched xattr call per package, is restricted to native
    binaries (other files are untouched), and is non-fatal (it
    logs a warning on unexpected errors).
    Fixes #11056
  - 61969fb: Fix pnpm install with optimisticRepeatInstall
    incorrectly reporting Already up to date when pnpm-lock.yaml
    changed but project manifests did not. This affected
    workflows such as checking out or restoring only the lockfile
    [#12100].
    Also fixes checkDepsStatus to use the correct lockfile path
    when useGitBranchLockfile is enabled, so the optimistic
    fast-path and lockfile modification detection work with
    pnpm-lock.<branch>.yaml files instead of always stat'ing
    pnpm-lock.yaml. Merge-conflict detection now reads the
    resolved lockfile name as well, and with
    mergeGitBranchLockfiles enabled every pnpm-lock.*.yaml is
    scanned for modifications and conflicts. The git branch is
    now resolved by reading .git/HEAD directly (no process spawn)
    and uses the workspace directory rather than process.cwd().
  - 5c12968: Fix recursive updates of transitive dependencies
    when the update command mixes transitive dependency patterns
    with direct dependency selectors. For example, pnpm up -r
    "@babel/core" uuid now updates matching transitive
    @babel/core dependencies even when uuid is a direct
    dependency selector #12103.
  - 9d79ba1: Register the pnpm update --no-save flag in the CLI
    help and option parser.
  - 0474a9c: Fixed pnpm import for Yarn v2 lockfiles when js-yaml
    v4 is installed.
  - 9e0c375: Fixed pnpm install repeatedly prompting to remove
    and reinstall node_modules in a workspace package when
    enableGlobalVirtualStore is enabled. The post-install build
    step recorded a per-project node_modules/.pnpm virtual store
    directory in node_modules/.modules.yaml, overwriting the
    global <storeDir>/links value the install step had written.
    The next install then detected a virtual-store mismatch
    (ERR_PNPM_UNEXPECTED_VIRTUAL_STORE). The build step now
    derives the same global virtual store directory as the
    install step #12307.
  - 223d060: Document the --cpu, --os and --libc flags in the
    output of pnpm install --help. These flags were already
    supported but were only documented on the website #12359.
  - e85aea2: Avoid reading README.md from disk when publishing if
    the publish manifest already provides a readme field. The
    README is now only read lazily, inside
    createExportableManifest, when it is actually needed.
  - 3188ae7: Fixed pnpm peers check to accept loose peer
    dependency ranges such as >=3.16.0 || >=4.0.0- when the
    installed peer version satisfies the range #12149.
  - 531f2a3: Fixed pnpm update rewriting a workspace: dependency
    that points at a local path (e.g.
    workspace:../packages/foo/dist) into a normalized link: or
    version-range specifier. Such specifiers are now preserved
    verbatim when the workspace protocol is preserved #3902.
  - fe66535: Fixed a lockfile non-convergence bug where an
    incremental install kept a duplicate transitive dependency
    that a fresh install would not produce. When a package is
    reused from the lockfile, its child edges are taken verbatim
    and bypass the preferred-versions walk, so a transitive
    dependency could stay pinned to an older version even after a
    direct dependency resolved to a higher version that satisfies
    the same range. The resolver now refreshes such a stale pin
    to the higher direct-dependency version during resolution —
    so the older version is never resolved or fetched, and the
    incremental result converges to the fresh one.
  - 6d35338: pnpm install detects changes inside local file
    dependencies again. The optimistic repeat-install fast path
    only tracks manifest and lockfile modification times, so
    edits inside a local dependency's directory (or a repacked
    local tarball) were reported as "Already up to date".
    Projects with local file dependencies (file: and bare local
    path or tarball specifiers, declared directly or through
    pnpm.overrides) now always run a full install, which
    refetches those dependencies, matching pnpm v10 behavior
    [#11795].
  - 4ca9247: Preserve the existing Node.js runtime version prefix
    when resolving node@runtime:<range> to a concrete version.
  - 30c7590: Create shorter CAFS temporary package directories to
    leave room for lifecycle scripts that create IPC socket paths
    under TMPDIR.
  - 13815ad: Reporter output (warnings, progress) for pnpm store
    and pnpm config subcommands now goes to stderr instead of
    stdout. This fixes scripts that capture their stdout (e.g.
    PNPM_STORE=$(pnpm store path), pnpm config list --json | jq)
    from getting warnings mixed into the result.
  - 1c05876: Avoid relinking unchanged child dependencies and
    remove stale child links during warm installs.
  - 817f99d: Fixed lockfile churn where a package's
    transitivePeerDependencies could be dropped (and shift
    between packages) when the package participates in a
    dependency cycle. A cycle re-entry resolves against truncated
    children, so it must not be cached as "pure"; otherwise
    sibling occurrences of the same package short-circuit and
    lose transitive peers depending on traversal order #5108.
  - eba03e0: Fix pnpm install reporting "Already up to date"
    after a catalog entry in pnpm-workspace.yaml was reverted to
    a previous version. After an update modified a catalog, the
    workspace state cache stored the pre-update catalog versions,
    so reverting the entry back to its original version was not
    detected as an outdated state #12418.
  - 3b54d79: pnpm update now keeps lockfile overrides that
    resolve through a catalog in sync with the catalog.
    Previously, when an override referenced a catalog (e.g.
    overrides: { foo: 'catalog:' }) and pnpm update bumped that
    catalog entry, the lockfile's catalogs advanced while the
    resolved overrides kept the old version. The resulting
    lockfile was internally inconsistent, so a later pnpm install
  - -frozen-lockfile failed with
    ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
  - 9d0a300: Fixed pnpm version --recursive so it honors the
    workspace selection. In recursive mode the version bump now
    applies to the packages resolved from the workspace filter
    (selectedProjectsGraph), matching the behavior of pnpm
    publish --recursive, instead of always bumping every
    workspace package #11348.
  - update to 11.7:
    * Minor Changes
  - Added a new setting frozenStore (--frozen-store) that lets
    pnpm install run against a package store on a read-only
    filesystem (e.g. a Nix store, a read-only bind mount, an OCI
    layer). When enabled, pnpm opens the store's SQLite index.db
    through the immutable=1 URI — bypassing the WAL/-shm sidecar
    creation that otherwise fails on a read-only directory — and
    suppresses every store-write path (the index.db writer and
    the project-registry write). Pair it with --offline
  - -frozen-lockfile against a fully-populated store. Under the
    global virtual store, package directories live inside the
    store, so if the store is missing the build output of a
    package whose lifecycle scripts are approved (or that has a
    patch), pnpm fails up front with
    ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing
    mid-build on a read-only write — seed the store with those
    builds first. Incompatible with --force and with a configured
    pnpr server, since both write into the store; the
    side-effects cache is likewise not written under frozenStore.
    If the store is missing its content directory, the install
    fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than
    attempting to initialize it. The read-only immutable=1 open
    requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older
    runtimes --frozen-store fails with a clear
    ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking
    also tolerates a read-only store: under the global virtual
    store a package's bin source lives inside the store, so the
    chmod that makes it executable would be refused — with
    EPERM/EACCES, or with EROFS on a genuinely read-only
    filesystem. That chmod is redundant when the seed already
    ships its bins executable with a normalized shebang, so it is
    now skipped in that case, while a non-executable bin (or one
    still carrying a Windows CRLF shebang) on a read-only store
    still errors.
  - When pacquet (the Rust port of pnpm) is declared in
    configDependencies, pnpm now delegates dependency resolution
    to it too — not just materialization — provided the installed
    pacquet is new enough to support full resolving installs (>=
    0.11.7).
    Previously pacquet only ran in frozen-install mode: pnpm
    always resolved the dependency graph itself (writing
    pnpm-lock.yaml) and handed pacquet a finished lockfile to
    fetch / import / link. With pacquet >= 0.11.7, a non-frozen
    pnpm install (default isolated nodeLinker, plain install) is
    delegated to pacquet end-to-end in a single pass — pacquet
    resolves the manifests, writes the lockfile, and materializes
    node_modules. pnpm detects the capability from the installed
    pacquet's version; older pacquet releases keep the
    resolve-then-materialize split, and add / update / remove
    still resolve in pnpm (it has to mutate the manifests first).
    This remains an opt-in preview of the Rust install engine
    [#11723].
  - Added a new opt-in --batch flag to pnpm publish --recursive
    that sends all selected packages to the registry in a single
    PUT /-/pnpm/v1/publish request instead of one request per
    package. The target registry has to implement the batch
    publish endpoint (pnpr does); registries that don't are
    reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED
    error. The batch is processed all-or-nothing by pnpr: if any
    package in the batch fails validation, none of the packages
    are published.
    * Patch Changes
  - Reject path-traversal and reserved dependency aliases (such
    as ../../../escape, .bin, .pnpm, or node_modules) that come
    from a lockfile rather than a freshly resolved manifest. A
    crafted lockfile alias could otherwise be joined directly
    under a hoisted node_modules directory, letting package files
    be written outside the intended install root or overwrite
    pnpm-owned layout.
    The fix adds two layers:
  - The nodeLinker: hoisted graph builder now validates each
    alias at the directory sink (safeJoinModulesDir), matching
    the validation pnpm already performs when resolving aliases
    from manifests.
  - The lockfile verification gate (verifyLockfileResolutions)
    now runs an always-on, policy-independent check that
    rejects any importer or snapshot dependency alias that is
    not a valid package name, failing the install early —
    before any fetch or filesystem work — for every node linker
    at once.
  - Made shared package child resolution deterministic when the
    same package is reached through multiple contexts. pnpm now
    chooses the shallowest occurrence, then importer order, then
    parent path, instead of letting request timing decide the
    child context and missing-peer report pnpm/pnpm#12358.
  - Fix garbled summary line after submitting pnpm update -i and
    pnpm audit --fix -i. The interactive checkbox prompt
    previously printed every selected choice's full table row
    (label, current/target versions, workspace, URL) joined by
    commas, producing a wall of text after pressing Enter. The
    summary now lists only the selected package names (or
    vulnerability keys) by setting an explicit short per choice;
    the in-progress selection UI is unchanged.
  - Prevent pnpm patch-remove from removing files outside the
    configured patches directory.
  - Fixed pnpm publish ignoring strictSsl: false when publishing
    to registries with self-signed certificates. The strictSSL
    option is now forwarded to libnpmpublish / npm-registry-fetch
    so that strict-ssl=false in .npmrc or strictSsl: false in
    pnpm-workspace.yaml is respected during publish, the same way
    it is for pnpm install pnpm/pnpm#12012.
  - Fixed Cannot destructure property 'manifest' of
    'manifestsByPath[rootDir]' as it is undefined regression
    introduced in 11.6.0 when running pnpm add <pkg> outside a
    workspace on Windows. selectProjectByDir was keying the
    resulting ProjectsGraph by opts.dir instead of
    project.rootDir, so downstream manifestsByPath lookups missed
    when the two paths normalized differently (typically
    drive-letter casing). pnpm/pnpm#12379
  - Git dependencies that point to a subdirectory of a repository
    (repo#commit&path:/sub/dir) keep their path in the lockfile
    again. Since the integrity of git-hosted tarballs started
    being pinned in the lockfile, any install that actually
    downloaded the tarball rebuilt the lockfile resolution as {
    integrity, tarball, gitHosted } and dropped the path field,
    while installs served from the store kept it — so the field
    disappeared seemingly at random. Without path, later installs
    from that lockfile silently unpacked the repository root
    instead of the subdirectory #12304.
  - Fixed nondeterministic lockfile output that made pnpm dedupe
  - -check fail intermittently in CI. When a locked peer
    provider was pinned for a dependency that has no child
    dependencies of its own, the pinned provider leaked into the
    shared parent scope, so siblings resolved after it could pick
    up an optional peer they should not see. Which siblings were
    affected depended on resolution order, which varies with
    network timing.
  - Sped up pnpm install with a frozen lockfile by running
    lockfile verification (the policy revalidation gate added for
    minimumReleaseAge/trustPolicy and the tarball-URL anti-tamper
    check) concurrently with fetching and linking instead of
    blocking the whole install on it. Dependency lifecycle
    scripts are still held back until verification succeeds, so
    no script runs on an unverified lockfile: if verification
    fails the install aborts before any dependency build, and if
    linking finishes first the install waits for the verification
    verdict before completing.
  - User-defined npm_config_* environment variables are now
    preserved during lifecycle script execution. Previously, all
    npm_-prefixed env vars were stripped, which caused user-set
    variables like npm_config_platform_arch to be lost
    pnpm/pnpm#12399.
  - pnpm can now use different auth tokens for different package
    scopes, even when those scopes use the same registry URL.
    Previously, auth was selected only by registry URL. If @org-a
    and @org-b both used https://npm.pkg.github.com/, they had to
    share the same token. This caused problems for registries
    that issue tokens per organization or per scope.
    Configure a scope-specific token by adding the package scope
    after the registry URL in the auth key:
    @org-a:registry=https://npm.pkg.github.com/
    @org-b:registry=https://npm.pkg.github.com/
    //npm.pkg.github.com/:@org-a:_authToken=${ORG_A_TOKEN}
    //npm.pkg.github.com/:@org-b:_authToken=${ORG_B_TOKEN}
    //npm.pkg.github.com/:_authToken=${FALLBACK_TOKEN}
    pnpm login --registry=https://npm.pkg.github.com --scope=@org-a
    writes the token to the same scope-specific auth key.
    When installing or publishing @org-a/*, pnpm uses
    ORG_A_TOKEN. For @org-b/*, pnpm uses ORG_B_TOKEN. Packages
    without a matching scope continue to use the registry-wide
    fallback token.
  - pnpm setup no longer prompts to approve build scripts for
    @pnpm/exe when installing the standalone executable. pnpm
    links the platform-specific binary itself, so the package's
    install scripts are skipped during the global self-install
    [#12377].
  - Close lockfile reads deterministically before rewriting
    lockfiles and keep pacquet's virtual store directory length
    aligned with pnpm on Windows.
  - A 304 Not Modified answer from the registry now renews the
    cached metadata file's mtime, so the minimumReleaseAge
    freshness shortcut keeps serving resolutions from the cache.
    Previously, once a cached packument grew older than
    minimumReleaseAge, every subsequent install re-validated it
    against the registry forever, because a 304 never rewrites
    the file.
  - Updated dependency ranges. Notably:
  - @pnpm/logger peer dependency range moved to ^1100.0.0.
  - msgpackr 1.11.8 → 2.0.4 (store index files remain
    byte-compatible in both directions).
  - open ^7.4.2 → ^11.0.0, memoize ^10 → ^11, cli-truncate ^5 →
    ^6, pidtree ^0.6 → ^1.
  - @yarnpkg/core 4.5.0 → 4.8.0, @rushstack/worker-pool 0.7.7 →
    0.7.18, @cyclonedx/cyclonedx-library 10.0.0 → 10.1.0,
    @pnpm/config.nerf-dart ^1 → ^2, @pnpm/log.group 3.0.2 →
    4.0.1, @pnpm/util.lex-comparator ^3 → ^4.
  - Updated @zkochan/cmd-shim to v9.0.6.
  - Fixed a Windows-only hang where a failed command could take
    20–46 seconds to exit. On error, pnpm enumerates descendant
    processes (via pidtree) to terminate them, which on Windows
    shells out to wmic/PowerShell Get-CimInstance Win32_Process —
    a lookup that is extremely slow on some machines. The lookup
    is now bounded by a short timeout so it can no longer stall
    the process exit.

++++ python-awkward:

  - update to 2.9.1:
    * feat: improve and test big-endian support
    * feat: implement array compatibility/interface protocols for
    virtual array and placeholder array (for better errors)
    * feat: reimplement reducers kernels using cccl
    * feat: implement byteswap as an nplike function
    * feat: lazy parents allocation
    * feat: extend Python reducers with `offset` support (precursor
    to `parent` removal)
    * feat: pass 'offsets' to reducer kernels (precursor to parent
    removal)
    * feat: reducer max for `axis==None`
    * feat: improve and fix delayed length calculations and add
    delayed length calculation for layouts that need it
    * feat: pickle in native byteorder and pass byteorder through
    pickling and unpickling
    * feat: customly overload the reducers that call cuda-compute
    kernels
    * feat: add `axis=None` specialization for `Min` reducer +
    small refactoring for existing specializatons
    * feat: cuda.compute combinations kernel study
    * feat: add `missing_repeat` kernel implementation using
    cuda.compute
    * feat: add `index_rpad_and_clip` kernels implementations using
    cuda.compute
    * feat: allow generator expressions in highlevel operations
    that accept iterable of arrays as input
    * feat: add awkward.* aliases to objects.inv for intersphinx
    * feat: properly handle numpy functions that return default
    containers of numpy arrays in `__array_function__`
    * feat: lazy concatenation of virtual arrays
    * feat: migrate awkward_index_rpad_and_clip_axis0 to
    cuda.compute
    * feat: migrate awkward_reduce_sum_complex to cuda.compute
    * feat: migrate awkward_reduce_max_complex to cuda.compute
    * ## Bug-fixes and performance
    * fix: temporarily use unary_transform instead of
    segmented_reduce
    * fix: C++ errors in `ak.from_rdataframe`
    * fix: Fix multiple CUDA out-of-bounds accesses and kernel
    memory management issues
    * fix: harden CUDA/CPU kernels against out-of-bounds writes in
    `ListOffsetArray`
    * fix: add offsets for UnmaskedArray reducer
    * fix: GrowableBuffer cleanup compiler warnings
    * fix: fix typetracer's `maximum` implementation
    * fix: fix ASAN detected buffer overflows in awkward-cpp
    * fix: Numba-CUDA refactoring -- `CUDATargetContext` is spinned
    off to `FunctionDescriptor`
    * fix: return shallow copy of fields list when `.fields` is
    being accessed from highlevel array/record
    * fix: handle union array simplification returning back indexed
    arrays in `ak.almost_equal`
    * fix: `ak.array_equal` with datetimes and timedeltas with NaTs
    * fix: consistent byteorder settings
    * fix: couple of fixes in tests that arose from running them in
    parallel threads
    * fix: proper comparison in `ak.almost_equal` between record
    array fields
    * fix: restore docstring cross-references lost in autoapi
    migration
    * fix: race condition in record array CUDA kernel
    * fix: ensure jax backend uses arrays on cpu only
    * fix: array attrs not being validated at creation and being of
    inconsistent type
    * perf: optimize CPU kernels and fix segfault when
    concatenating arrays with None values
    * perf: restructure CUDA unit tests

++++ python-bokeh:

  - update to 3.9.1:
    * Document().to_json() is not JSON serializable
    * [component: docs] Dev docs no longer report precise
    version information
    * range_padding of y_range is not updated when changed
    via CustomJS
    * [component: bokehjs] Invert Colorbar Axis
    * [component: bokehjs] Cannot update min_border of
    figure with CustomJS callback
    * [component: bokehjs] BoxAnnotation shows resize
    cursor by default
    * [component: bokehjs] vline hover misses some multi-
    lines
    * [BUG] Using array/list in line_dash for hspan
    doesn't work
    * [component: bokehjs] [BUG] Incorrectly formatted
    ticks with %N format when time is older than the Epoch
    * [component: bokehjs] [bokeh-3.8.0.min.js:405]
    Uncaught (in promise) RangeError: Maximum call stack size
    exceeded
    * [component: bokehjs] Legends are not synced with
    glyph visibility state
    * [component: bokehjs] Possible regression in muting
    of legend entries since v3.7.0
    * [component: bokehjs] Patches hover tooltip triggers
    inside holes (hit-testing doesn't account for NaN-separated
    holes)
    * [component: bokehjs] Canvas Patch fill doesn't
    respect holes (nonzero fill rule instead of evenodd)
    * [component: bokehjs] Bokeh plot frame height does
    not update when changed via slider
    * [component: bokehjs] Update of num_minor_ticks does
    not trigger a visual update of the plot
    * `NaT` is encoded as `float(nan)` by the serializer
    * 15116 [component: docs] Documentation of enums is broken
    in 3.10 branch
    * [component: build] Release build failed for non pre-

++++ python-cucumber-expressions:

  - update to 20.0.0:
    * [JavaScript] BREAKING CHANGE: Switch to ESM
    * [.Net] Downgrade dependency fluentassertions to 7.2.0

++++ python-django-allauth:

  - update to 65.18.0:
    * The password2 (password confirmation) field on the
    set/change/reset password forms now carries
    autocomplete="new-password", matching password1. This allows
    browser and password manager "suggest strong password"
    features to fill both fields as a pair.
    * IdP: Added support for Dynamic Client Registration.
    * IdP: Added support for client_secret_basic.
    * IdP: Added support for Resource Indicators (RFC 8707).
    * IdP: The .well-known/openid-configuration endpoint previously
    derived response_types_supported and grant_types_supported
    from configured clients. Per RFC 8414, these fields should
    reflect server capabilities, not the configuration of
    existing clients. They are now statically derived.
    Additionally, scopes_supported is now included. Use the new
    populate_server_metadata() adapter method to customize the
    metadata.
    * Added new socialaccount provider: Klaviyo.
    * Rate limiting now truncates IPv6 addresses to their network
    prefix (default /64) to prevent bypass via address rotation.
    Configurable via ALLAUTH_RATE_LIMIT_IPV6_PREFIX.
    * Added authenticate_by_email hook to
    DefaultSocialAccountAdapter, allowing customization of user
    lookup and email matching during social login.
    * BitBucket: When using the BitBucket API, the token is passed
    in the headers instead of the query parameters, which no
    longer works since May 4th, 2026 (deprecation notice).

++++ python-django-environ:

  - update to 0.14.0:
    * Added type annotations and matching docstring information to
    Env methods #633.
    * Added a Python 3.9 compatibility dependency on
    typing_extensions for TypeAlias #633.
    * Updated Env.read_env() to accept path-like and file-like
    objects without closing file-like objects supplied by the
    caller #633.
    * Added an explicit error when Env.read_env() cannot determine
    its caller frame while resolving the default .env path #633.

++++ python-django-haystack:

  - update to 3.4.0:
    * Remove obsolete ElasticSearch2 support and tests
    * Add Django v5.1 to the testing
    * GitHub Actions: Add Python 3.13 to the testing
    * Fix typo.
    * Fix RelatedSearchQueryset.load_all() truncating results
    * [FIXED] -- handle trailing slash in Solr index URL for core
    reload.
    * Bump the github-actions group with 2 updates
    * Update license field to use proper SPDX identifier
    * dev: Update Python dependencies
    * dev: Update django
    * fix: handle HEAD requests like GET in generic_views
    * feat: Add requires-python to pyproject.toml (PEP 621)
    * Add Python 3.14 and 3.14t to the testing
    * Fix race condition in ConnectionRouter.routers lazy
    initialization
    * add postgres backend to backend_support.rst
    * Actions: limit permissions for tests
    * GitHub Actions: zizmor fixes

++++ python-django-js-asset:

  - update to 4.0.1:
    * Added js_asset.Media, a django.forms.Media subclass with two
    extra abilities.
    * JS and CSS now produce Django's own Script and Stylesheet
    objects (backported via js_asset._compat on Django versions
    that lack them) instead of being standalone dataclasses
    * Script, Stylesheet, MediaAsset and InlineStyle can now be
    imported from js_asset
    * Equality now follows Django's own contract: identity is
    attribute-aware on Django 4.2–5.1 and 6.2+,
    * Added a static_lazy helper (a lazy wrapper around static()
    * Removed the global importmap object

++++ python-fastavro:

  - update to 1.12.2:
    * Publish wheels for Windows ARM64 (@Harishmcw)

++++ python-jsonrpclib-pelix:

  - update to 1.1.0:
    * Fixed access to error message in results
    * Allow the request query ID to be set to 0 or empty string
    * Allow the definition of a classes registry to restrict
    dynamic imports
    * Allow the definition of a maximum content length to reject
    large requests
    * Overall code review
    * Disable `cjson` and `simplejson` tests on Python 3.15
    * Added note on expected Pydantic test failure on Python 2.7

++++ python-opentelemetry-exporter-otlp:

  - update to 1.42.1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
    * ### Fixed
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending
    on the available trace id generator.
  - update to 1.42.0:
    * ### Added
    * `opentelemetry-api`, `opentelemetry-sdk`: add support for
    'random-trace-id' flags in W3C traceparent header trace
    flags. Implementations of `IdGenerator` that do randomly
    generate the 56 least significant bits, should also implement
    a `is_trace_id_random` methods that returns `True`.
    * logs: add exception support to Logger emit and LogRecord
    attributes
    * `opentelemetry-exporter-otlp-proto-grpc`: make retryable gRPC
    error codes configurable for gRPC exporters
    * `opentelemetry-sdk`: Add
    `create_logger_provider`/`configure_logger_provider` to
    declarative file configuration, enabling LoggerProvider
    instantiation from config files without reading env vars
    * `opentelemetry-exporter-otlp-json-common`: add
    'opentelemetry-exporter-otlp-json-common' package for OTLP
    JSON exporters
    * `opentelemetry-sdk`: Add `service` resource detector support
    to declarative file configuration via
    `detection_development.detectors[].service`
    * `opentelemetry-docker-tests`: add docker-tests coverage of
    `opentelemetry-exporter-otlp-proto-grpc` and `opentelemetry-
    exporter-otlp-proto-http` metrics export
    * Add `registry` keyword argument to `PrometheusMetricReader`
    to allow passing a custom Prometheus registry
    * Add WeaverLiveCheck test util
    * `opentelemetry-sdk`: add `load_entry_point` shared utility to
    declarative file configuration for loading plugins via entry
    points; refactor propagator loading to use it
    * `opentelemetry-sdk`: add sampler plugin loading to
    declarative file configuration via the
    `opentelemetry_sampler` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add propagator plugin loading to
    declarative file configuration via the
    `opentelemetry_propagator` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add exporter plugin loading to
    declarative file configuration for all three signals (traces,
    metrics, logs) via the `opentelemetry_*_exporter` entry point
    groups, matching the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add generic resource detector plugin
    loading to declarative file configuration via the
    `opentelemetry_resource_detector` entry point group, matching
    the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add `additional_properties` support to
    generated config models via custom `datamodel-codegen`
    template, enabling plugin/custom component names to flow
    through typed dataclasses
    * Add ability to selectively enable exporting of SDK internal
    metrics with the `OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED`
    environment variable.
    * ### Changed
    * `opentelemetry-semantic-conventions`: use `X | Y` union
    annotation
    * `opentelemetry-api`: update `EnvironmentGetter` and
    `EnvironmentSetter` to use normalized environment variable
    names
    * Apply fixes for `UP` ruff rule
    * `opentelemetry-sdk`: only load entrypoints for resource
    detectors if they are configured via
    `OTEL_EXPERIMENTAL_RESOURCE_DETECTORS`
    * ci: wait for tracecontext server readiness instead of a fixed
    sleep in `scripts/tracecontext-integration-test.sh`
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-semantic-conventions`: Bump semantic
    conventions to 1.41.1, this changes the metrics name of
    `K8S_CONTAINER_CPU_LIMIT_UTILIZATION` and
    `K8S_CONTAINER_CPU_REQUEST_UTILIZATION`.
    * ### Removed
    * `opentelemetry-api`: remove third-party importlib-metadata in
    favor of standard library since Python >= 3.10 is now
    required
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-sdk`: Allow declarative OTLP HTTP exporters to
    map `compression: deflate` instead of rejecting it as
    unsupported.
    * Fix incorrect code example in `create_tracer()` docstring
    * `opentelemetry-sdk`: Fix `ProcessResourceDetector` to use
    `sys.orig_argv` so that `process.command`,
    `process.command_line`, and `process.command_args` reflect
    the original invocation for `python -m ` runs (where
    `sys.argv[0]` is rewritten to the module path)
    * `opentelemetry-sdk`: fix YAML structure injection via
    environment variable substitution in declarative file
    configuration; values containing newlines are now emitted as
    quoted YAML scalars per spec requirement
    * `opentelemetry-sdk`: Fix mutable attributes reference in
    metrics, attributes passed to instrument `add`/`record` are
    now copied so that subsequent mutations do not affect
    recorded data points
    * `opentelemetry-sdk`: make resource detector ordering
    deterministic
    * Fix incorrect type annotation on `detectors` parameter of
    `get_aggregated_resources`
    * `opentelemetry-api`: Enforce W3C Baggage size limits on
    outbound propagation in `W3CBaggagePropagator.inject()`.
    Previously only inbound extraction enforced limits; now
    inject also caps entries at 180, individual pairs at 4096
    bytes, and total header at 8192 bytes per the W3C Baggage
    spec. The extract path max_pairs limit now counts all size-
    valid entries rather than only successfully parsed ones.
    * `opentelemetry-sdk`: fix multi-processor `force_flush`
    skipping remaining processors when one returns `None`
    * `opentelemetry-test-utils`: fix weaver live check hanging
    when weaver log output fills the pipe buffer

++++ python-opentelemetry-exporter-otlp-proto-common:

  - update to 1.42.1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
    * ### Fixed
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending
    on the available trace id generator.
  - update to 1.42.0:
    * ### Added
    * `opentelemetry-api`, `opentelemetry-sdk`: add support for
    'random-trace-id' flags in W3C traceparent header trace
    flags. Implementations of `IdGenerator` that do randomly
    generate the 56 least significant bits, should also implement
    a `is_trace_id_random` methods that returns `True`.
    * logs: add exception support to Logger emit and LogRecord
    attributes
    * `opentelemetry-exporter-otlp-proto-grpc`: make retryable gRPC
    error codes configurable for gRPC exporters
    * `opentelemetry-sdk`: Add
    `create_logger_provider`/`configure_logger_provider` to
    declarative file configuration, enabling LoggerProvider
    instantiation from config files without reading env vars
    * `opentelemetry-exporter-otlp-json-common`: add
    'opentelemetry-exporter-otlp-json-common' package for OTLP
    JSON exporters
    * `opentelemetry-sdk`: Add `service` resource detector support
    to declarative file configuration via
    `detection_development.detectors[].service`
    * `opentelemetry-docker-tests`: add docker-tests coverage of
    `opentelemetry-exporter-otlp-proto-grpc` and `opentelemetry-
    exporter-otlp-proto-http` metrics export
    * Add `registry` keyword argument to `PrometheusMetricReader`
    to allow passing a custom Prometheus registry
    * Add WeaverLiveCheck test util
    * `opentelemetry-sdk`: add `load_entry_point` shared utility to
    declarative file configuration for loading plugins via entry
    points; refactor propagator loading to use it
    * `opentelemetry-sdk`: add sampler plugin loading to
    declarative file configuration via the
    `opentelemetry_sampler` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add propagator plugin loading to
    declarative file configuration via the
    `opentelemetry_propagator` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add exporter plugin loading to
    declarative file configuration for all three signals (traces,
    metrics, logs) via the `opentelemetry_*_exporter` entry point
    groups, matching the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add generic resource detector plugin
    loading to declarative file configuration via the
    `opentelemetry_resource_detector` entry point group, matching
    the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add `additional_properties` support to
    generated config models via custom `datamodel-codegen`
    template, enabling plugin/custom component names to flow
    through typed dataclasses
    * Add ability to selectively enable exporting of SDK internal
    metrics with the `OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED`
    environment variable.
    * ### Changed
    * `opentelemetry-semantic-conventions`: use `X | Y` union
    annotation
    * `opentelemetry-api`: update `EnvironmentGetter` and
    `EnvironmentSetter` to use normalized environment variable
    names
    * Apply fixes for `UP` ruff rule
    * `opentelemetry-sdk`: only load entrypoints for resource
    detectors if they are configured via
    `OTEL_EXPERIMENTAL_RESOURCE_DETECTORS`
    * ci: wait for tracecontext server readiness instead of a fixed
    sleep in `scripts/tracecontext-integration-test.sh`
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-semantic-conventions`: Bump semantic
    conventions to 1.41.1, this changes the metrics name of
    `K8S_CONTAINER_CPU_LIMIT_UTILIZATION` and
    `K8S_CONTAINER_CPU_REQUEST_UTILIZATION`.
    * ### Removed
    * `opentelemetry-api`: remove third-party importlib-metadata in
    favor of standard library since Python >= 3.10 is now
    required
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-sdk`: Allow declarative OTLP HTTP exporters to
    map `compression: deflate` instead of rejecting it as
    unsupported.
    * Fix incorrect code example in `create_tracer()` docstring
    * `opentelemetry-sdk`: Fix `ProcessResourceDetector` to use
    `sys.orig_argv` so that `process.command`,
    `process.command_line`, and `process.command_args` reflect
    the original invocation for `python -m ` runs (where
    `sys.argv[0]` is rewritten to the module path)
    * `opentelemetry-sdk`: fix YAML structure injection via
    environment variable substitution in declarative file
    configuration; values containing newlines are now emitted as
    quoted YAML scalars per spec requirement
    * `opentelemetry-sdk`: Fix mutable attributes reference in
    metrics, attributes passed to instrument `add`/`record` are
    now copied so that subsequent mutations do not affect
    recorded data points
    * `opentelemetry-sdk`: make resource detector ordering
    deterministic
    * Fix incorrect type annotation on `detectors` parameter of
    `get_aggregated_resources`
    * `opentelemetry-api`: Enforce W3C Baggage size limits on
    outbound propagation in `W3CBaggagePropagator.inject()`.
    Previously only inbound extraction enforced limits; now
    inject also caps entries at 180, individual pairs at 4096
    bytes, and total header at 8192 bytes per the W3C Baggage
    spec. The extract path max_pairs limit now counts all size-
    valid entries rather than only successfully parsed ones.
    * `opentelemetry-sdk`: fix multi-processor `force_flush`
    skipping remaining processors when one returns `None`
    * `opentelemetry-test-utils`: fix weaver live check hanging
    when weaver log output fills the pipe buffer

++++ python-opentelemetry-exporter-otlp-proto-grpc:

  - update to 1.42.1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
    * ### Fixed
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending
    on the available trace id generator.
  - update to 1.42.0:
    * ### Added
    * `opentelemetry-api`, `opentelemetry-sdk`: add support for
    'random-trace-id' flags in W3C traceparent header trace
    flags. Implementations of `IdGenerator` that do randomly
    generate the 56 least significant bits, should also implement
    a `is_trace_id_random` methods that returns `True`.
    * logs: add exception support to Logger emit and LogRecord
    attributes
    * `opentelemetry-exporter-otlp-proto-grpc`: make retryable gRPC
    error codes configurable for gRPC exporters
    * `opentelemetry-sdk`: Add
    `create_logger_provider`/`configure_logger_provider` to
    declarative file configuration, enabling LoggerProvider
    instantiation from config files without reading env vars
    * `opentelemetry-exporter-otlp-json-common`: add
    'opentelemetry-exporter-otlp-json-common' package for OTLP
    JSON exporters
    * `opentelemetry-sdk`: Add `service` resource detector support
    to declarative file configuration via
    `detection_development.detectors[].service`
    * `opentelemetry-docker-tests`: add docker-tests coverage of
    `opentelemetry-exporter-otlp-proto-grpc` and `opentelemetry-
    exporter-otlp-proto-http` metrics export
    * Add `registry` keyword argument to `PrometheusMetricReader`
    to allow passing a custom Prometheus registry
    * Add WeaverLiveCheck test util
    * `opentelemetry-sdk`: add `load_entry_point` shared utility to
    declarative file configuration for loading plugins via entry
    points; refactor propagator loading to use it
    * `opentelemetry-sdk`: add sampler plugin loading to
    declarative file configuration via the
    `opentelemetry_sampler` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add propagator plugin loading to
    declarative file configuration via the
    `opentelemetry_propagator` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add exporter plugin loading to
    declarative file configuration for all three signals (traces,
    metrics, logs) via the `opentelemetry_*_exporter` entry point
    groups, matching the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add generic resource detector plugin
    loading to declarative file configuration via the
    `opentelemetry_resource_detector` entry point group, matching
    the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add `additional_properties` support to
    generated config models via custom `datamodel-codegen`
    template, enabling plugin/custom component names to flow
    through typed dataclasses
    * Add ability to selectively enable exporting of SDK internal
    metrics with the `OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED`
    environment variable.
    * ### Changed
    * `opentelemetry-semantic-conventions`: use `X | Y` union
    annotation
    * `opentelemetry-api`: update `EnvironmentGetter` and
    `EnvironmentSetter` to use normalized environment variable
    names
    * Apply fixes for `UP` ruff rule
    * `opentelemetry-sdk`: only load entrypoints for resource
    detectors if they are configured via
    `OTEL_EXPERIMENTAL_RESOURCE_DETECTORS`
    * ci: wait for tracecontext server readiness instead of a fixed
    sleep in `scripts/tracecontext-integration-test.sh`
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-semantic-conventions`: Bump semantic
    conventions to 1.41.1, this changes the metrics name of
    `K8S_CONTAINER_CPU_LIMIT_UTILIZATION` and
    `K8S_CONTAINER_CPU_REQUEST_UTILIZATION`.
    * ### Removed
    * `opentelemetry-api`: remove third-party importlib-metadata in
    favor of standard library since Python >= 3.10 is now
    required
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-sdk`: Allow declarative OTLP HTTP exporters to
    map `compression: deflate` instead of rejecting it as
    unsupported.
    * Fix incorrect code example in `create_tracer()` docstring
    * `opentelemetry-sdk`: Fix `ProcessResourceDetector` to use
    `sys.orig_argv` so that `process.command`,
    `process.command_line`, and `process.command_args` reflect
    the original invocation for `python -m ` runs (where
    `sys.argv[0]` is rewritten to the module path)
    * `opentelemetry-sdk`: fix YAML structure injection via
    environment variable substitution in declarative file
    configuration; values containing newlines are now emitted as
    quoted YAML scalars per spec requirement
    * `opentelemetry-sdk`: Fix mutable attributes reference in
    metrics, attributes passed to instrument `add`/`record` are
    now copied so that subsequent mutations do not affect
    recorded data points
    * `opentelemetry-sdk`: make resource detector ordering
    deterministic
    * Fix incorrect type annotation on `detectors` parameter of
    `get_aggregated_resources`
    * `opentelemetry-api`: Enforce W3C Baggage size limits on
    outbound propagation in `W3CBaggagePropagator.inject()`.
    Previously only inbound extraction enforced limits; now
    inject also caps entries at 180, individual pairs at 4096
    bytes, and total header at 8192 bytes per the W3C Baggage
    spec. The extract path max_pairs limit now counts all size-
    valid entries rather than only successfully parsed ones.
    * `opentelemetry-sdk`: fix multi-processor `force_flush`
    skipping remaining processors when one returns `None`
    * `opentelemetry-test-utils`: fix weaver live check hanging
    when weaver log output fills the pipe buffer

++++ python-opentelemetry-exporter-otlp-proto-http:

  - update to 1.42.1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
    * ### Fixed
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending
    on the available trace id generator.
  - update to 1.42.0:
    * ### Added
    * `opentelemetry-api`, `opentelemetry-sdk`: add support for
    'random-trace-id' flags in W3C traceparent header trace
    flags. Implementations of `IdGenerator` that do randomly
    generate the 56 least significant bits, should also implement
    a `is_trace_id_random` methods that returns `True`.
    * logs: add exception support to Logger emit and LogRecord
    attributes
    * `opentelemetry-exporter-otlp-proto-grpc`: make retryable gRPC
    error codes configurable for gRPC exporters
    * `opentelemetry-sdk`: Add
    `create_logger_provider`/`configure_logger_provider` to
    declarative file configuration, enabling LoggerProvider
    instantiation from config files without reading env vars
    * `opentelemetry-exporter-otlp-json-common`: add
    'opentelemetry-exporter-otlp-json-common' package for OTLP
    JSON exporters
    * `opentelemetry-sdk`: Add `service` resource detector support
    to declarative file configuration via
    `detection_development.detectors[].service`
    * `opentelemetry-docker-tests`: add docker-tests coverage of
    `opentelemetry-exporter-otlp-proto-grpc` and `opentelemetry-
    exporter-otlp-proto-http` metrics export
    * Add `registry` keyword argument to `PrometheusMetricReader`
    to allow passing a custom Prometheus registry
    * Add WeaverLiveCheck test util
    * `opentelemetry-sdk`: add `load_entry_point` shared utility to
    declarative file configuration for loading plugins via entry
    points; refactor propagator loading to use it
    * `opentelemetry-sdk`: add sampler plugin loading to
    declarative file configuration via the
    `opentelemetry_sampler` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add propagator plugin loading to
    declarative file configuration via the
    `opentelemetry_propagator` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add exporter plugin loading to
    declarative file configuration for all three signals (traces,
    metrics, logs) via the `opentelemetry_*_exporter` entry point
    groups, matching the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add generic resource detector plugin
    loading to declarative file configuration via the
    `opentelemetry_resource_detector` entry point group, matching
    the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add `additional_properties` support to
    generated config models via custom `datamodel-codegen`
    template, enabling plugin/custom component names to flow
    through typed dataclasses
    * Add ability to selectively enable exporting of SDK internal
    metrics with the `OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED`
    environment variable.
    * ### Changed
    * `opentelemetry-semantic-conventions`: use `X | Y` union
    annotation
    * `opentelemetry-api`: update `EnvironmentGetter` and
    `EnvironmentSetter` to use normalized environment variable
    names
    * Apply fixes for `UP` ruff rule
    * `opentelemetry-sdk`: only load entrypoints for resource
    detectors if they are configured via
    `OTEL_EXPERIMENTAL_RESOURCE_DETECTORS`
    * ci: wait for tracecontext server readiness instead of a fixed
    sleep in `scripts/tracecontext-integration-test.sh`
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-semantic-conventions`: Bump semantic
    conventions to 1.41.1, this changes the metrics name of
    `K8S_CONTAINER_CPU_LIMIT_UTILIZATION` and
    `K8S_CONTAINER_CPU_REQUEST_UTILIZATION`.
    * ### Removed
    * `opentelemetry-api`: remove third-party importlib-metadata in
    favor of standard library since Python >= 3.10 is now
    required
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-sdk`: Allow declarative OTLP HTTP exporters to
    map `compression: deflate` instead of rejecting it as
    unsupported.
    * Fix incorrect code example in `create_tracer()` docstring
    * `opentelemetry-sdk`: Fix `ProcessResourceDetector` to use
    `sys.orig_argv` so that `process.command`,
    `process.command_line`, and `process.command_args` reflect
    the original invocation for `python -m ` runs (where
    `sys.argv[0]` is rewritten to the module path)
    * `opentelemetry-sdk`: fix YAML structure injection via
    environment variable substitution in declarative file
    configuration; values containing newlines are now emitted as
    quoted YAML scalars per spec requirement
    * `opentelemetry-sdk`: Fix mutable attributes reference in
    metrics, attributes passed to instrument `add`/`record` are
    now copied so that subsequent mutations do not affect
    recorded data points
    * `opentelemetry-sdk`: make resource detector ordering
    deterministic
    * Fix incorrect type annotation on `detectors` parameter of
    `get_aggregated_resources`
    * `opentelemetry-api`: Enforce W3C Baggage size limits on
    outbound propagation in `W3CBaggagePropagator.inject()`.
    Previously only inbound extraction enforced limits; now
    inject also caps entries at 180, individual pairs at 4096
    bytes, and total header at 8192 bytes per the W3C Baggage
    spec. The extract path max_pairs limit now counts all size-
    valid entries rather than only successfully parsed ones.
    * `opentelemetry-sdk`: fix multi-processor `force_flush`
    skipping remaining processors when one returns `None`
    * `opentelemetry-test-utils`: fix weaver live check hanging
    when weaver log output fills the pipe buffer

++++ python-opentelemetry-instrumentation:

  - update to 0.63b1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
  - update to 0.63b0:
    * ### Added
    * `opentelemetry-instrumentation`: Add experimental metrics
    attributes Labeler utility
    * `opentelemetry-instrumentation`: Register
    `OTEL_SEMCONV_STABILITY_OPT_IN` in `environment_variables.py`
    so `opentelemetry-instrument` exposes a
    `--semconv_stability_opt_in` CLI argument
    * Expand `AGENTS.md` with instrumentation/GenAI guidance and
    add PR review instructions.
    * `opentelemetry-instrumentation`: update auto-instrumentation
    to re-inject instrumentation path after init
    * ### Changed
    * Remove redundant `pylint: disable=attribute-defined-outside-
    init` comments and add rule to global `.pylintrc` disable
    list
    * Bump `pylint` to `4.0.5`
    * Switch to SPDX license headers and add CI enforcement
    * ### Removed
    * Drop Python 3.9 support

++++ python-opentelemetry-instrumentation-asgi:

  - update to 0.63b1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
  - update to 0.63b0:
    * ### Added
    * `opentelemetry-exporter-richconsole`: Add support for
    suppressing resource information
    * `opentelemetry-instrumentation`: Add experimental metrics
    attributes Labeler utility
    * `opentelemetry-instrumentation-logging`: Add
    `OTEL_PYTHON_LOG_HANDLER_LEVEL` and `OTEL_PYTHON_LOG_FORMAT`
    environment variables to configure the log level and
    formatter of the auto-instrumented `LoggingHandler`.
    * `opentelemetry-instrumentation-sqlite3`: Add uninstrument,
    error status, suppress, and no-op tests
    * Add `BaggageLogProcessor` to `opentelemetry-processor-
    baggage`
    * `opentelemetry-instrumentation-system-metrics`: Add support
    for `process.disk.io` metric in system-metrics
    instrumentation
    * `opentelemetry-instrumentation`: Register
    `OTEL_SEMCONV_STABILITY_OPT_IN` in `environment_variables.py`
    so `opentelemetry-instrument` exposes a
    `--semconv_stability_opt_in` CLI argument
    * Expand `AGENTS.md` with instrumentation/GenAI guidance and
    add PR review instructions.
    * `opentelemetry-instrumentation`: update auto-instrumentation
    to re-inject instrumentation path after init
    * `opentelemetry-instrumentation-dbapi`: Add Database client
    operation duration and returned rows metrics
    * ### Changed
    * Remove redundant `pylint: disable=attribute-defined-outside-
    init` comments and add rule to global `.pylintrc` disable
    list
    * Bump `pylint` to `4.0.5`
    * `opentelemetry-instrumentation-logging`: Use
    `LogRecord.getMessage()` to format and extract each log
    record's body text to more closely match the expected usage
    of the logging system. As a result, all OTel log record
    bodies are now always strings. Previously, if `LogRecord.msg`
    (which contains the format string) was set to a non-string
    object (e.g. `logger.warning(some_dict)`), the object was
    exported as-is to the OTLP body field. Now,
    `LogRecord.getMessage()` will convert it to to a string. If
    you are passing in non-strings as the format string argument
    and your backend is expecting them as-is, you will need to
    update accordingly.
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-instrumentation-{urllib,urllib3,requests}`:
    switch http mock library from abandoned httpretty to mocket
    * ### Removed
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-instrumentation-aiohttp-server`: Use
    `canonical` attribute of the `Resource` as a span name
    * Refactor unit tests to allow for population of the random
    trace id flag in the `traceparent` header
    * `opentelemetry-instrumentation-aws-lambda`: fix improper
    handling of header casing
    * `opentelemetry-instrumentation-flask`: Clean up environ keys
    in `_teardown_request` to prevent duplicate execution
    * `opentelemetry-instrumentation-celery`: Coerce non-string
    values to strings in `CeleryGetter.get()` to prevent
    `TypeError` in `TraceState.from_header()` when Celery request
    attributes contain ints
    * `opentelemetry-instrumentation-celery`: Coerce timelimit
    values to strings in `set_attributes_from_context()` to
    prevent mixed-type span attribute warning
    * `opentelemetry-instrumentation-fastapi`: Fix `FastAPI`
    instrumentation to correctly trace `BackgroundTasks` by
    wrapping their execution in a dedicated span, ensuring proper
    parent-child relationships and accurate trace timing
    * `opentelemetry-instrumentation-flask`: Stop reading the
    deprecated (from 3.1) `flask.__version__` attribute; resolve
    the Flask version via `importlib.metadata`
    * `opentelemetry-instrumentation-confluent-kafka`: Populate
    `server.address` and `server.port` span attributes from the
    producer/consumer `bootstrap.servers` config; previously
    `KafkaPropertiesExtractor.extract_bootstrap_servers` was
    defined but never called
    * `opentelemetry-instrumentation-dbapi` Use `ObjectProxy`
    instead of `BaseObjectProxy` for `TracedCursorProxy` to
    restore iterability with wrapt 2.x
    * `opentelemetry-instrumentation-pyramid`: add missing
    `http.response.status_code` in duration metrics for stable
    http semantic conventions
    * `opentelemetry-instrumentation-pika` Use `ObjectProxy`
    instead of `BaseObjectProxy` for `ReadyMessagesDequeProxy` to
    restore iterability with wrapt 2.x
    * `docker-tests`: Don't require sudo, debian based distro and
    MS SQL ODBC driver to run locally. Instead require docker and
    unixodbc
    * `opentelemetry-instrumentation-celery`: clear completed task
    ids from `task_id_to_start_time`
    * `opentelemetry-instrumentation-celery`: add null guards and
    type-safe helper handling around Celery context propagation
    internals
    * `opentelemetry-instrumentation-wsgi`: use `PATH_INFO` and
    `QUERY_STRING` for URL attributes instead of parsing
    `RAW_URI` or `REQUEST_URI`
    * `opentelemetry-instrumentation-mysqlclient`: Update unit
    tests to properly validate trace context trace flag values.
    * `opentelemetry-instrumentation-pika`: pass destination to
    `_enrich_span` instead of `task_name`
    * `opentelemetry-instrumentation-tornado`: reduce cardinality
    of span names and metrics attributes. This introduces a
    breaking change in the metrics attributes for the stable
    semantic convention by dropping the out of spec `url.query`
    and `url.path` attributes in favor of in-spec `http.route`.
    * `opentelemetry-instrumentation-confluent-kafka`: Declare
    `opentelemetry-semantic-conventions` as a direct dependency
    * `opentelemetry-instrumentation-pymssql`: Fix semconv
    stability migration for connection attributes (host, port,
    user) set in `wrapped_connection()` to respect
    `OTEL_SEMCONV_STABILITY_OPT_IN`. Note: `net.peer.port` is now
    emitted as `int` instead of `string` in default mode,
    aligning with other DB instrumentations.
    * Declare `opentelemetry-semantic-conventions` as a direct
    dependency for the aio-pika, logging, pika and system-metrics
    instrumentations, since each imports `opentelemetry.semconv`
    directly.
  - update to opentelemetry-instrumentation-google-genai==0.7b1:
    * This is a patch release on the previous 0.7b0 release, fixing
    the issue(s) below.
  - update to opentelemetry-util-genai==0.4b0:
    * Add `AgentInvocation` type with `invoke_agent` span lifecycle
    * Add metrics support for EmbeddingInvocation
    * Add support for workflow in genAI utils handler.
    * Enrich ToolCall type, breaking change: usage of ToolCall
    class renamed to ToolCallRequest
    * Add EmbeddingInvocation span lifecycle support
    * Populate schema_url on metrics
    * Add workflow invocation type to genAI utils
    * Check if upload works at startup in initializer of the
    `UploadCompletionHook`, instead of repeatedly failing on
    every upload (#4390).
    * Refactor public API: add factory methods (`start_inference`,
    `start_embedding`, `start_tool`, `start_workflow`) and
    invocation-owned lifecycle (`invocation.stop()` /
    `invocation.fail(exc)`); rename `LLMInvocation` →
    `InferenceInvocation` and `ToolCall` → `ToolInvocation`.
    Existing usages remain fully functional via deprecated
    aliases.
    * `TelemetryHandler` now accepts a `completion_hook` parameter
    and calls it after each LLM invocation, passing inputs,
    outputs, the active span, and the log record. Content capture
    is enabled automatically when a real hook is configured.
    * Add metrics to ToolInvocations
    * Wrap completion hooks loaded via `load_completion_hook` so
    exceptions raised by `on_completion` are logged and swallowed
    instead of propagating to instrumentation call sites.
  - update to opentelemetry-instrumentation-openai-v2==2.4b0:
    * Migrate experimental path from deprecated `LLMInvocation` to
    `InferenceInvocation`, using `handler.start_inference()` and
    `invocation.stop()`/`invocation.fail()` directly
    * Use `create_duration_histogram` and `create_token_histogram`
    from `opentelemetry-util-genai` instead of defining bucket
    boundaries locally
    * Import `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT`
    from `opentelemetry.util.genai.environment_variables` instead
    of re-defining it locally, making `opentelemetry-util-genai`
    the single source of truth for this constant.
    * Fix compatibility with wrapt 2.x by using positional
    arguments in `wrap_function_wrapper()` calls
    * Fix `ChoiceBuffer` crash on streaming tool-call deltas with
    `arguments=None`
    * Fix `StreamWrapper` missing `.headers` and other attributes
    when using `with_raw_response` streaming
    * Add opt-in support for latest experimental semantic
    conventions (v1.37.0). Set `OTEL_SEMCONV_STABILITY_OPT_IN` to
    `gen_ai_latest_experimental` to enable. Add dependency on
    `opentelemetry-util-genai` pypi package.
    * Add wrappers for OpenAI Responses API streams and response
    stream managers
    * Add async wrappers for OpenAI Responses API streams and
    response stream managers
    * Add strongly typed Responses API extractors with validation
    and content extraction improvements
    * Add completion hook support.
    * Fix `response_format` handling: map
    `json_object`/`json_schema` to `json` output type.
    * Skip attribute values with `openai.Omit` value.
    * Default empty string for `gen_ai.request.model` attribute on
    missing model.

++++ python-opentelemetry-instrumentation-fastapi:

  - update to 0.63b1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
  - update to 0.63b0:
    * ### Added
    * `opentelemetry-exporter-richconsole`: Add support for
    suppressing resource information
    * `opentelemetry-instrumentation`: Add experimental metrics
    attributes Labeler utility
    * `opentelemetry-instrumentation-logging`: Add
    `OTEL_PYTHON_LOG_HANDLER_LEVEL` and `OTEL_PYTHON_LOG_FORMAT`
    environment variables to configure the log level and
    formatter of the auto-instrumented `LoggingHandler`.
    * `opentelemetry-instrumentation-sqlite3`: Add uninstrument,
    error status, suppress, and no-op tests
    * Add `BaggageLogProcessor` to `opentelemetry-processor-
    baggage`
    * `opentelemetry-instrumentation-system-metrics`: Add support
    for `process.disk.io` metric in system-metrics
    instrumentation
    * `opentelemetry-instrumentation`: Register
    `OTEL_SEMCONV_STABILITY_OPT_IN` in `environment_variables.py`
    so `opentelemetry-instrument` exposes a
    `--semconv_stability_opt_in` CLI argument
    * Expand `AGENTS.md` with instrumentation/GenAI guidance and
    add PR review instructions.
    * `opentelemetry-instrumentation`: update auto-instrumentation
    to re-inject instrumentation path after init
    * `opentelemetry-instrumentation-dbapi`: Add Database client
    operation duration and returned rows metrics
    * ### Changed
    * Remove redundant `pylint: disable=attribute-defined-outside-
    init` comments and add rule to global `.pylintrc` disable
    list
    * Bump `pylint` to `4.0.5`
    * `opentelemetry-instrumentation-logging`: Use
    `LogRecord.getMessage()` to format and extract each log
    record's body text to more closely match the expected usage
    of the logging system. As a result, all OTel log record
    bodies are now always strings. Previously, if `LogRecord.msg`
    (which contains the format string) was set to a non-string
    object (e.g. `logger.warning(some_dict)`), the object was
    exported as-is to the OTLP body field. Now,
    `LogRecord.getMessage()` will convert it to to a string. If
    you are passing in non-strings as the format string argument
    and your backend is expecting them as-is, you will need to
    update accordingly.
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-instrumentation-{urllib,urllib3,requests}`:
    switch http mock library from abandoned httpretty to mocket
    * ### Removed
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-instrumentation-aiohttp-server`: Use
    `canonical` attribute of the `Resource` as a span name
    * Refactor unit tests to allow for population of the random
    trace id flag in the `traceparent` header
    * `opentelemetry-instrumentation-aws-lambda`: fix improper
    handling of header casing
    * `opentelemetry-instrumentation-flask`: Clean up environ keys
    in `_teardown_request` to prevent duplicate execution
    * `opentelemetry-instrumentation-celery`: Coerce non-string
    values to strings in `CeleryGetter.get()` to prevent
    `TypeError` in `TraceState.from_header()` when Celery request
    attributes contain ints
    * `opentelemetry-instrumentation-celery`: Coerce timelimit
    values to strings in `set_attributes_from_context()` to
    prevent mixed-type span attribute warning
    * `opentelemetry-instrumentation-fastapi`: Fix `FastAPI`
    instrumentation to correctly trace `BackgroundTasks` by
    wrapping their execution in a dedicated span, ensuring proper
    parent-child relationships and accurate trace timing
    * `opentelemetry-instrumentation-flask`: Stop reading the
    deprecated (from 3.1) `flask.__version__` attribute; resolve
    the Flask version via `importlib.metadata`
    * `opentelemetry-instrumentation-confluent-kafka`: Populate
    `server.address` and `server.port` span attributes from the
    producer/consumer `bootstrap.servers` config; previously
    `KafkaPropertiesExtractor.extract_bootstrap_servers` was
    defined but never called
    * `opentelemetry-instrumentation-dbapi` Use `ObjectProxy`
    instead of `BaseObjectProxy` for `TracedCursorProxy` to
    restore iterability with wrapt 2.x
    * `opentelemetry-instrumentation-pyramid`: add missing
    `http.response.status_code` in duration metrics for stable
    http semantic conventions
    * `opentelemetry-instrumentation-pika` Use `ObjectProxy`
    instead of `BaseObjectProxy` for `ReadyMessagesDequeProxy` to
    restore iterability with wrapt 2.x
    * `docker-tests`: Don't require sudo, debian based distro and
    MS SQL ODBC driver to run locally. Instead require docker and
    unixodbc
    * `opentelemetry-instrumentation-celery`: clear completed task
    ids from `task_id_to_start_time`
    * `opentelemetry-instrumentation-celery`: add null guards and
    type-safe helper handling around Celery context propagation
    internals
    * `opentelemetry-instrumentation-wsgi`: use `PATH_INFO` and
    `QUERY_STRING` for URL attributes instead of parsing
    `RAW_URI` or `REQUEST_URI`
    * `opentelemetry-instrumentation-mysqlclient`: Update unit
    tests to properly validate trace context trace flag values.
    * `opentelemetry-instrumentation-pika`: pass destination to
    `_enrich_span` instead of `task_name`
    * `opentelemetry-instrumentation-tornado`: reduce cardinality
    of span names and metrics attributes. This introduces a
    breaking change in the metrics attributes for the stable
    semantic convention by dropping the out of spec `url.query`
    and `url.path` attributes in favor of in-spec `http.route`.
    * `opentelemetry-instrumentation-confluent-kafka`: Declare
    `opentelemetry-semantic-conventions` as a direct dependency
    * `opentelemetry-instrumentation-pymssql`: Fix semconv
    stability migration for connection attributes (host, port,
    user) set in `wrapped_connection()` to respect
    `OTEL_SEMCONV_STABILITY_OPT_IN`. Note: `net.peer.port` is now
    emitted as `int` instead of `string` in default mode,
    aligning with other DB instrumentations.
    * Declare `opentelemetry-semantic-conventions` as a direct
    dependency for the aio-pika, logging, pika and system-metrics
    instrumentations, since each imports `opentelemetry.semconv`
    directly.
  - update to opentelemetry-instrumentation-google-genai==0.7b1:
    * This is a patch release on the previous 0.7b0 release, fixing
    the issue(s) below.
  - update to opentelemetry-util-genai==0.4b0:
    * Add `AgentInvocation` type with `invoke_agent` span lifecycle
    * Add metrics support for EmbeddingInvocation
    * Add support for workflow in genAI utils handler.
    * Enrich ToolCall type, breaking change: usage of ToolCall
    class renamed to ToolCallRequest
    * Add EmbeddingInvocation span lifecycle support
    * Populate schema_url on metrics
    * Add workflow invocation type to genAI utils
    * Check if upload works at startup in initializer of the
    `UploadCompletionHook`, instead of repeatedly failing on
    every upload (#4390).
    * Refactor public API: add factory methods (`start_inference`,
    `start_embedding`, `start_tool`, `start_workflow`) and
    invocation-owned lifecycle (`invocation.stop()` /
    `invocation.fail(exc)`); rename `LLMInvocation` →
    `InferenceInvocation` and `ToolCall` → `ToolInvocation`.
    Existing usages remain fully functional via deprecated
    aliases.
    * `TelemetryHandler` now accepts a `completion_hook` parameter
    and calls it after each LLM invocation, passing inputs,
    outputs, the active span, and the log record. Content capture
    is enabled automatically when a real hook is configured.
    * Add metrics to ToolInvocations
    * Wrap completion hooks loaded via `load_completion_hook` so
    exceptions raised by `on_completion` are logged and swallowed
    instead of propagating to instrumentation call sites.
  - update to opentelemetry-instrumentation-openai-v2==2.4b0:
    * Migrate experimental path from deprecated `LLMInvocation` to
    `InferenceInvocation`, using `handler.start_inference()` and
    `invocation.stop()`/`invocation.fail()` directly
    * Use `create_duration_histogram` and `create_token_histogram`
    from `opentelemetry-util-genai` instead of defining bucket
    boundaries locally
    * Import `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT`
    from `opentelemetry.util.genai.environment_variables` instead
    of re-defining it locally, making `opentelemetry-util-genai`
    the single source of truth for this constant.
    * Fix compatibility with wrapt 2.x by using positional
    arguments in `wrap_function_wrapper()` calls
    * Fix `ChoiceBuffer` crash on streaming tool-call deltas with
    `arguments=None`
    * Fix `StreamWrapper` missing `.headers` and other attributes
    when using `with_raw_response` streaming
    * Add opt-in support for latest experimental semantic
    conventions (v1.37.0). Set `OTEL_SEMCONV_STABILITY_OPT_IN` to
    `gen_ai_latest_experimental` to enable. Add dependency on
    `opentelemetry-util-genai` pypi package.
    * Add wrappers for OpenAI Responses API streams and response
    stream managers
    * Add async wrappers for OpenAI Responses API streams and
    response stream managers
    * Add strongly typed Responses API extractors with validation
    and content extraction improvements
    * Add completion hook support.
    * Fix `response_format` handling: map
    `json_object`/`json_schema` to `json` output type.
    * Skip attribute values with `openai.Omit` value.
    * Default empty string for `gen_ai.request.model` attribute on
    missing model.

++++ python-opentelemetry-proto:

  - update to 1.42.1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
    * ### Fixed
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending
    on the available trace id generator.
  - update to 1.42.0:
    * ### Added
    * `opentelemetry-api`, `opentelemetry-sdk`: add support for
    'random-trace-id' flags in W3C traceparent header trace
    flags. Implementations of `IdGenerator` that do randomly
    generate the 56 least significant bits, should also implement
    a `is_trace_id_random` methods that returns `True`.
    * logs: add exception support to Logger emit and LogRecord
    attributes
    * `opentelemetry-exporter-otlp-proto-grpc`: make retryable gRPC
    error codes configurable for gRPC exporters
    * `opentelemetry-sdk`: Add
    `create_logger_provider`/`configure_logger_provider` to
    declarative file configuration, enabling LoggerProvider
    instantiation from config files without reading env vars
    * `opentelemetry-exporter-otlp-json-common`: add
    'opentelemetry-exporter-otlp-json-common' package for OTLP
    JSON exporters
    * `opentelemetry-sdk`: Add `service` resource detector support
    to declarative file configuration via
    `detection_development.detectors[].service`
    * `opentelemetry-docker-tests`: add docker-tests coverage of
    `opentelemetry-exporter-otlp-proto-grpc` and `opentelemetry-
    exporter-otlp-proto-http` metrics export
    * Add `registry` keyword argument to `PrometheusMetricReader`
    to allow passing a custom Prometheus registry
    * Add WeaverLiveCheck test util
    * `opentelemetry-sdk`: add `load_entry_point` shared utility to
    declarative file configuration for loading plugins via entry
    points; refactor propagator loading to use it
    * `opentelemetry-sdk`: add sampler plugin loading to
    declarative file configuration via the
    `opentelemetry_sampler` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add propagator plugin loading to
    declarative file configuration via the
    `opentelemetry_propagator` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add exporter plugin loading to
    declarative file configuration for all three signals (traces,
    metrics, logs) via the `opentelemetry_*_exporter` entry point
    groups, matching the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add generic resource detector plugin
    loading to declarative file configuration via the
    `opentelemetry_resource_detector` entry point group, matching
    the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add `additional_properties` support to
    generated config models via custom `datamodel-codegen`
    template, enabling plugin/custom component names to flow
    through typed dataclasses
    * Add ability to selectively enable exporting of SDK internal
    metrics with the `OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED`
    environment variable.
    * ### Changed
    * `opentelemetry-semantic-conventions`: use `X | Y` union
    annotation
    * `opentelemetry-api`: update `EnvironmentGetter` and
    `EnvironmentSetter` to use normalized environment variable
    names
    * Apply fixes for `UP` ruff rule
    * `opentelemetry-sdk`: only load entrypoints for resource
    detectors if they are configured via
    `OTEL_EXPERIMENTAL_RESOURCE_DETECTORS`
    * ci: wait for tracecontext server readiness instead of a fixed
    sleep in `scripts/tracecontext-integration-test.sh`
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-semantic-conventions`: Bump semantic
    conventions to 1.41.1, this changes the metrics name of
    `K8S_CONTAINER_CPU_LIMIT_UTILIZATION` and
    `K8S_CONTAINER_CPU_REQUEST_UTILIZATION`.
    * ### Removed
    * `opentelemetry-api`: remove third-party importlib-metadata in
    favor of standard library since Python >= 3.10 is now
    required
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-sdk`: Allow declarative OTLP HTTP exporters to
    map `compression: deflate` instead of rejecting it as
    unsupported.
    * Fix incorrect code example in `create_tracer()` docstring
    * `opentelemetry-sdk`: Fix `ProcessResourceDetector` to use
    `sys.orig_argv` so that `process.command`,
    `process.command_line`, and `process.command_args` reflect
    the original invocation for `python -m ` runs (where
    `sys.argv[0]` is rewritten to the module path)
    * `opentelemetry-sdk`: fix YAML structure injection via
    environment variable substitution in declarative file
    configuration; values containing newlines are now emitted as
    quoted YAML scalars per spec requirement
    * `opentelemetry-sdk`: Fix mutable attributes reference in
    metrics, attributes passed to instrument `add`/`record` are
    now copied so that subsequent mutations do not affect
    recorded data points
    * `opentelemetry-sdk`: make resource detector ordering
    deterministic
    * Fix incorrect type annotation on `detectors` parameter of
    `get_aggregated_resources`
    * `opentelemetry-api`: Enforce W3C Baggage size limits on
    outbound propagation in `W3CBaggagePropagator.inject()`.
    Previously only inbound extraction enforced limits; now
    inject also caps entries at 180, individual pairs at 4096
    bytes, and total header at 8192 bytes per the W3C Baggage
    spec. The extract path max_pairs limit now counts all size-
    valid entries rather than only successfully parsed ones.
    * `opentelemetry-sdk`: fix multi-processor `force_flush`
    skipping remaining processors when one returns `None`
    * `opentelemetry-test-utils`: fix weaver live check hanging
    when weaver log output fills the pipe buffer

++++ python-opentelemetry-sdk:

  - update to 1.42.1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
    * ### Fixed
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending
    on the available trace id generator.
  - update to 1.42.0:
    * ### Added
    * `opentelemetry-api`, `opentelemetry-sdk`: add support for
    'random-trace-id' flags in W3C traceparent header trace
    flags. Implementations of `IdGenerator` that do randomly
    generate the 56 least significant bits, should also implement
    a `is_trace_id_random` methods that returns `True`.
    * `opentelemetry-sdk`: Add
    `create_logger_provider`/`configure_logger_provider` to
    declarative file configuration, enabling LoggerProvider
    instantiation from config files without reading env vars
    * `opentelemetry-sdk`: Add `service` resource detector support
    to declarative file configuration via
    `detection_development.detectors[].service`
    * Add `registry` keyword argument to `PrometheusMetricReader`
    to allow passing a custom Prometheus registry
    * `opentelemetry-sdk`: add `load_entry_point` shared utility to
    declarative file configuration for loading plugins via entry
    points; refactor propagator loading to use it
    * `opentelemetry-sdk`: add sampler plugin loading to
    declarative file configuration via the
    `opentelemetry_sampler` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add propagator plugin loading to
    declarative file configuration via the
    `opentelemetry_propagator` entry point group, matching the
    spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add exporter plugin loading to
    declarative file configuration for all three signals (traces,
    metrics, logs) via the `opentelemetry_*_exporter` entry point
    groups, matching the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add generic resource detector plugin
    loading to declarative file configuration via the
    `opentelemetry_resource_detector` entry point group, matching
    the spec's PluginComponentProvider mechanism
    * `opentelemetry-sdk`: add `additional_properties` support to
    generated config models via custom `datamodel-codegen`
    template, enabling plugin/custom component names to flow
    through typed dataclasses
    * Add ability to selectively enable exporting of SDK internal
    metrics with the `OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED`
    environment variable.
    * ### Changed
    * Apply fixes for `UP` ruff rule
    * `opentelemetry-sdk`: only load entrypoints for resource
    detectors if they are configured via
    `OTEL_EXPERIMENTAL_RESOURCE_DETECTORS`
    * Switch to SPDX license headers and add CI enforcement
    * ### Removed
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-sdk`: Allow declarative OTLP HTTP exporters to
    map `compression: deflate` instead of rejecting it as
    unsupported.
    * Fix incorrect code example in `create_tracer()` docstring
    * `opentelemetry-sdk`: Fix `ProcessResourceDetector` to use
    `sys.orig_argv` so that `process.command`,
    `process.command_line`, and `process.command_args` reflect
    the original invocation for `python -m ` runs (where
    `sys.argv[0]` is rewritten to the module path)
    * `opentelemetry-sdk`: fix YAML structure injection via
    environment variable substitution in declarative file
    configuration; values containing newlines are now emitted as
    quoted YAML scalars per spec requirement
    * `opentelemetry-sdk`: Fix mutable attributes reference in
    metrics, attributes passed to instrument `add`/`record` are
    now copied so that subsequent mutations do not affect
    recorded data points
    * `opentelemetry-sdk`: make resource detector ordering
    deterministic
    * Fix incorrect type annotation on `detectors` parameter of
    `get_aggregated_resources`
    * `opentelemetry-sdk`: fix multi-processor `force_flush`
    skipping remaining processors when one returns `None`
    when weaver log output fills the pipe buffer

++++ python-opentelemetry-semantic-conventions:

  - update to 0.63b1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
  - update to 0.63b0:
    * ### Added
    * `opentelemetry-exporter-richconsole`: Add support for
    suppressing resource information
    * `opentelemetry-instrumentation`: Add experimental metrics
    attributes Labeler utility
    * `opentelemetry-instrumentation-logging`: Add
    `OTEL_PYTHON_LOG_HANDLER_LEVEL` and `OTEL_PYTHON_LOG_FORMAT`
    environment variables to configure the log level and
    formatter of the auto-instrumented `LoggingHandler`.
    * `opentelemetry-instrumentation-sqlite3`: Add uninstrument,
    error status, suppress, and no-op tests
    * Add `BaggageLogProcessor` to `opentelemetry-processor-
    baggage`
    * `opentelemetry-instrumentation-system-metrics`: Add support
    for `process.disk.io` metric in system-metrics
    instrumentation
    * `opentelemetry-instrumentation`: Register
    `OTEL_SEMCONV_STABILITY_OPT_IN` in `environment_variables.py`
    so `opentelemetry-instrument` exposes a
    `--semconv_stability_opt_in` CLI argument
    * Expand `AGENTS.md` with instrumentation/GenAI guidance and
    add PR review instructions.
    * `opentelemetry-instrumentation`: update auto-instrumentation
    to re-inject instrumentation path after init
    * `opentelemetry-instrumentation-dbapi`: Add Database client
    operation duration and returned rows metrics
    * ### Changed
    * Remove redundant `pylint: disable=attribute-defined-outside-
    init` comments and add rule to global `.pylintrc` disable
    list
    * Bump `pylint` to `4.0.5`
    * `opentelemetry-instrumentation-logging`: Use
    `LogRecord.getMessage()` to format and extract each log
    record's body text to more closely match the expected usage
    of the logging system. As a result, all OTel log record
    bodies are now always strings. Previously, if `LogRecord.msg`
    (which contains the format string) was set to a non-string
    object (e.g. `logger.warning(some_dict)`), the object was
    exported as-is to the OTLP body field. Now,
    `LogRecord.getMessage()` will convert it to to a string. If
    you are passing in non-strings as the format string argument
    and your backend is expecting them as-is, you will need to
    update accordingly.
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-instrumentation-{urllib,urllib3,requests}`:
    switch http mock library from abandoned httpretty to mocket
    * ### Removed
    * Drop Python 3.9 support

++++ python-opentelemetry-test-utils:

  - update to 0.63b1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
  - update to 0.63b0:
    * `opentelemetry-test-utils`: fix weaver live check hanging
    when weaver log output fills the pipe buffer
    * Expand `AGENTS.md` with instrumentation/GenAI guidance and
    add PR review instructions.
    * Switch to SPDX license headers and add CI enforcement
    * Drop Python 3.9 support

++++ python-opentelemetry-util-http:

  - update to 0.63b1:
    * This is a patch release on the previous 1.42.0/0.63b0
    release, fixing the issue(s) below.
  - update to 0.63b0:
    * ### Added
    * `opentelemetry-exporter-richconsole`: Add support for
    suppressing resource information
    * `opentelemetry-instrumentation`: Add experimental metrics
    attributes Labeler utility
    * `opentelemetry-instrumentation-logging`: Add
    `OTEL_PYTHON_LOG_HANDLER_LEVEL` and `OTEL_PYTHON_LOG_FORMAT`
    environment variables to configure the log level and
    formatter of the auto-instrumented `LoggingHandler`.
    * `opentelemetry-instrumentation-sqlite3`: Add uninstrument,
    error status, suppress, and no-op tests
    * Add `BaggageLogProcessor` to `opentelemetry-processor-
    baggage`
    * `opentelemetry-instrumentation-system-metrics`: Add support
    for `process.disk.io` metric in system-metrics
    instrumentation
    * `opentelemetry-instrumentation`: Register
    `OTEL_SEMCONV_STABILITY_OPT_IN` in `environment_variables.py`
    so `opentelemetry-instrument` exposes a
    `--semconv_stability_opt_in` CLI argument
    * Expand `AGENTS.md` with instrumentation/GenAI guidance and
    add PR review instructions.
    * `opentelemetry-instrumentation`: update auto-instrumentation
    to re-inject instrumentation path after init
    * `opentelemetry-instrumentation-dbapi`: Add Database client
    operation duration and returned rows metrics
    * ### Changed
    * Remove redundant `pylint: disable=attribute-defined-outside-
    init` comments and add rule to global `.pylintrc` disable
    list
    * Bump `pylint` to `4.0.5`
    * `opentelemetry-instrumentation-logging`: Use
    `LogRecord.getMessage()` to format and extract each log
    record's body text to more closely match the expected usage
    of the logging system. As a result, all OTel log record
    bodies are now always strings. Previously, if `LogRecord.msg`
    (which contains the format string) was set to a non-string
    object (e.g. `logger.warning(some_dict)`), the object was
    exported as-is to the OTLP body field. Now,
    `LogRecord.getMessage()` will convert it to to a string. If
    you are passing in non-strings as the format string argument
    and your backend is expecting them as-is, you will need to
    update accordingly.
    * Switch to SPDX license headers and add CI enforcement
    * `opentelemetry-instrumentation-{urllib,urllib3,requests}`:
    switch http mock library from abandoned httpretty to mocket
    * ### Removed
    * Drop Python 3.9 support
    * ### Fixed
    * `opentelemetry-instrumentation-aiohttp-server`: Use
    `canonical` attribute of the `Resource` as a span name
    * Refactor unit tests to allow for population of the random
    trace id flag in the `traceparent` header
    * `opentelemetry-instrumentation-aws-lambda`: fix improper
    handling of header casing
    * `opentelemetry-instrumentation-flask`: Clean up environ keys
    in `_teardown_request` to prevent duplicate execution
    * `opentelemetry-instrumentation-celery`: Coerce non-string
    values to strings in `CeleryGetter.get()` to prevent
    `TypeError` in `TraceState.from_header()` when Celery request
    attributes contain ints
    * `opentelemetry-instrumentation-celery`: Coerce timelimit
    values to strings in `set_attributes_from_context()` to
    prevent mixed-type span attribute warning
    * `opentelemetry-instrumentation-fastapi`: Fix `FastAPI`
    instrumentation to correctly trace `BackgroundTasks` by
    wrapping their execution in a dedicated span, ensuring proper
    parent-child relationships and accurate trace timing
    * `opentelemetry-instrumentation-flask`: Stop reading the
    deprecated (from 3.1) `flask.__version__` attribute; resolve
    the Flask version via `importlib.metadata`
    * `opentelemetry-instrumentation-confluent-kafka`: Populate
    `server.address` and `server.port` span attributes from the
    producer/consumer `bootstrap.servers` config; previously
    `KafkaPropertiesExtractor.extract_bootstrap_servers` was
    defined but never called
    * `opentelemetry-instrumentation-dbapi` Use `ObjectProxy`
    instead of `BaseObjectProxy` for `TracedCursorProxy` to
    restore iterability with wrapt 2.x
    * `opentelemetry-instrumentation-pyramid`: add missing
    `http.response.status_code` in duration metrics for stable
    http semantic conventions
    * `opentelemetry-instrumentation-pika` Use `ObjectProxy`
    instead of `BaseObjectProxy` for `ReadyMessagesDequeProxy` to
    restore iterability with wrapt 2.x
    * `docker-tests`: Don't require sudo, debian based distro and
    MS SQL ODBC driver to run locally. Instead require docker and
    unixodbc
    * `opentelemetry-instrumentation-celery`: clear completed task
    ids from `task_id_to_start_time`
    * `opentelemetry-instrumentation-celery`: add null guards and
    type-safe helper handling around Celery context propagation
    internals
    * `opentelemetry-instrumentation-wsgi`: use `PATH_INFO` and
    `QUERY_STRING` for URL attributes instead of parsing
    `RAW_URI` or `REQUEST_URI`
    * `opentelemetry-instrumentation-mysqlclient`: Update unit
    tests to properly validate trace context trace flag values.
    * `opentelemetry-instrumentation-pika`: pass destination to
    `_enrich_span` instead of `task_name`
    * `opentelemetry-instrumentation-tornado`: reduce cardinality
    of span names and metrics attributes. This introduces a
    breaking change in the metrics attributes for the stable
    semantic convention by dropping the out of spec `url.query`
    and `url.path` attributes in favor of in-spec `http.route`.
    * `opentelemetry-instrumentation-confluent-kafka`: Declare
    `opentelemetry-semantic-conventions` as a direct dependency
    * `opentelemetry-instrumentation-pymssql`: Fix semconv
    stability migration for connection attributes (host, port,
    user) set in `wrapped_connection()` to respect
    `OTEL_SEMCONV_STABILITY_OPT_IN`. Note: `net.peer.port` is now
    emitted as `int` instead of `string` in default mode,
    aligning with other DB instrumentations.
    * Declare `opentelemetry-semantic-conventions` as a direct
    dependency for the aio-pika, logging, pika and system-metrics
    instrumentations, since each imports `opentelemetry.semconv`
    directly.
  - update to opentelemetry-instrumentation-google-genai==0.7b1:
    * This is a patch release on the previous 0.7b0 release, fixing
    the issue(s) below.
  - update to opentelemetry-util-genai==0.4b0:
    * Add `AgentInvocation` type with `invoke_agent` span lifecycle
    * Add metrics support for EmbeddingInvocation
    * Add support for workflow in genAI utils handler.
    * Enrich ToolCall type, breaking change: usage of ToolCall
    class renamed to ToolCallRequest
    * Add EmbeddingInvocation span lifecycle support
    * Populate schema_url on metrics
    * Add workflow invocation type to genAI utils
    * Check if upload works at startup in initializer of the
    `UploadCompletionHook`, instead of repeatedly failing on
    every upload (#4390).
    * Refactor public API: add factory methods (`start_inference`,
    `start_embedding`, `start_tool`, `start_workflow`) and
    invocation-owned lifecycle (`invocation.stop()` /
    `invocation.fail(exc)`); rename `LLMInvocation` →
    `InferenceInvocation` and `ToolCall` → `ToolInvocation`.
    Existing usages remain fully functional via deprecated
    aliases.
    * `TelemetryHandler` now accepts a `completion_hook` parameter
    and calls it after each LLM invocation, passing inputs,
    outputs, the active span, and the log record. Content capture
    is enabled automatically when a real hook is configured.
    * Add metrics to ToolInvocations
    * Wrap completion hooks loaded via `load_completion_hook` so
    exceptions raised by `on_completion` are logged and swallowed
    instead of propagating to instrumentation call sites.
  - update to opentelemetry-instrumentation-openai-v2==2.4b0:
    * Migrate experimental path from deprecated `LLMInvocation` to
    `InferenceInvocation`, using `handler.start_inference()` and
    `invocation.stop()`/`invocation.fail()` directly
    * Use `create_duration_histogram` and `create_token_histogram`
    from `opentelemetry-util-genai` instead of defining bucket
    boundaries locally
    * Import `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT`
    from `opentelemetry.util.genai.environment_variables` instead
    of re-defining it locally, making `opentelemetry-util-genai`
    the single source of truth for this constant.
    * Fix compatibility with wrapt 2.x by using positional
    arguments in `wrap_function_wrapper()` calls
    * Fix `ChoiceBuffer` crash on streaming tool-call deltas with
    `arguments=None`
    * Fix `StreamWrapper` missing `.headers` and other attributes
    when using `with_raw_response` streaming
    * Add opt-in support for latest experimental semantic
    conventions (v1.37.0). Set `OTEL_SEMCONV_STABILITY_OPT_IN` to
    `gen_ai_latest_experimental` to enable. Add dependency on
    `opentelemetry-util-genai` pypi package.
    * Add wrappers for OpenAI Responses API streams and response
    stream managers
    * Add async wrappers for OpenAI Responses API streams and
    response stream managers
    * Add strongly typed Responses API extractors with validation
    and content extraction improvements
    * Add completion hook support.
    * Fix `response_format` handling: map
    `json_object`/`json_schema` to `json` output type.
    * Skip attribute values with `openai.Omit` value.
    * Default empty string for `gen_ai.request.model` attribute on
    missing model.

++++ rt-tests:

  - Update to version 2.10:
    * hwlatdetect: add MTBF calculation and width/bounds checking
    * cyclictest: fix the -A long option name in the manpage and drop a
    duplicate getopt entry
    * rt-utils: fix the write() return-value check

++++ rumdl:

  - Upate to version 0.2.20:
    * Fixed
  - cli: redirect removed --list-rules to the canonical commands
    (7a3842d)
  - parser: correct code-region detection for comments and JSX
    fences (17f975c)

++++ strawberry:

  - Update to version 1.2.20
    + Defer writing playcount and rating tags for the currently playing MP3 file to prevent playback issues (#1916)
    + Fixed volume being reset during gapless playback when the sample rate changes between tracks (#2149)
    + Prevent duplicate songs with identical URL (#1341)
    + Fixed album shuffle to use the effective album artist
    + Fixed collection watcher skipping symlinked directories
    + Fixed collection subdirectory path handling when renaming directories
    + Fixed songlyrics.com, elyrics.net and letras lyrics parsing
    + Fixed SPC (GME) file parsing
    + Fixed Tidal session not being cleared on authentication errors
    + Fixed global shortcuts to use the first backend that registers successfully
    + Prefer the volume UUID when identifying removable devices (#2125)
    + Save settings when the session manager requests a commit (#1818)
    + Set StartupWMClass in the desktop file to org.strawberrymusicplayer.strawberry (#1996)
    + Fixed two tabs closed when middle clicking on a playlist tab (#2084)
    + Allow longer timeout waiting for lyrics
    + Fixed scroll wheel changes numeric values (number, disc, year) instead of scrolling the window content in tag editor (#2104)
    + Fixed playback stopping on files with embedded subtitle/text streams such as S_TEXT/WEBVTT (#2128)
    + Only apply HTTP proxies to streaming, since SOCKS proxies are not supported by GStreamer (#2086)
    + Fixed updating device collection path (#2125)
    + Numerous stability, crash-safety, memory-safety and detach fixes throughout the application
    + New waveform for seekbar
    + New filesystem watcher on Linux and Windows which also detects file changes within directories
    + Added radio browser
    + Improved MPRIS2 support (TrackMetadataChanged and TrackAdded signals and upgraded playlist track definitions)
    + Include release group MBID in ListenBrainz scrobble submission
    + FFTW3 fast spectrum plugin for moodbar is now optional
    + Removed broken ChartLyrics, lyricfind.com and lololyrics.com lyrics provider
  - Drop no longer used dependency RapidJSON

++++ tailscale:

  - Update to version 1.98.6:
    + ssh/tailssh: reject dangerous LD_/DYLD_ env vars in acceptEnv filtering
    + go.mod,wgengine/magicsock: pull wireguard-go fix for roaming endpoints
    + wgengine/magicsock: suppress TSMP disco advert when bestAddr is peer
    + control/controlknobs,wgengine/magicsock: disable TSMP disco advert if
    netmap caching is disabled

++++ thextech:

  - Update to version 1.3.7.3
    * https://github.com/TheXTech/TheXTech/releases/tag/v1.3.7.3

++++ tiobench:

  - Update to version 0.5.0:
    * Switch to the maintained fork at github.com/aliceinwire/tiobench
  - Drop patches now merged or obsoleted upstream:
    * tiobench-rename-conflicting-functions.diff (upstream renamed the
    aligned_alloc helper to tt_aligned_alloc)
    * tiobench-moredigits.diff (wider rate/latency output columns are now
    upstream)
    * tiobench-warnings-makefile.diff (no longer required; install uses
    PREFIX/DOCDIR overrides)

++++ topgrade:

  - Update to version 17.6.2:
    * chore: release v17.6.2 (#2089)
    * fix(brew): add assume_yes support (#2090)
    * chore(deps): update actions/checkout action to v7 (#2096)
    * chore(deps): update rust crate itertools to 0.15.0 (#2095)
    * chore(deps): lock file maintenance (#2093)
    * docs: fix winget_silent_install key name in config.example.toml (#2092)
    * fix(powershell): skip step if there is a wrapper script (#2087)
    * fix(brew): don't panic when linuxbrew owner uid has no passwd entry (#2063)
    * fix(pip3): skip self-update on Termux (#2065)
    * fix(nix): don't skip self-upgrade on non-NixOS Linux (#2072)
    * chore(deps): update release-plz/action action to v0.5.130 (#2084)

------------------------------------------------------------------
------------------  2026-6-19  -  Jun 19 2026  -------------------
------------------------------------------------------------------

++++ 3proxy:

  - Enabled http-proxy and allowed local network 192.168.0.0/16 by default.
  - Updated to 0.9.6
    * https://github.com/3proxy/3proxy/releases/tag/0.9.6
    * SSLPlugin significantly improved and bugfixed: adds ssl_client
    and multiple configuration options.
    * HAProxy PROXY protocol v1 support as client and server.
    * tlspr is now supported in auto and gained a -s option to break
    the HELLO packet and evade some SNI-based DPI.
    * New maxseg configuration option (TCP_MAXSEG).

++++ CoreFreq:

  - removed upstream fix-leap16-compilation.patch
  - Update to 2.1.2
    * [AMD]
  - Route SMN I/O through per-UMC PCI device on multi-die platforms
  - Remove AMD_UMC_Normalize_Channels() function
  - Skip Rank calculation when secondary regions are active
  - Aggregate DIMM size from RAM regions
  - [UMC] Attempt to detect shared DRAM CS mask
    * [x86_64]
  - Decode and display Extended Supervisor State Mask (XSS)
  - STMXCSR: remove XCR0.SSE condition with legacy architectures
  - Reorder processing logic of XCR0 and MXCSR registers
  - [AVX|SSE] Media and Extended Control and Status Register
  - [Intel][AMD] Complete CPUID dump leaf list from updated specs
    * [Intel]
  - Rephrase to " Advanced Matrix Extensions Brain Float16 "
  - Rename CPUID.(EAX=0x29, ECX=0).EBX[0] feature to APX_NDD_NF
  - Display AVX10-128/256/512 and APX-NCI_NDD_NF CPUID bits
  - Display APX_F, AMX_COMPLEX and new leaf 7.1 features
  - Dump additional CPUID leaves through 0x29
    * [CLI]
  - Show blanks instead of zero values in DIMM geometry
    * [Doc]
  - [AMD] DDR4 Limit encoding specification
  - [AMD] DDR5 Limit encoding specification
  - [AMD] Register HWCR[34] Downgrade FP512 to FP256
  - [Intel] Architecture Instruction Set Extensions and Future Features
  - [x86_64] Dump undocumented CPUID leaves introduced in AMD Family 1Ah
  - [AMD][Zen] Fix the bit fields of AMD_CPPC_REQUEST MSR register
    * [Build]
  - [CR] Fix __builtin_strnlen() fallback for GCC < 7
  - [CR] Propagate StrCopy() hardening to other architectures
  - [CR] Ensure bounded and null-terminated string copies
  - [Build] Add a dependency to create Symlink first
  - [Build] Fix module rebuild dependency tracking
  - [Build][openSUSE] Fix WRMSRNS collision with Leap 16.0 kernel headers (#594)
    * [Kernel]
  - [aarch64][ppc64][riscv64] Make use of cpufreq_cpu_put()
  - [CPUFreq] Fallback to policy-based governor label when unavailable
  - [CPPC] Read per CPU the updated ACPI-CPPC registers
  - [CPPC] Read the updated ACPI-CPPC registers
  - [CR][Kernel] Remove __free(put_cpufreq_policy) dependency
  - [CR][Kernel] Call cpufreq_cpu_put() to release cpu_policy
  - [CPPC] Compute Bounds after altering the Energy Policy

++++ agama-web-ui:

  - Fine-tune and extend the Agama appearance system: improve font
    rendering (update the SUSE variable font to v2.001, adopt SUSE Mono,
    fix the variable-font @font-face declarations and drop the custom
    font-weight overrides) and let products fine-tune typography, icon
    sizes, icon color, disabled and tooltip through --agm-t--* tokens
    (gh#agama-project/agama#3647).
  - search properly also user visible summary to avoid confusion
    (bsc#1268098)

++++ aliyun-cli:

  - Update to version 3.3.23
    * {Plugin} Allow plugins to opt out of host profile enforcement
    by @AllyW in (#1348)

++++ ansible-13:

  - update to 13.8.0:
    Ansible 13.8.0 includes ansible-core 2.20.7 as well as a curated
    set of Ansible collections that provide a vast number of modules
    and plugins.
    Collections which have opted-in to being a part of the Ansible 13
    unified changelog will have an entry on this page:
    https://github.com/ansible-community/ansible-build-data/blob/main/13/CHANGELOG-v13.rst

++++ ansible:

  - update to 14.0.1:
    Ansible 14.0.0 includes ansible-core 2.21.1 as well as a curated
    set of Ansible collections that provide a vast number of modules
    and plugins.
    Collections which have opted-in to being a part of the Ansible 14
    unified changelog will have an entry on this page:
    https://github.com/ansible-community/ansible-build-data/blob/main/14/CHANGELOG-v14.rst

++++ ansible-core-2.18:

  - update to 2.18.18:
    https://github.com/ansible/ansible/blob/v2.18.18/changelogs/CHANGELOG-v2.18.rst
    * Security Fixes
  - ansible-galaxy install - Ensure role requirements are passed
    as positional arguments to :command:`git clone`. Previously,
    a malicious role author could inject arbitrary git
    configuration in role dependencies. (CVE-2026-11332)

++++ ansible-core-2.19:

  - update to 2.19.11:
    https://github.com/ansible/ansible/blob/v2.19.11/changelogs/CHANGELOG-v2.19.rst
    * Security Fixes
  - ansible-galaxy install - Ensure role requirements are passed
    as positional arguments to :command:`git clone`. Previously,
    a malicious role author could inject arbitrary git
    configuration in role dependencies. (CVE-2026-11332)
    * Minor Changes
  - ansible-test - Replace FreeBSD 14.2 with 14.3.
    * Bugfixes
  - module_utils sanitize_keys and remove_value functions now
    sort their input to ensure matching subsets are always
    obscured.

++++ ansible-core-2.20:

  - update to 2.20.7:
    https://github.com/ansible/ansible/blob/v2.20.7/changelogs/CHANGELOG-v2.20.rst
    * Security Fixes
  - ansible-galaxy install - Ensure role requirements are passed
    as positional arguments to :command:`git clone`. Previously,
    a malicious role author could inject arbitrary git
    configuration in role dependencies. (CVE-2026-11332)
    * Bugfixes
  - module_utils sanitize_keys and remove_value functions now
    sort their input to ensure matching subsets are always
    obscured.

++++ ansible-core:

  - update to 2.21.1:
    * Security Fixes
  - ansible-galaxy install - Ensure role requirements are passed
    as positional arguments to :command:`git clone`. Previously,
    a malicious role author could inject arbitrary git
    configuration in role dependencies. (CVE-2026-11332)
  - psrp - Do not log raw stdout/stderr on verbosity 5 when task
    has no_log: true set
  - winrm - Do not log raw stdout/stderr on verbosity 5 when task
    has no_log: true set
    * Bugfixes
  - cli - handle empty value for PAGER (#86898).
  - config - use correct key value for inject_invocation setting
    (#86999).
  - free strategy - Fix IndexError when hosts become unreachable
    during playbook execution (#87027).
  - meta pseudo-action - Fixed callback args passed to
    v2_runner_on_skipped when any meta action was skipped by a
    when condition; added test coverage. A previous regression
    caused the callback dispatch to be omitted and a warning
    issued.
  - module_utils sanitize_keys and remove_value functions now
    sort their input to ensure matching subsets are always
    obscured.
  - module_utils/basic.py - Fix AnsibleModule.run_command() to
    handle None return from non-blocking pipe reads (#86920).
  - wait_for - use errno.ENOENT symbolic constant instead of
    hardcoded value for improved code portability.
  - remove patch ansible-core-CVE-2026-11332.patch as this is
    included in the release

++++ ansible-documentation:

  - Update to version 2.21.1:
    * dev_guide: Fix link (#3742) (#3779)
    * Review requests (#3472) (#3775)
    * get_started_inventory.rst: fix small typo (#3769) (#3772)
    * ci: refresh dev dependencies (#3766)
    * ci: refresh dev dependencies (#3761)
    * fix(getting_started_ee): remove unnecessary become from EE
    examples (#3737) (#3751)
    * ci: refresh dev dependencies (#3745)
    * Add PowerShell 7 documentation (#3692) (#3741)
    * Add note to roadmap index pointing to devel branch for upcoming
    releases (#3660) (#3740)
    * updated documentation for networking collections (#3722)
    (#3733)
    * chore: remove stable-2.19 note from banner (#3725) (#3730)
    * chore: remove banner about Red Hat Summit (#3726) (#3728)
    * ci: refresh dev dependencies (#3716)
    * Add the Ansible community 14 porting guide (#3723) (#3724)
    * Add warning about module_utils import restriction (#3668)
    (#3715)
    * ansible-galaxy: update skeleton_ignore parameter docs (#3470)
    (#3712)
    * Add multi-parent metagroup example and clarify group_vars
    inheritance (#3493) (#3708)
    * Add 'module' in 'The crypt _module_ is used' (#3675) (#3710)
    * Add note on Collection Testing with ansible-test (#3654)
    (#3702)
    * Document expected --start-at-task behavior (#3589) (#3704)
    * Fix minor grammar mistakes and typos (#3667) (#3699)
    * Add the Ansible community 14.0.0rc1 porting guide (#3694)
    (#3695)
    * ci: refresh dev dependencies (#3688)
    * Add the Ansible community 14.0.0b1 porting guide (#3685)
    (#3686)
    * Update style_guide, add AGENTS.md file. Assisted-by: Claude
    Opus, Gemini (#3662) (#3684)
    * Add the Ansible community 13.7.0 porting guide (#3677) (#3679)

++++ apache-commons-configuration2:

  - Upgrade to version 2.15.1
    * Fixed Bugs
    + CONFIGURATION-856: The artifact commons-io:commons-io is a
    normal dependency
    + Avoid NPE when combined location strategy sub strategies is
    immutable list (#639)
    * Changes
    + Bump org.apache.commons:commons-parent from 99 to 100

++++ apache-commons-csv:

  - Upgrade to version 1.14.1
    * Fixed Bugs
    + CSV-318: CSVPrinter.printRecord(Stream) hangs if given a
    parallel stream
    + CSV-318: CSVPrinter now uses an internal lock instead of
    synchronized methods
    + org.apache.commons.csv.CSVPrinter.printRecords(ResultSet) now
    writes one record at a time using a lock
    * Changes
    + Bump org.apache.commons:commons-parent from 81 to 85 #542
    + Bump commons-io:commons-io from 2.18.0 to 2.20.0
    + Bump com.opencsv:opencsv from 5.10 to 5.11.2 #545, #551, #553
    + Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0
    [#556]
    + Bump commons-codec:commons-codec from 1.18.0 to 1.19.0

++++ apache-commons-daemon:

  - Upgrade to 1.6.1
    * Bug Fixes:
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS
    (from org.apache.commons:commons-parent:80)
    + Document --enable-preview
    + Fix first appearance of --enable-native-access
    + Procrun. Fix redirection issues on some OS versions by using
    recommended method to redirect stdout and stderr.
    Fixes DAEMON-398.
    + Procrun. Fix updating of startup mode to 'Automatic (delayed)'
    being incorrectly processed as an update to 'Manual'.
    Fixes DAEMON-439.
    + Procrun. Fix timeout handling #238. Fixes DAEMON-468.
    + Procrun. Replace RTF version of license header with plain text
    version of full license in about box for monitor application.
    Fixes DAEMON-472.
    + Procrun. Service should be marked as stopped if the service
    worker crashes. Fixes DAEMON-475.
    + jsvc. Fix compilation warnings.
    + jsvc. Fix a regression in 1.5.1 that exposed long standing
    bugs around the locking and unlocking of pid files. Also fix
    the locking/unlocking bugs.
    + Detaches from console when the service stops #307. Fixes
    DAEMON-477.
    + jsvc. Correct a packaging error in the 1.6.0 native source
    tarball for *nix systems. Thanks to Michael Osipov.
    * New Features:
    + Add support for --enable-native-access Java startup option in
    jsvc. Fixes DAEMON-471.
    + Add tests for prunsrv on Windows #260.
    + Add Java API compatibility report to the site (JApiCmp).
    + Procun. Build binaries for Windows using the static hybrid CRT
    strategy by default.
    + jsvc. Use FreeBSD's setproctitle(3) to pass -procname similar
    to daemon(8).
    + procrun. Add ARM64 support for Windows binaries. Fixes
    DAEMON-462.
    * Update dependencies:
    + Bump org.apache.commons:commons-parent from 78 to 91 #253,
    [#255], #287.
    + Update to use new ASF logo
    + Bump org.apache.commons:commons-parent from 93 to 99.
    + jsvc. Consistently use strerror(3) for log output.

++++ apache-commons-email:

  - Update to version 1.6.0
    * New features:
    + Add github/codeql-action #75
    + Add Maven plugin JapiCmp and remove Clirr
    + EMAIL-176: Add Automatic-Module-Name MANIFEST entry for Java 9
    compatibility.
    + EMAIL-207: Add InputStreamDataSource
    + EMAIL-207: Don't waste memory in
    MimeMessageParser#createDataSource()
    + Add EmailConstants.SOCKET_TIMEOUT and deprecate
    SOCKET_TIMEOUT_MS
    + Add Email.setSocketConnectionTimeout(Duration) and deprecate
    setSocketConnectionTimeout(int)
    + Add Email.setSocketTimeout(Duration) and deprecate
    setSocketTimeout(int)
    + Add PathDataSource
    + Add DataSourcePathResolver
    + Add MimeMessageUtils.createMimeMessage(Session, Path,
    OpenOption...)
    + Add MultiPartEmail.attach(Path, OpenOption...)
    * Fixed Bugs:
    + EMAIL-190: Fix broken JDK 9 build by updating "easymock" and
    other dependencies
    + Use JUnit 5 APIs #106, #108, #109, #114
    + [StepSecurity] ci: Harden GitHub Actions #149
    + Better use of JUnit APIs #158
    + EMAIL-205: Update conversion code #153
    + Email.setBounceAddress no longer accepts invalid email
    addresses
    + Throw more specific exceptions in MimeMessageParser #11
    + Email.setMailSession(Session) throws the more precise
    exception NullPointerException
    + Avoid possible NullPointerException in
    DataSourceClassPathResolver.resolve(String, boolean)
    + Complete half-baked test DataSourceUrlResolverTest
    .testResolvingHttpNonLenient()
    + EMAIL-206: Use SharedByteArrayInputStream for memory usage
    [#157]
    + Migrate to JUnit 5 #186
    + EMAIL-174: Bump javax.mail dependency to 1.6.1, so that i18n
    is supported for email addresses
    + Add missing getters and setters in EMail and subclasses;
    deprecate access to protected instance variables
    + DataSourceUrlResolver.resolve(String, boolean) leaks
    InputStreams
    + Use US-ASCII in MimeMessageUtils.createMimeMessage(Session,
    String)
    * Changes:
    + Bump org.slf4j:slf4j-jdk14 from 1.7.7 to 2.0.9 #165
    + Bump mockito-core from 4.11.0 to 5.8.0 #187
    + Bump actions/cache from 2 to 3.0.11 #39, #48, #60, #70, #102
    + Bump actions/checkout from 1 to 3.2.0, #25 #33, #67, #99, #117
    + Bump actions/setup-java from 1.4.0 to v3.6.0 #30, #74, #103
    + Bump actions/upload-artifact from 3.1.0 to 3.1.1 #110
    + EMAIL-177: Bump from Java 6 to 7
    + Bump from Java 7 to 8
    + EMAIL-183: Bump javax.mail:1.6.1 to jakarta.mail:1.6.7
    + Bump commons-parent from 50 to 65, #118, #128
    + Bump spotbugs-maven-plugin from 4.0.0 to 4.7.2 #18
    + Bump spotbugs from 4.0.6 to 4.7.2 #40
    + Bump junit from 4.13 to 4.13.2 #32
    + Bump commons-release-plugin from 1.0 to 1.7 #23
    + Bump maven-pmd-plugin from 3.13.0 to 3.19.0 #34, #72, #79, #94
    + Bump tests commons-io:commons-io 2.6 to 2.15.1
    + Bump jacoco from 0.8.6 to 0.8.8; fixes jacoco on Java 17
    + Bump org.easymock:easymock from 4.2 to 5.2.0, #107, #164
    + Bump commons-release-plugin from 1.7 to 1.8.1 #73, #184
    + Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #87
  - Distribute as a maven artifact
  - Removed patches:
    * commons-email-1.5-javadoc.patch
    * commons-email-1.5-sourcetarget.patch
    + not needed with this version.

++++ argocd-cli:

  - Update to version 3.4.4:
    No CLI-related changes or dependency updates

++++ aws-c-io:

  - Update to version 0.27.2
    * Option to disable revocation check by @sbSteveK in (#806)
  - from version 0.27.1
    * Minor fix by @azkrishpy in (#802)

++++ aws-c-sdkutils:

  - Update to version 0.2.5
    * Remove Windows 2019 and add Windows 2025 with MSVC-17 by @TingDaoK in (#55)
    * change stale issue and discussion handling to run once a week
    by @DmitriyMusatkin in (#57)
    * Ingest BDD endpoints by @azkrishpy in (#60)
    * BDD loader optimizations by @DmitriyMusatkin in (#61)
    * Align profile name parsing with SDKs by @TingDaoK in (#65)

++++ blog:

  - Update to version 2.41
    * The __attribute__((noreturn)) for error() in libconsole.h added
    * The variable err with 0 initialized in thread_poll()
    * The variable cp.parity with {0} initialized in readpw()
    * feat(blogd): handle pending systemd password requests on coldstart
    * Initialize console pointer list as well
    * Check peer credentials before reading command
    * Make isinteger() string check usable for all architectures
    * Add some comments about warnings and translation for S390

++++ bugzilla-mcp:

  - Initial package (version 0.14.0)

++++ buildkit:

  - Update to version 0.31.0:
    * Dockerfile: update containerd v2.2.5, v2.1.9, v1.7.33
    * vendor: github.com/containerd/containerd/v2 v2.2.5
    * vendor: golang.org/x/crypto v0.53.0
    * vendor: golang.org/x/text v0.38.0
    * vendor: golang.org/x/sync v0.21.0
    * vendor: golang.org/x/term v0.44.0
    * vendor: golang.org/x/sys v0.46.0
    * build(deps): bump actions/checkout from 6.0.3 to 7.0.0
    * Dockerfile: update docker engine, cli to v29.6
    * sourcepolicy: fix grammar in Evaluate doc comment
    * gitutil: preserve SUDO_UID for git subprocesses
    * Dockerfile: update runc binary to v1.3.6
    * chore: update generated files
    * vendor: update policy-helpers to d5411a945cfc
    * fix: add mutex to protect Worker.Platforms from data race
    * cniprovider: keep loopback DNS dials in caller netns
    * cniprovider: keep proxy dials in CNI netns
    * filesync: detect local export multi-platform transfer support
    * ci: update docker/github-builder to v1.12.0
    * proxyprovider: test HTTP/2 transport clone with custom dialer
    * sourcepolicy: fix exact match convert ignoring destination
    * proxyprovider: fix exec proxy HTTPS regressions
    * client: update loopback condition for dockerd worker
    * client: update dockerd test conditions after oci-mediatypes default
    * client: fix mergeop requirements in new test for dockerd
    * Revert "executor: fix containerd stdin close race"
    * network: fix proxy default egress
    * docs: update CDI example to match the current debug workers output.
    * config: fix a default GC policy filter never matching any record
    * exporter: use root-backed fsutil receive instead of client-side staging
    * vendor: update github.com/tonistiigi/fsutil to 0257b3308df4
    * client: add testExportLocalModeMultiPlatformKeepsAllPlatforms test
    * exporter: add local exporter mode=delete
    * vendor: github.com/urfave/cli/v3 v3.9.0
    * deps: update golang.org/x/exp
    * deps: align Go dependencies with Moby
    * deps: update github.com/containerd/nydus-snapshotter to v0.15.15
    * executor: fix containerd stdin close race
    * test: stabilize worker exec pid1 lifetime
    * Dockerfile update nerdctl to v2.3.1
    * Dockerfile: update buildx to v0.34.1
    * Dockerfile: update RootlessKit to v3.0.1
    * Dockerfile: update containerd v2.2.4, v2.1.8, v1.7.32
    * docs: document proxy network
    * network: split exec proxy from net mode
    * vendor: github.com/moby/sys/sequential v0.7.0
    * vendor: github.com/docker/cli v29.5.3
    * Dockerfile: update docker engine, cli to v29.5
    * update binfmt to v10.2.3
    * vendor: update github.com/aws/aws-sdk-go-v2 modules to latest
    * exporter: default docker tar to OCI types
    * testutil: match exact platform for mirrored images
    * executor: avoid runc stdin shutdown hangs
    * test: stabilize nested progress assertions
    * llb: add passthrough op
    * build(deps): bump docker/github-builder/.github/workflows/bake.yml
    * build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0
    * build(deps): bump github/codeql-action from 4.36.1 to 4.36.2
    * build(deps): bump crazy-max/.github from 1.8.0 to 1.10.0
    * build(deps): bump the crazy-max-dot-github group with 2 updates
    * solver/errdefs: rm deprecated github.com/golang/protobuf/jsonpb
    * update protoc to v3.14.0
    * util/grpcerrors: remove import of deprecated github.com/golang/protobuf
    * frontend/gateway: remove import of deprecated github.com/golang/protobuf
    * bound telemetry shutdown when trace forwarding stalls
    * control: forward traces in a non-blocking goroutine
    * ci: switch to bento/freebsd-14 vagrant box
    * proxyprovider: bound proxy cert cache
    * test: cover proxy network source conversion
    * proxyprovider: fix redirects capturing
    * proxyprovider: better url formatting
    * proxyprovider: avoid untracted requests because transfer encoding
    * proxyprovider: log response status code
    * proxyprovider: fix early context cancel
    * buildkitd: add daemon proxy network option
    * solver: keep runtime load opts out of LLB digests
    * solver: log proxy network requests
    * solver: reuse source policy for proxy network
    * network: capture proxy exec materials
    * solver: add proxy network mode
    * build(deps): bump github/codeql-action from 4.36.0 to 4.36.1
    * build(deps): bump actions/checkout from 6.0.2 to 6.0.3
    * test: cover chmod on copied parent dirs
    * vendor: update fsutil with umask-aware MkdirAll
    * test: avoid local source differ release race
    * test: log integration helper timing
    * exporter: add compatibility version 30
    * exporter: fix OCI media type test coverage
    * all: use well-known zstd mediaType constants
    * exporter/containerimage: document "oci-artifact=" values
    * exporter/containerimage: parse oci-mediatypes=bool strictly
    * exporter/containerimage: remove unnecessary errors.Errorf
    * exporter/containerimage: default to oci-mediatype=true
    * exporter/containerimage: remove unused EnableForceCompression
    * attestation: emit in-toto v1 statements directly
    * attestation: update tests and docs for in-toto v1 statements
    * attestation: switch exporter paths to in-toto v1 json wrapper
    * attestation: add in-toto v1 json compatibility wrapper
    * solver: clone fileop input ref in ExecError decoration
    * source/http: fix resolver cache ref lookup
    * cache: tighten parent lock scope in parentRefs.release
    * Fix premature ref release on failed-exec output
    * solver/file: release mutable on Commit failure in RefManager
    * solver: release active on commit failure in exec error defer
    * solver: release partial outputs on commit failure
    * test: avoid shared containerd worker env
    * solver: fix slow cache error result ownership
    * docs: remove outdated cni-networking.md
    * build(deps): bump docker/github-builder/.github/workflows/bake.yml
    * Add Dexfile: a buildkit frontend; to Buildkit README.md file
    * exporter: close local export progress writer
    * containerimage: preserve local fallback for default image resolution
    * session: use anonymous registry auth when sessions are unset
    * vendor: github.com/containerd/typeurl/v2 v2.3.0
    * source/http: release resolver cache lock on errors
    * build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    * docs: clarify a caveat with `COPY --link` and overwriting directory permissions
    * vendor: sync dependencies
    * solver/llbsolver: emit native build-completion metrics
    * solver: add per-step CPU and memory resource limits
    * test: stabilize named context transfer tracking
    * build(deps): bump github/codeql-action from 4.35.4 to 4.36.0
    * build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0
    * build(deps): bump docker/github-builder/.github/workflows/bake.yml
    * build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0
    * build(deps): bump docker/bake-action from 7.1.0 to 7.2.0
    * build(deps): bump docker/login-action from 4.1.0 to 4.2.0
    * build(deps): bump github.com/containerd/containerd/v2
    * util/resolver/limited: make registry concurrency configurable by the configuration file
    * http: fix resolver cache nil race
    * dockerfile/docs: fix typo  --excludes
    * Add docs for `HTTP_AUTH_HEADER_` and `HTTP_AUTH_TOKEN_` secrets.
    * Ensure that a wrapped nil isn't returned as it causes a SIGSEGV.
    * Fix sigsegv by ensuring a func is returned in failure case.
    * build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1
    * runcexecutor: change how the runc executor kills runc processes
    * update protolint to v0.56.4
    * update govulncheck to v1.3.0
    * update doctoc to v2.4.1
    * update Buildx to v0.34.0
    * update Delve to v1.26.3
    * lint: modernize Go lint findings
    * lint: update golangci-lint to v2.12.2
    * chore: fix duplicated words in llb, executor and dockerfile_test comments
    * dockerfile: update builtin dockerfile to 1.25
    * hack: switch to gomod-updates
    * test: gate merge diff tests through worker capabilities
    * skip pin race test on workers without merge diff support
    * ci: fix deprecated runner value in github builder workflow
    * vendor: github.com/opencontainers/selinux v1.14.1
    * build(deps): bump crazy-max/.github from 1.7.1 to 1.8.0
    * build(deps): bump the crazy-max-dot-github group with 2 updates
    * solver: fix race in walkProvenance
    * Updated Coverage for dockerfile_test
    * remotecache: propagate details field from registry when included
    * build(deps): bump github/codeql-action from 4.35.3 to 4.35.4
    * build(deps): bump docker/github-builder/.github/workflows/bake.yml
    * solver: fix provenance bridge races
    * client: add `reset` option for local cache exporter
    * Revert "session: use anonymous registry auth when sessions are unset"
    * vendor: update policy-helpers to a39d60132186
    * vendor: github.com/docker/cli v29.4.3
    * build(deps): bump actions/labeler from 6.0.1 to 6.1.0
    * build(deps): bump docker/github-builder/.github/workflows/bake.yml
    * gateway: reduce potential lock contention in gateway forwarder
    * feat: add log level option to buildkitd config
    * version: expose Dockerfile frontend version
    * provenance: add dockerfile frontend version
    * deps: update in-toto-golang to v0.11.0.
    * deps: update patch dependencies
    * deps: update docker cli and seccomp
    * session: use anonymous registry auth when sessions are unset
    * provenance: scrub nested min request inputs
    * vendor: go.opentelemetry.io/otel v1.43.0, otel/contrib v0.68.0
    * vendor: google.golang.org/grpc v1.80.0
    * vendor: golang.org/x/net v0.52.0
    * vendor: golang.org/x/crypto v0.49.0
    * vendor: golang.org/x/sync v0.20.0
    * provenance: record request provenance for LLB refs
    * build(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    * Updated Coverage for heredoc
    * build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
    * git: fix sha256 detection for bundles
    * git: add git bundle source support
    * provenance: include git subdir in configSource
    * build(deps): bump crazy-max/.github from 1.7.0 to 1.7.1
    * build(deps): bump the crazy-max-dot-github group with 2 updates
    * build(deps): bump crazy-max/.github from 1.6.0 to 1.7.0
    * build(deps): bump the crazy-max-dot-github group with 2 updates
    * dockerfile2llb: deep copy cloned image config state
    * Updated Test Coverage for client
    * Updated Test Coverage for addgit
    * otlptracegrpc: remove errNoClient instead of a sentinel error
    * build(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    * session: add timeout for credentialsfunc
    * source/git: add fetch-by-commit support
    * otel: refactor tracing helpers for child processes
    * build(deps): bump docker/github-builder/.github/workflows/bake.yml
    * ci(zizmor): enable secrets-outside-env
    * ci: scope labeler concurrency to the pull request
    * Dockerfile: update containerd v2.1.7, v1.7.31
    * Dockerfile: update containerd v2.2.3
    * vendor: github.com/containerd/containerd/v2 v2.2.3
    * vendor: github.com/Microsoft/hcsshim v0.14.1
    * ci: run compatibility releases via hack/test
    * build(deps): bump actions/cache from 5.0.4 to 5.0.5
    * fix: remove data race in the progress writer
    * client: compatibility test amd64 update
    * build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
    * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
    * build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
    * build(deps): bump actions/github-script from 8.0.0 to 9.0.0
    * build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0
    * github: fix integration tests not running in containerd 2.0
    * Dockerfile: update RootlessKit to v3.0.0
    * Dockerfile: copy docker-engine stage before other stages
    * solver: add compatibility-version support
    * dockerfile: support SOURCE_DATE_EPOCH=<stage>
    * dockerfile: support SOURCE_DATE_EPOCH=context
    * session: tune session healthcheck defaults
    * session: fail stuck session RPCs on health timeout

++++ calamaris:

  - Update to version 2.99.4.8 (the maintained Calamaris "Version 3"
    development line):
    * Support for many more log formats (NetCache, Inktomi Traffic
    Server, OOPS, Cisco Content Engines, Extended Log-file-Format, ...)
    * Optional graphical HTML output (requires the GD::Graph and
    NetAddr::IP Perl modules)
    * Years of accumulated fixes since 2.59
  - Re-point Source/URL to https://cord.de/files/calamaris/
  - Drop 0001_perl.patch: the deprecated defined(%hash) construct it
    fixed is gone upstream
  - Adjust %doc to the files shipped by this release (CHANGES is no
    longer present)

++++ cntlm:

  - Update to version 0.94.0:
    * Source moved to the maintained fork at
    https://github.com/versat/cntlm (upstream SourceForge has been
    dormant since 0.92.3)
    * Adds Kerberos authentication, IPv6 support and proxy PAC file
    support (via a bundled duktape JS engine)
    * Numerous bug fixes accumulated across the 0.93.x / 0.94.x series
  - Drop cntlm-0.92.3-HTTP-1.1-persistent-connections-with-HTTP-1.0-clients.patch:
    merged upstream
  - Drop cntlm-override-CFLAGS-CXXFLAGS-makefile.patch: obsolete; the
    CFLAGS/strip handling is done in the spec instead
  - Modernise the spec: drop the long-dead suse_version < 1230 SysV-init
    paths and other obsolete constructs

++++ containerized-data-importer1.65:

  - Provide/Obsolete the dashed containerized-data-importer-1.65-* subpackages
    in addition to the unversioned containerized-data-importer-* ones, so the
    rename to containerized-data-importer1.65 cleanly replaces the binaries
    briefly shipped to Factory (renaming-a-package; versioned %{version}-%{release}).

++++ coreutils:

  - Switch coreutils-single to build as hardlinks

++++ coreutils-single:

  - Switch coreutils-single to build as hardlinks

++++ coreutils-systemd:

  - Switch coreutils-single to build as hardlinks

++++ coreutils-testsuite:

  - Switch coreutils-single to build as hardlinks

++++ gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ crash:

  - Change spec file conditional that restricts requiring
    kernel-syms-rt to versions >= 1520 and less than 1550 to
    only restrict including it to versions >= 1520. This removes
    the upper version limit on buildrequires kernel-syms-rt

++++ cross-aarch64-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-aarch64-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-amdgcn-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-arm-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-arm-none-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-arm-none-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-avr-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-avr-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-bpf-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-hppa-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-hppa-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-loongarch64-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-loongarch64-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-nvptx-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-ppc64-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-ppc64le-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-ppc64le-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-pru-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-riscv64-elf-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-riscv64-elf-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-riscv64-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-riscv64-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-rx-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-rx-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-s390x-gcc14:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ cross-s390x-gcc14-bootstrap:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ dracut:

  - Update to version 110+suse.35.g9834432:
    * fix(fips): handle zipl (bsc#1262515)
    * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
    * fix(network-legacy): add input validation to RFC 3442 route parser

++++ fail2ban:

  - Modernize specfile constructs
  - Make build recipe compatible with POSIX sh

++++ gap-alnuth:

  - Update to release 4.0.1
    * Updated OSCAR integration for enhanced compatibility with the
    latest OSCAR version.

++++ gcc14-testresults:

  - Update to gcc-14 branch head, 0c553ee07b1aac30b53ce0d72, git12685
    * GCC 14.4 RC1

++++ gnome-settings-daemon:

  - Update to version 50.1+6:
    + Updated translations.

++++ govulncheck:

  - Update to version 1.4.0:
    * cmd/govulncheck: fix exit code propagation for wrapped scan errors
    * go.mod: update golang.org/x dependencies
    * go.mod: update golang.org/x dependencies

++++ gstreamer-plugins-bad:

  - Update to version 1.28.4+24 (boo#1268406, boo#1268408,
    boo#1268410, CVE-2026-52720, CVE-2026-52721, CVE-2026-52722):
    + mxfdemux: fix remaining offsets index entry insertion call site
    + mxfdemux: fix essence track offsets array population
    + mxdemux: index entry: use intialized
    + rtmp2: Remove socket timeout after handshake completes
    + rtmp2: Don't retry on G_IO_ERROR_TIMED_OUT
    + vnmdec: Avoid integer overflows when rectangle positions and
    sizes
    + pcapparse: Add missing bounds checks to ensure packets are
    large enough
    + mpegpsdemux: Release stream lock when seeking fails
    + librfb: Validate framebuffer update rectangles against the
    framebuffer size

++++ helm:

  - Update helm to 4.2.2:
    * Revert: Fixed a race condition in WaitForDelete where the status
    observer canceled the watch too early, causing intermittent
    failures when running a full test suite #32214

++++ ibis:

  - Update to version 0.16.0:
    + Depend on Birb 0.6.1 and migrate to some of its new APIs
    + Add tests to verify that the license headers are consistent
    + Add a Client::stopped signal
    + Move the builders to the imfreedom organization
    + Add a bunch of missing constants
    + Remove the deprecated API
    + Add constants for standard replies and metadata
    + Add Client.connect_async and deprecate Client.connect for it

++++ jakarta-messaging:

  - Fix the license string

++++ jc:

  - Update to version 1.25.7
    * Add csv-ih, tsv, and tsv-ih file parsers for CSV files without
    headers, TSV files, and TSV files without headers. Note that
    these are standard and not streaming parsers so the entire
    CSV/TSV will be loaded into memory. For lazy loading
    equivalents, see below.
    * Add csv-ih-s, tsv-s, and tsv-ih-s streaming file parsers for
    CSV files without headers, TSV files, and TSV files without
    headers. These streaming parsers will lazily load the data
    into memory and may be more suitable for extremely large files.
    * Add typeset and declare Bash internal command parser to convert
    variables simple arrays, and associative arrays along with
    object metadata.
    * Enhance pip-show command parser to add -f show files support.
    * Enhance rsync and rsync-s parsers to add --stats or
  - -info=stats[1-3] fields.
    * Fix certbot command parser to allow parsing of named certs.
    * Fix hashsum command parser to correctly parse the mode
    indicator.
    * Fix ifconfig command parser for incorrect stripping of
    leading zeros in some hex numbers.
    * Fix iptables command parser when Target is blank and verbose
    output is used.
    * Fix lsattr command parser for filenames with spaces (newlines
    in filenames are still not supported).
    * Fix proc-pid-smaps proc parser when unknown VmFlags are output
    * Fix jc.utils.timestamp function and tests for behavior change
    in python 3.15
    * Fix ufw command parser to support rule logging. A new boolean
    log field is introduced.

++++ kernel-default:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-source:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-source-longterm:

  - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE
    then SMB2_CANCEL (git-fixes).
  - Revert "ALSA: timer: Fix UAF at snd_timer_user_params()"
    (git-fixes).
  - commit 9f02549
  - Update config files for v6.18.36.
  - commit 1b24aff
  - Linux 6.18.36 (bsc#1258210).
  - netfilter: require Ethernet MAC header before using eth_hdr()
    (bsc#1258210).
  - cfi: Include uaccess.h for get_kernel_nofault() (bsc#1258210).
  - vsock/virtio: fix skb overhead overflow on 32-bit builds
    (bsc#1258210).
  - block: fix handling of dead zone write plugs (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1258210).
  - arm64: cputype: Add C1-Premium definitions (bsc#1258210).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1258210).
  - vsock/virtio: fix skb overhead accounting to preserve full
    buf_alloc (bsc#1258210).
  - vsock/virtio: fix potential unbounded skb queue (bsc#1258210).
  - ipvs: skip ipv6 extension headers for csum checks (bsc#1258210).
  - RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1258210).
  - RDMA: Move DMA block iterator logic into dedicated files
    (bsc#1258210).
  - RDMA/umem: fix kernel-doc warnings (bsc#1258210).
  - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
    (bsc#1258210).
  - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
    (bsc#1258210).
  - RDMA/umem: Add helpers for umem dmabuf revoke lock (bsc#1258210).
  - RDMA/umem: Move umem dmabuf revoke logic into helper function
    (bsc#1258210).
  - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
    (bsc#1258210).
  - sched_ext: Don't warn on NULL cgrp_moving_from in
    scx_cgroup_move_task() (bsc#1258210).
  - wifi: mac80211: tests: mark HT check strict (bsc#1258210).
  - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check
    in non-strict mode (bsc#1258210).
  - driver core: reject devices with unregistered buses
    (bsc#1258210).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1258210).
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
    (bsc#1258210).
  - drm/amd/display: Fix out-of-bounds read in
    dp_get_eq_aux_rd_interval() (bsc#1258210).
  - drm/amd/display: Fix NULL deref and buffer over-read in SDP
    debugfs (bsc#1258210).
  - drm/amd/display: add missing CSC entries for BT.2020 for DCE
    IPs (bsc#1258210).
  - drm/amd/display: Clamp VBIOS HDMI retimer register count to
    array size (bsc#1258210).
  - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
    (bsc#1258210).
  - drm/amd/display: Bound VBIOS record-chain walk loops
    (bsc#1258210).
  - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
    set_soft_freq_limited_range (bsc#1258210).
  - drm/amd/pm: mark metrics.energy_accumulator is invalid for
    smu 14.0.2 (bsc#1258210).
  - drm/amd/pm: fix smu13 power limit default/cap calculation
    (bsc#1258210).
  - drm/amdgpu: set noretry=1 as default for GFX 10.1.x
    (Navi10/12/14) (bsc#1258210).
  - drm/amdgpu: restart the CS if some parts of the VM are still
    invalidated (bsc#1258210).
  - drm/amdgpu: fix waiting for all submissions for userptrs
    (bsc#1258210).
  - drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1258210).
  - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
    (bsc#1258210).
  - drm/v3d: Fix global performance monitor reference counting
    (bsc#1258210).
  - drm/v3d: Wait for pending L2T flush before cleaning caches
    (bsc#1258210).
  - drm/xe: Clear pending_disable before signaling suspend fence
    (bsc#1258210).
  - drm/xe/display: fix oops in suspend/shutdown without display
    (bsc#1258210).
  - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore
    on GFX11 (bsc#1258210).
  - drm/amdkfd: fix NULL dereference in get_queue_ids()
    (bsc#1258210).
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Initialize controller resources in
    controller (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Register callbacks after creating the
    ngd (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Fix probe error path ordering
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: fix OF node refcount (bsc#1258210).
  - thunderbolt: Limit XDomain response copy to actual frame size
    (bsc#1258210).
  - thunderbolt: Validate XDomain request packet size before type
    cast (bsc#1258210).
  - thunderbolt: Clamp XDomain response data copy to allocation size
    (bsc#1258210).
  - thunderbolt: Bound root directory content to block size
    (bsc#1258210).
  - thunderbolt: Reject zero-length property entries in validator
    (bsc#1258210).
  - sctp: stream: fully roll back denied add-stream state
    (bsc#1258210).
  - sctp: diag: reject stale associations in dump_one path
    (bsc#1258210).
  - rxrpc: Fix the ACK parser to extract the SACK table for parsing
    (bsc#1258210).
  - rtase: Reset TX subqueue when clearing TX ring (bsc#1258210).
  - rtase: Avoid sleeping in get_stats64() (bsc#1258210).
  - pmdomain: ti_sci: add wakeup constraint to parent devices of
    wakeup source (bsc#1258210).
  - pmdomain: imx: fix OF node refcount (bsc#1258210).
  - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    (bsc#1258210).
  - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (bsc#1258210).
  - mmc: litex_mmc: Set mandatory idle clocks before CMD0
    (bsc#1258210).
  - mmc: dw_mmc-rockchip: Add missing private data for very old
    controllers (bsc#1258210).
  - mmc: core: Fix host controller programming for fixed driver type
    (bsc#1258210).
  - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
    (bsc#1258210).
  - mm/list_lru: drain before clearing xarray entry on reparent
    (bsc#1258210).
  - mm/hugetlb: restore reservation on error in hugetlb folio copy
    paths (bsc#1258210).
  - mm/hugetlb: avoid false positive lockdep assertion (bsc#1258210).
  - mm/damon/reclaim: handle ctx allocation failure (bsc#1258210).
  - mm/damon/lru_sort: handle ctx allocation failure (bsc#1258210).
  - mm/cma_debug: fix invalid accesses for inactive CMA areas
    (bsc#1258210).
  - mm/cma: fix reserved page leak on activation failure
    (bsc#1258210).
  - io_uring/wait: fix min_timeout behavior (bsc#1258210).
  - io_uring/kbuf: don't truncate end buffer for bundles
    (bsc#1258210).
  - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
    (bsc#1258210).
  - octeontx2-af: fix memory leak in rvu_setup_hw_resources()
    (bsc#1258210).
  - nvmem: layouts: onie-tlv: fix hang on unknown types
    (bsc#1258210).
  - nvmem: core: fix use-after-free bugs in error paths
    (bsc#1258210).
  - net: sfp: initialize i2c_block_size at adapter configure time
    (bsc#1258210).
  - net: rds: clear i_sends on setup unwind (bsc#1258210).
  - net: phonet: free phonet_device after RCU grace period
    (bsc#1258210).
  - net: mv643xx: fix OF node refcount (bsc#1258210).
  - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    (bsc#1258210).
  - net: airoha: Add NULL check for of_reserved_mem_lookup()
    in airoha_qdma_init_hfwd_queues() (bsc#1258210).
  - net/mlx5: Reorder completion before putting command entry in
    cmd_work_handler (bsc#1258210).
  - firmware: samsung: acpm: Fix mailbox channel leak on probe error
    (bsc#1258210).
  - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    (bsc#1258210).
  - misc: fastrpc: fix DMA address corruption due to find_vma misuse
    (bsc#1258210).
  - misc: fastrpc: fix use-after-free race in fastrpc_map_create
    (bsc#1258210).
  - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue
    context (bsc#1258210).
  - memcg: use round-robin victim selection in refill_stock
    (bsc#1258210).
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    (bsc#1258210).
  - ipc/shm: serialize orphan cleanup with shm_nattch updates
    (bsc#1258210).
  - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
    (bsc#1258210).
  - Input: atkbd - skip deactivate for HONOR BCC-N's internal
    keyboard (bsc#1258210).
  - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    (bsc#1258210).
  - i2c: tegra: Fix NOIRQ suspend/resume (bsc#1258210).
  - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
    (bsc#1258210).
  - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
    (bsc#1258210).
  - i2c: imx: fix clock and pinctrl state inconsistency in runtime
    PM (bsc#1258210).
  - i2c: imx-lpi2c: fix resource leaks switching to
    devm_dma_request_chan() (bsc#1258210).
  - futex/requeue: Prevent NULL pointer dereference in
    remove_waiter() on self-deadlock (bsc#1258210).
  - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
    (bsc#1258210).
  - fuse: reject fuse_notify() pagecache ops on directories
    (bsc#1258210).
  - fs/qnx6: fix pointer arithmetic in directory iteration
    (bsc#1258210).
  - pidfd: refuse access to tasks that have started exiting harder
    (bsc#1258210).
  - inet: frags: fix use-after-free caused by the fqdir_pre_exit()
    flush (bsc#1258210).
  - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
    (bsc#1258210).
  - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
    (bsc#1258210).
  - bnxt_en: Fix NULL pointer dereference (bsc#1258210).
  - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in
    xMR write (bsc#1258210).
  - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
    (bsc#1258210).
  - timers/migration: Fix livelock in tmigr_handle_remote_up()
    (bsc#1258210).
  - vsock/vmci: fix sk_ack_backlog leak on failed handshake
    (bsc#1258210).
  - wifi: nl80211: reject oversized EMA RNR lists (bsc#1258210).
  - wifi: iwlwifi: pcie: simplify the resume flow if fast resume
    is not used (bsc#1258210).
  - xfs: fix rtgroup cleanup in CoW fork repair (bsc#1258210).
  - xfs: fix error returns in CoW fork repair (bsc#1258210).
  - mptcp: add-addr: always drop other suboptions (bsc#1258210).
  - selftests: mptcp: add test for extra_subflows underflow on
    userspace PM (bsc#1258210).
  - mptcp: sockopt: set sockopt on all subflows (bsc#1258210).
  - mptcp: sockopt: check timestamping ret value (bsc#1258210).
  - mptcp: pm: fix extra_subflows underflow on userspace PM subflow
    creation (bsc#1258210).
  - mptcp: allow subflow rcv wnd to shrink (bsc#1258210).
  - mptcp: close TOCTOU race while computing rcv_wnd (bsc#1258210).
  - mptcp: fix retransmission loop when csum is enabled
    (bsc#1258210).
  - arm64: mm: call pagetable dtor when freeing hot-removed page
    tables (bsc#1258210).
  - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
    (bsc#1258210).
  - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword
    I/O (bsc#1258210).
  - ARM: socfpga: Fix OF node refcount leak in SMP setup
    (bsc#1258210).
  - udp: clear skb->dev before running a sockmap verdict
    (bsc#1258210).
  - zram: fix use-after-free in zram_bvec_write_partial()
    (bsc#1258210).
  - RDMA/srp: bound SRP_RSP sense copy by the received length
    (bsc#1258210).
  - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
    (bsc#1258210).
  - RDMA/core: Validate the passed in fops for ib_get_ucaps()
    (bsc#1258210).
  - mm/huge_memory: update file PUD counter before folio_put()
    (bsc#1258210).
  - mm/damon/ops-common: call folio_test_lru() after folio_get()
    (bsc#1258210).
  - mm/huge_memory: update file PMD counter before folio_put()
    (bsc#1258210).
  - drm/amd/display: Reject gpio_bitshift >= 32 in
    bios_parser_get_gpio_pin_info() (bsc#1258210).
  - drm/virtio: fix dma_fence refcount leak on error in
    virtio_gpu_dma_fence_wait() (bsc#1258210).
  - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv
    retries (bsc#1258210).
  - ALSA: timer: Fix UAF at snd_timer_user_params() (bsc#1258210).
  - ALSA: timer: Forcibly close timer instances at closing
    (bsc#1258210).
  - USB: serial: kl5kusb105: fix bulk-out buffer overflow
    (bsc#1258210).
  - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    (bsc#1258210).
  - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
    (bsc#1258210).
  - USB: serial: io_ti: fix heap overflow in get_manuf_info()
    (bsc#1258210).
  - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
    (bsc#1258210).
  - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
    (bsc#1258210).
  - xfrm: espintcp: do not reuse an in-progress partial send
    (bsc#1258210).
  - ksmbd: fix use-after-free of a deferred file_lock on double
    SMB2_CANCEL (bsc#1258210).
  - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
    (bsc#1258210).
  - drm/i915/gem: Fix phys BO pread/pwrite with offset (bsc#1258210).
  - KVM: arm64: Restore POR_EL0 access to host EL0 (bsc#1258210).
  - KVM: SEV: Decouple the need to sync the GHCB SA from the need
    to free the SA (bsc#1258210).
  - KVM: Don't WARN if memory is dirtied without a vCPU when the
    VM is dying (bsc#1258210).
  - mshv: add a missing padding field (bsc#1258210).
  - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock
    calculation (bsc#1258210).
  - rust: kasan/kbuild: fix rustc-option when cross-compiling
    (bsc#1258210).
  - rust: arm64: set uwtable llvm module flag for
    CONFIG_UNWIND_TABLES (bsc#1258210).
  - ARM: Do not select HAVE_RUST when KASAN is enabled (bsc#1258210).
  - rust: x86: support Rust >= 1.98.0 target spec (bsc#1258210).
  - tracing/probes: Point the error offset correctly for eprobe
    argument error (bsc#1258210).
  - tracing: Fix CFI violation in probestub being called by tprobes
    (bsc#1258210).
  - accel/ivpu: Fix signed integer truncation in IPC receive
    (bsc#1258210).
  - accel/ivpu: Add buffer overflow check in MS get_info_ioctl
    (bsc#1258210).
  - accel/ivpu: Add bounds checks for firmware log indices
    (bsc#1258210).
  - mm/memory-failure: fix hugetlb_lock AA deadlock in
    get_huge_page_for_hwpoison (bsc#1258210).
  - soc: qcom: ice: Fix race between qcom_ice_probe() and
    of_qcom_ice_get() (bsc#1258210).
  - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
    (bsc#1258210).
  - Bluetooth: hci_sync: reject oversized Broadcast Announcement
    prepend (bsc#1258210).
  - tee: shm: fix shm leak in register_shm_helper() (bsc#1258210).
  - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR
    register (bsc#1258210).
  - netfilter: nft_tunnel: fix use-after-free on object destroy
    (bsc#1258210).
  - accel/amdxdna: Fix mm_struct reference leak in
    aie2_populate_range() (bsc#1258210).
  - drm/xe: fix refcount leak in xe_range_fence_insert()
    (bsc#1258210).
  - drm/vc4: fix krealloc() memory leak (bsc#1258210).
  - drm/virtio: Fix driver removal with disabled KMS (bsc#1258210).
  - drm/i915/edp: Check supported link rates DPCD read (bsc#1258210).
  - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at
    registration time (bsc#1258210).
  - clk: samsung: gs101: Fix missing USI7_USI DIV clock in
    peric0_clk_regs (bsc#1258210).
  - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
    getting parked (bsc#1258210).
  - KVM: VMX: Update SVI during runtime APICv activation
    (bsc#1258210).
  - ipv6: Fix a potential NPD in cleanup_prefix_route()
    (bsc#1258210).
  - net: txgbe: initialize module info buffer (bsc#1258210).
  - net: txgbe: rename the SFP related (bsc#1258210).
  - net: txgbe: support CR modules for AML devices (bsc#1258210).
  - net: txgbe: optimize the flow to setup PHY for AML devices
    (bsc#1258210).
  - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
    (bsc#1258210).
  - net: mvpp2: refill RX buffers before XDP or skb use
    (bsc#1258210).
  - net: mvpp2: limit XDP frame size to the RX buffer (bsc#1258210).
  - net: mvpp2: sync RX data at the hardware packet offset
    (bsc#1258210).
  - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
    (bsc#1258210).
  - netfilter: nf_log: validate MAC header was set before dumping it
    (bsc#1258210).
  - netfilter: x_tables: avoid leaking percpu counter pointers
    (bsc#1258210).
  - netfilter: nf_conntrack: destroy stale expectfn expectations
    on unregister (bsc#1258210).
  - netfilter: revalidate bridge ports (bsc#1258210).
  - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
    (bsc#1258210).
  - rds: mark snapshot pages dirty in rds_info_getsockopt()
    (bsc#1258210).
  - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
    (bsc#1258210).
  - tun: zero the whole vnet header in tun_put_user() (bsc#1258210).
  - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked
    atomic completion (bsc#1258210).
  - net: guard timestamp cmsgs to real error queue skbs
    (bsc#1258210).
  - sctp: validate embedded INIT chunk and address list lengths
    in cookie (bsc#1258210).
  - ip6_vti: set netns_immutable on the fallback device
    (bsc#1258210).
  - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
    (bsc#1258210).
  - ASoC: SOF: amd: fix for ipc flags check (bsc#1258210).
  - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred
    submission (bsc#1258210).
  - net: mctp: usb: fix race between urb completion and rx_retry
    cancellation (bsc#1258210).
  - gpio: rockchip: fix generic IRQ chip leak on remove
    (bsc#1258210).
  - gpio: zynq: fix runtime PM leak on remove (bsc#1258210).
  - r8152: handle the return value of usb_reset_device()
    (bsc#1258210).
  - net: openvswitch: fix possible kfree_skb of ERR_PTR
    (bsc#1258210).
  - ipv6: sit: reload inner IPv6 header after GSO offloads
    (bsc#1258210).
  - net/mlx5: Use effective affinity mask for IRQ selection
    (bsc#1258210).
  - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit
    failure (bsc#1258210).
  - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
    (bsc#1258210).
  - net: qrtr: fix refcount saturation and potential UAF in
    qrtr_port_remove (bsc#1258210).
  - net: phy: clean the sfp upstream if phy probing fails
    (bsc#1258210).
  - netdev: fix double-free in netdev_nl_bind_rx_doit()
    (bsc#1258210).
  - net: ibm: emac: Fix use-after-free during device removal
    (bsc#1258210).
  - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
    (bsc#1258210).
  - net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1258210).
  - tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1258210).
  - ASoC: wm_adsp: Fix NULL dereference when removing firmware
    controls (bsc#1258210).
  - gpio: mvebu: fix NULL pointer dereference in suspend/resume
    (bsc#1258210).
  - netlabel: validate unlabeled address and mask attribute lengths
    (bsc#1258210).
  - bnge: fix context mem iteration (bsc#1258210).
  - net: ena: PHC: Add missing barrier (bsc#1258210).
  - idpf: fix mailbox capability for set device clock time
    (bsc#1258210).
  - ice: fix missing priority callbacks for U.FL DPLL pins
    (bsc#1258210).
  - xfrm: policy: fix use-after-free on inexact bin in
    xfrm_policy_bysel_ctx() (bsc#1258210).
  - dma-debug: fix physical address retrieval in
    debug_dma_sync_sg_for_device (bsc#1258210).
  - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE
    segments (bsc#1258210).
  - xfrm: iptfs: fix use-after-free on first_skb in
    __input_process_payload (bsc#1258210).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1258210).
  - verification/rvgen: Fix ltl2k writing True as a literal
    (bsc#1258210).
  - verification/rvgen: Fix options shared among commands
    (bsc#1258210).
  - tools/rv: Fix cleanup after failed trace setup (bsc#1258210).
  - tools/rv: Fix substring match when listing container monitors
    (bsc#1258210).
  - tools/rv: Fix substring match bug in monitor name search
    (bsc#1258210).
  - tools/rv: Ensure monitor name and desc are NUL-terminated
    (bsc#1258210).
  - cpufreq/amd-pstate: drop stale @epp_cached kdoc (bsc#1258210).
  - spi: cadence-quadspi: fix unclocked access on unbind
    (bsc#1258210).
  - ALSA: seq: dummy: fix UMP event stack overread (bsc#1258210).
  - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain()
    on linked streams (bsc#1258210).
  - time: Fix off-by-one in settimeofday() usec validation
    (bsc#1258210).
  - hyperv: Clean up and fix the guest ID comment in hvgdk.h
    (bsc#1258210).
  - signal: clear JOBCTL_PENDING_MASK for caller in
    zap_other_threads() (bsc#1258210).
  - selftests: harness: fix pidfd leak in __wait_for_test
    (bsc#1258210).
  - drm/hyperv: During panic do VMBus unload after frame buffer
    is flushed (bsc#1258210).
  - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
    (bsc#1258210).
  - Drivers: hv: VMBus protocol version 6.0 (bsc#1258210).
  - sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1258210).
  - net/802/mrp: fix vector attribute parsing in
    mrp_pdu_parse_vecattr (bsc#1258210).
  - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    (bsc#1258210).
  - vxlan: vnifilter: fix spurious notification on VNI update
    (bsc#1258210).
  - vxlan: vnifilter: send notification on VNI add (bsc#1258210).
  - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
    (bsc#1258210).
  - sctp: validate cached peer INIT chunk length in COOKIE_ECHO
    processing (bsc#1258210).
  - net/sched: fix pedit partial COW leading to page cache corruption
    (bsc#1258210).
  - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata
    dst teardown (bsc#1258210).
  - net: airoha: Fix use-after-free in metadata dst teardown
    (bsc#1258210).
  - ptp: vclock: Switch from RCU to SRCU (bsc#1258210).
  - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1258210).
  - af_unix: Fix inq_len update problem in partial read
    (bsc#1258210).
  - octeontx2-af: Fix initialization of mcam's entry2target_pffunc
    field (bsc#1258210).
  - octeontx2-pf: Fix NDC sync operation errors (bsc#1258210).
  - xsk: cache csum_start/csum_offset to fix TOCTOU in
    xsk_skb_metadata() (bsc#1258210).
  - Bluetooth: MGMT: Fix backward compatibility with userspace
    (bsc#1258210).
  - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
    (bsc#1258210).
  - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route
    calls (bsc#1258210).
  - Bluetooth: ISO: Fix not releasing hdev reference on
    iso_conn_big_sync (bsc#1258210).
  - Bluetooth: fix memory leak in error path of hci_alloc_dev()
    (bsc#1258210).
  - Bluetooth: bnep: reject short frames before parsing
    (bsc#1258210).
  - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
    extension handling (bsc#1258210).
  - Bluetooth: RFCOMM: validate skb length in MCC handlers
    (bsc#1258210).
  - Bluetooth: MGMT: validate advertising TLV before type checks
    (bsc#1258210).
  - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
    (bsc#1258210).
  - wifi: fix leak if split 6 GHz scanning fails (bsc#1258210).
  - ipv6: anycast: insert aca into global hash under idev->lock
    (bsc#1258210).
  - net: fec: fix pinctrl default state restore order on resume
    (bsc#1258210).
  - net: lan743x: permit VLAN-tagged packets up to configured MTU
    (bsc#1258210).
  - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    (bsc#1258210).
  - hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1258210).
  - net: Annotate sk->sk_write_space() for UDP SOCKMAP (bsc#1258210).
  - pcnet32: stop holding device spin lock during napi_complete_done
    (bsc#1258210).
  - wifi: mac80211: limit injected antenna index in
    ieee80211_parse_tx_radiotap (bsc#1258210).
  - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
    (bsc#1258210).
  - devlink: Release nested relation on devlink free (bsc#1258210).
  - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
    (bsc#1258210).
  - 6lowpan: fix off-by-one in multicast context address compression
    (bsc#1258210).
  - net/sched: act_api: use RCU with deferred freeing for action
    lifecycle (bsc#1258210).
  - dm cache policy smq: check allocation under invalidate lock
    (bsc#1258210).
  - netfilter: bridge: make ebt_snat ARP rewrite writable
    (bsc#1258210).
  - netfilter: nft_ct: bail out on template ct in get eval
    (bsc#1258210).
  - netfilter: conntrack_irc: fix possible out-of-bounds read
    (bsc#1258210).
  - netfilter: synproxy: add mutex to guard hook reference counting
    (bsc#1258210).
  - ipvs: clear the svc scheduler ptr early on edit (bsc#1258210).
  - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id (bsc#1258210).
  - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break
    notifiers (bsc#1258210).
  - wifi: iwlwifi: mvm: don't support the reset handshake for old
    firmwares (bsc#1258210).
  - erofs: fix use-after-free on sbi->sync_decompress (bsc#1258210).
  - erofs: tidy up synchronous decompression (bsc#1258210).
  - tee: qcomtee: add missing va_end in early return
    qcomtee_object_user_init() (bsc#1258210).
  - tee: fix tee_ioctl_object_invoke_arg padding (bsc#1258210).
  - soc: qcom: ice: Return -ENODEV if the ICE platform device is
    not found (bsc#1258210).
  - ARM: dts: microchip: sam9x7: fix GMAC clock configuration
    (bsc#1258210).
  - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus)
    and reserve its pins (bsc#1258210).
  - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
    (bsc#1258210).
  - tee: optee: prevent use-after-free when the client exits before
    the supplicant (bsc#1258210).
  - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing
    local DoS (bsc#1258210).
  - ipv6: mcast: Fix use-after-free when processing MLD queries
    (bsc#1258210).
  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (bsc#1258210).
  - KVM: arm64: Take the SRCU lock for page table walks in fault
    injection and AT emulation (bsc#1258210).
  - ARM: fix branch predictor hardening (bsc#1258210).
  - ARM: fix hash_name() fault (bsc#1258210).
  - ARM: allow __do_kernel_fault() to report execution of memory
    faults (bsc#1258210).
  - ARM: group is_permission_fault() with is_translation_fault()
    (bsc#1258210).
  - bpf: Free reuseport cBPF prog after RCU grace period
    (bsc#1258210).
  - commit 0175c69
  - Delete
    patches.kernel.org/drm-gem-Try-to-fix-change_handle-ioctl-attempt-4.patch.
  - commit 4ce1d5d

++++ kernel-docs:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-firmware-bluetooth:

  - Update to version 20260618 (git commit a8f9ebbaa645):
    * QCA: Add bluetooth firmware nvm files for USI/NFA725B
    * linux-firmware: Add firmware file for Intel BlazarIW
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel BlazarI core
    * linux-firmware: Update firmware file for Intel Scorpius core

++++ kernel-firmware-qcom:

  - Update to version 20260618 (git commit a8f9ebbaa645):
    * qcom: update CDSP firmware for glymur platform
    * qcom: update ADSP firmware for qcs615 platform

++++ kernel-firmware-sound:

  - Update to version 20260618 (git commit a8f9ebbaa645):
    * cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops

++++ kernel-kvmsmall:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-longterm:

  - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE
    then SMB2_CANCEL (git-fixes).
  - Revert "ALSA: timer: Fix UAF at snd_timer_user_params()"
    (git-fixes).
  - commit 9f02549
  - Update config files for v6.18.36.
  - commit 1b24aff
  - Linux 6.18.36 (bsc#1258210).
  - netfilter: require Ethernet MAC header before using eth_hdr()
    (bsc#1258210).
  - cfi: Include uaccess.h for get_kernel_nofault() (bsc#1258210).
  - vsock/virtio: fix skb overhead overflow on 32-bit builds
    (bsc#1258210).
  - block: fix handling of dead zone write plugs (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1258210).
  - arm64: cputype: Add C1-Premium definitions (bsc#1258210).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1258210).
  - vsock/virtio: fix skb overhead accounting to preserve full
    buf_alloc (bsc#1258210).
  - vsock/virtio: fix potential unbounded skb queue (bsc#1258210).
  - ipvs: skip ipv6 extension headers for csum checks (bsc#1258210).
  - RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1258210).
  - RDMA: Move DMA block iterator logic into dedicated files
    (bsc#1258210).
  - RDMA/umem: fix kernel-doc warnings (bsc#1258210).
  - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
    (bsc#1258210).
  - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
    (bsc#1258210).
  - RDMA/umem: Add helpers for umem dmabuf revoke lock (bsc#1258210).
  - RDMA/umem: Move umem dmabuf revoke logic into helper function
    (bsc#1258210).
  - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
    (bsc#1258210).
  - sched_ext: Don't warn on NULL cgrp_moving_from in
    scx_cgroup_move_task() (bsc#1258210).
  - wifi: mac80211: tests: mark HT check strict (bsc#1258210).
  - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check
    in non-strict mode (bsc#1258210).
  - driver core: reject devices with unregistered buses
    (bsc#1258210).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1258210).
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
    (bsc#1258210).
  - drm/amd/display: Fix out-of-bounds read in
    dp_get_eq_aux_rd_interval() (bsc#1258210).
  - drm/amd/display: Fix NULL deref and buffer over-read in SDP
    debugfs (bsc#1258210).
  - drm/amd/display: add missing CSC entries for BT.2020 for DCE
    IPs (bsc#1258210).
  - drm/amd/display: Clamp VBIOS HDMI retimer register count to
    array size (bsc#1258210).
  - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
    (bsc#1258210).
  - drm/amd/display: Bound VBIOS record-chain walk loops
    (bsc#1258210).
  - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
    set_soft_freq_limited_range (bsc#1258210).
  - drm/amd/pm: mark metrics.energy_accumulator is invalid for
    smu 14.0.2 (bsc#1258210).
  - drm/amd/pm: fix smu13 power limit default/cap calculation
    (bsc#1258210).
  - drm/amdgpu: set noretry=1 as default for GFX 10.1.x
    (Navi10/12/14) (bsc#1258210).
  - drm/amdgpu: restart the CS if some parts of the VM are still
    invalidated (bsc#1258210).
  - drm/amdgpu: fix waiting for all submissions for userptrs
    (bsc#1258210).
  - drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1258210).
  - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
    (bsc#1258210).
  - drm/v3d: Fix global performance monitor reference counting
    (bsc#1258210).
  - drm/v3d: Wait for pending L2T flush before cleaning caches
    (bsc#1258210).
  - drm/xe: Clear pending_disable before signaling suspend fence
    (bsc#1258210).
  - drm/xe/display: fix oops in suspend/shutdown without display
    (bsc#1258210).
  - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore
    on GFX11 (bsc#1258210).
  - drm/amdkfd: fix NULL dereference in get_queue_ids()
    (bsc#1258210).
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Initialize controller resources in
    controller (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Register callbacks after creating the
    ngd (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Fix probe error path ordering
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: fix OF node refcount (bsc#1258210).
  - thunderbolt: Limit XDomain response copy to actual frame size
    (bsc#1258210).
  - thunderbolt: Validate XDomain request packet size before type
    cast (bsc#1258210).
  - thunderbolt: Clamp XDomain response data copy to allocation size
    (bsc#1258210).
  - thunderbolt: Bound root directory content to block size
    (bsc#1258210).
  - thunderbolt: Reject zero-length property entries in validator
    (bsc#1258210).
  - sctp: stream: fully roll back denied add-stream state
    (bsc#1258210).
  - sctp: diag: reject stale associations in dump_one path
    (bsc#1258210).
  - rxrpc: Fix the ACK parser to extract the SACK table for parsing
    (bsc#1258210).
  - rtase: Reset TX subqueue when clearing TX ring (bsc#1258210).
  - rtase: Avoid sleeping in get_stats64() (bsc#1258210).
  - pmdomain: ti_sci: add wakeup constraint to parent devices of
    wakeup source (bsc#1258210).
  - pmdomain: imx: fix OF node refcount (bsc#1258210).
  - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    (bsc#1258210).
  - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (bsc#1258210).
  - mmc: litex_mmc: Set mandatory idle clocks before CMD0
    (bsc#1258210).
  - mmc: dw_mmc-rockchip: Add missing private data for very old
    controllers (bsc#1258210).
  - mmc: core: Fix host controller programming for fixed driver type
    (bsc#1258210).
  - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
    (bsc#1258210).
  - mm/list_lru: drain before clearing xarray entry on reparent
    (bsc#1258210).
  - mm/hugetlb: restore reservation on error in hugetlb folio copy
    paths (bsc#1258210).
  - mm/hugetlb: avoid false positive lockdep assertion (bsc#1258210).
  - mm/damon/reclaim: handle ctx allocation failure (bsc#1258210).
  - mm/damon/lru_sort: handle ctx allocation failure (bsc#1258210).
  - mm/cma_debug: fix invalid accesses for inactive CMA areas
    (bsc#1258210).
  - mm/cma: fix reserved page leak on activation failure
    (bsc#1258210).
  - io_uring/wait: fix min_timeout behavior (bsc#1258210).
  - io_uring/kbuf: don't truncate end buffer for bundles
    (bsc#1258210).
  - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
    (bsc#1258210).
  - octeontx2-af: fix memory leak in rvu_setup_hw_resources()
    (bsc#1258210).
  - nvmem: layouts: onie-tlv: fix hang on unknown types
    (bsc#1258210).
  - nvmem: core: fix use-after-free bugs in error paths
    (bsc#1258210).
  - net: sfp: initialize i2c_block_size at adapter configure time
    (bsc#1258210).
  - net: rds: clear i_sends on setup unwind (bsc#1258210).
  - net: phonet: free phonet_device after RCU grace period
    (bsc#1258210).
  - net: mv643xx: fix OF node refcount (bsc#1258210).
  - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    (bsc#1258210).
  - net: airoha: Add NULL check for of_reserved_mem_lookup()
    in airoha_qdma_init_hfwd_queues() (bsc#1258210).
  - net/mlx5: Reorder completion before putting command entry in
    cmd_work_handler (bsc#1258210).
  - firmware: samsung: acpm: Fix mailbox channel leak on probe error
    (bsc#1258210).
  - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    (bsc#1258210).
  - misc: fastrpc: fix DMA address corruption due to find_vma misuse
    (bsc#1258210).
  - misc: fastrpc: fix use-after-free race in fastrpc_map_create
    (bsc#1258210).
  - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue
    context (bsc#1258210).
  - memcg: use round-robin victim selection in refill_stock
    (bsc#1258210).
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    (bsc#1258210).
  - ipc/shm: serialize orphan cleanup with shm_nattch updates
    (bsc#1258210).
  - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
    (bsc#1258210).
  - Input: atkbd - skip deactivate for HONOR BCC-N's internal
    keyboard (bsc#1258210).
  - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    (bsc#1258210).
  - i2c: tegra: Fix NOIRQ suspend/resume (bsc#1258210).
  - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
    (bsc#1258210).
  - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
    (bsc#1258210).
  - i2c: imx: fix clock and pinctrl state inconsistency in runtime
    PM (bsc#1258210).
  - i2c: imx-lpi2c: fix resource leaks switching to
    devm_dma_request_chan() (bsc#1258210).
  - futex/requeue: Prevent NULL pointer dereference in
    remove_waiter() on self-deadlock (bsc#1258210).
  - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
    (bsc#1258210).
  - fuse: reject fuse_notify() pagecache ops on directories
    (bsc#1258210).
  - fs/qnx6: fix pointer arithmetic in directory iteration
    (bsc#1258210).
  - pidfd: refuse access to tasks that have started exiting harder
    (bsc#1258210).
  - inet: frags: fix use-after-free caused by the fqdir_pre_exit()
    flush (bsc#1258210).
  - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
    (bsc#1258210).
  - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
    (bsc#1258210).
  - bnxt_en: Fix NULL pointer dereference (bsc#1258210).
  - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in
    xMR write (bsc#1258210).
  - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
    (bsc#1258210).
  - timers/migration: Fix livelock in tmigr_handle_remote_up()
    (bsc#1258210).
  - vsock/vmci: fix sk_ack_backlog leak on failed handshake
    (bsc#1258210).
  - wifi: nl80211: reject oversized EMA RNR lists (bsc#1258210).
  - wifi: iwlwifi: pcie: simplify the resume flow if fast resume
    is not used (bsc#1258210).
  - xfs: fix rtgroup cleanup in CoW fork repair (bsc#1258210).
  - xfs: fix error returns in CoW fork repair (bsc#1258210).
  - mptcp: add-addr: always drop other suboptions (bsc#1258210).
  - selftests: mptcp: add test for extra_subflows underflow on
    userspace PM (bsc#1258210).
  - mptcp: sockopt: set sockopt on all subflows (bsc#1258210).
  - mptcp: sockopt: check timestamping ret value (bsc#1258210).
  - mptcp: pm: fix extra_subflows underflow on userspace PM subflow
    creation (bsc#1258210).
  - mptcp: allow subflow rcv wnd to shrink (bsc#1258210).
  - mptcp: close TOCTOU race while computing rcv_wnd (bsc#1258210).
  - mptcp: fix retransmission loop when csum is enabled
    (bsc#1258210).
  - arm64: mm: call pagetable dtor when freeing hot-removed page
    tables (bsc#1258210).
  - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
    (bsc#1258210).
  - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword
    I/O (bsc#1258210).
  - ARM: socfpga: Fix OF node refcount leak in SMP setup
    (bsc#1258210).
  - udp: clear skb->dev before running a sockmap verdict
    (bsc#1258210).
  - zram: fix use-after-free in zram_bvec_write_partial()
    (bsc#1258210).
  - RDMA/srp: bound SRP_RSP sense copy by the received length
    (bsc#1258210).
  - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
    (bsc#1258210).
  - RDMA/core: Validate the passed in fops for ib_get_ucaps()
    (bsc#1258210).
  - mm/huge_memory: update file PUD counter before folio_put()
    (bsc#1258210).
  - mm/damon/ops-common: call folio_test_lru() after folio_get()
    (bsc#1258210).
  - mm/huge_memory: update file PMD counter before folio_put()
    (bsc#1258210).
  - drm/amd/display: Reject gpio_bitshift >= 32 in
    bios_parser_get_gpio_pin_info() (bsc#1258210).
  - drm/virtio: fix dma_fence refcount leak on error in
    virtio_gpu_dma_fence_wait() (bsc#1258210).
  - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv
    retries (bsc#1258210).
  - ALSA: timer: Fix UAF at snd_timer_user_params() (bsc#1258210).
  - ALSA: timer: Forcibly close timer instances at closing
    (bsc#1258210).
  - USB: serial: kl5kusb105: fix bulk-out buffer overflow
    (bsc#1258210).
  - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    (bsc#1258210).
  - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
    (bsc#1258210).
  - USB: serial: io_ti: fix heap overflow in get_manuf_info()
    (bsc#1258210).
  - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
    (bsc#1258210).
  - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
    (bsc#1258210).
  - xfrm: espintcp: do not reuse an in-progress partial send
    (bsc#1258210).
  - ksmbd: fix use-after-free of a deferred file_lock on double
    SMB2_CANCEL (bsc#1258210).
  - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
    (bsc#1258210).
  - drm/i915/gem: Fix phys BO pread/pwrite with offset (bsc#1258210).
  - KVM: arm64: Restore POR_EL0 access to host EL0 (bsc#1258210).
  - KVM: SEV: Decouple the need to sync the GHCB SA from the need
    to free the SA (bsc#1258210).
  - KVM: Don't WARN if memory is dirtied without a vCPU when the
    VM is dying (bsc#1258210).
  - mshv: add a missing padding field (bsc#1258210).
  - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock
    calculation (bsc#1258210).
  - rust: kasan/kbuild: fix rustc-option when cross-compiling
    (bsc#1258210).
  - rust: arm64: set uwtable llvm module flag for
    CONFIG_UNWIND_TABLES (bsc#1258210).
  - ARM: Do not select HAVE_RUST when KASAN is enabled (bsc#1258210).
  - rust: x86: support Rust >= 1.98.0 target spec (bsc#1258210).
  - tracing/probes: Point the error offset correctly for eprobe
    argument error (bsc#1258210).
  - tracing: Fix CFI violation in probestub being called by tprobes
    (bsc#1258210).
  - accel/ivpu: Fix signed integer truncation in IPC receive
    (bsc#1258210).
  - accel/ivpu: Add buffer overflow check in MS get_info_ioctl
    (bsc#1258210).
  - accel/ivpu: Add bounds checks for firmware log indices
    (bsc#1258210).
  - mm/memory-failure: fix hugetlb_lock AA deadlock in
    get_huge_page_for_hwpoison (bsc#1258210).
  - soc: qcom: ice: Fix race between qcom_ice_probe() and
    of_qcom_ice_get() (bsc#1258210).
  - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
    (bsc#1258210).
  - Bluetooth: hci_sync: reject oversized Broadcast Announcement
    prepend (bsc#1258210).
  - tee: shm: fix shm leak in register_shm_helper() (bsc#1258210).
  - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR
    register (bsc#1258210).
  - netfilter: nft_tunnel: fix use-after-free on object destroy
    (bsc#1258210).
  - accel/amdxdna: Fix mm_struct reference leak in
    aie2_populate_range() (bsc#1258210).
  - drm/xe: fix refcount leak in xe_range_fence_insert()
    (bsc#1258210).
  - drm/vc4: fix krealloc() memory leak (bsc#1258210).
  - drm/virtio: Fix driver removal with disabled KMS (bsc#1258210).
  - drm/i915/edp: Check supported link rates DPCD read (bsc#1258210).
  - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at
    registration time (bsc#1258210).
  - clk: samsung: gs101: Fix missing USI7_USI DIV clock in
    peric0_clk_regs (bsc#1258210).
  - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
    getting parked (bsc#1258210).
  - KVM: VMX: Update SVI during runtime APICv activation
    (bsc#1258210).
  - ipv6: Fix a potential NPD in cleanup_prefix_route()
    (bsc#1258210).
  - net: txgbe: initialize module info buffer (bsc#1258210).
  - net: txgbe: rename the SFP related (bsc#1258210).
  - net: txgbe: support CR modules for AML devices (bsc#1258210).
  - net: txgbe: optimize the flow to setup PHY for AML devices
    (bsc#1258210).
  - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
    (bsc#1258210).
  - net: mvpp2: refill RX buffers before XDP or skb use
    (bsc#1258210).
  - net: mvpp2: limit XDP frame size to the RX buffer (bsc#1258210).
  - net: mvpp2: sync RX data at the hardware packet offset
    (bsc#1258210).
  - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
    (bsc#1258210).
  - netfilter: nf_log: validate MAC header was set before dumping it
    (bsc#1258210).
  - netfilter: x_tables: avoid leaking percpu counter pointers
    (bsc#1258210).
  - netfilter: nf_conntrack: destroy stale expectfn expectations
    on unregister (bsc#1258210).
  - netfilter: revalidate bridge ports (bsc#1258210).
  - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
    (bsc#1258210).
  - rds: mark snapshot pages dirty in rds_info_getsockopt()
    (bsc#1258210).
  - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
    (bsc#1258210).
  - tun: zero the whole vnet header in tun_put_user() (bsc#1258210).
  - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked
    atomic completion (bsc#1258210).
  - net: guard timestamp cmsgs to real error queue skbs
    (bsc#1258210).
  - sctp: validate embedded INIT chunk and address list lengths
    in cookie (bsc#1258210).
  - ip6_vti: set netns_immutable on the fallback device
    (bsc#1258210).
  - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
    (bsc#1258210).
  - ASoC: SOF: amd: fix for ipc flags check (bsc#1258210).
  - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred
    submission (bsc#1258210).
  - net: mctp: usb: fix race between urb completion and rx_retry
    cancellation (bsc#1258210).
  - gpio: rockchip: fix generic IRQ chip leak on remove
    (bsc#1258210).
  - gpio: zynq: fix runtime PM leak on remove (bsc#1258210).
  - r8152: handle the return value of usb_reset_device()
    (bsc#1258210).
  - net: openvswitch: fix possible kfree_skb of ERR_PTR
    (bsc#1258210).
  - ipv6: sit: reload inner IPv6 header after GSO offloads
    (bsc#1258210).
  - net/mlx5: Use effective affinity mask for IRQ selection
    (bsc#1258210).
  - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit
    failure (bsc#1258210).
  - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
    (bsc#1258210).
  - net: qrtr: fix refcount saturation and potential UAF in
    qrtr_port_remove (bsc#1258210).
  - net: phy: clean the sfp upstream if phy probing fails
    (bsc#1258210).
  - netdev: fix double-free in netdev_nl_bind_rx_doit()
    (bsc#1258210).
  - net: ibm: emac: Fix use-after-free during device removal
    (bsc#1258210).
  - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
    (bsc#1258210).
  - net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1258210).
  - tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1258210).
  - ASoC: wm_adsp: Fix NULL dereference when removing firmware
    controls (bsc#1258210).
  - gpio: mvebu: fix NULL pointer dereference in suspend/resume
    (bsc#1258210).
  - netlabel: validate unlabeled address and mask attribute lengths
    (bsc#1258210).
  - bnge: fix context mem iteration (bsc#1258210).
  - net: ena: PHC: Add missing barrier (bsc#1258210).
  - idpf: fix mailbox capability for set device clock time
    (bsc#1258210).
  - ice: fix missing priority callbacks for U.FL DPLL pins
    (bsc#1258210).
  - xfrm: policy: fix use-after-free on inexact bin in
    xfrm_policy_bysel_ctx() (bsc#1258210).
  - dma-debug: fix physical address retrieval in
    debug_dma_sync_sg_for_device (bsc#1258210).
  - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE
    segments (bsc#1258210).
  - xfrm: iptfs: fix use-after-free on first_skb in
    __input_process_payload (bsc#1258210).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1258210).
  - verification/rvgen: Fix ltl2k writing True as a literal
    (bsc#1258210).
  - verification/rvgen: Fix options shared among commands
    (bsc#1258210).
  - tools/rv: Fix cleanup after failed trace setup (bsc#1258210).
  - tools/rv: Fix substring match when listing container monitors
    (bsc#1258210).
  - tools/rv: Fix substring match bug in monitor name search
    (bsc#1258210).
  - tools/rv: Ensure monitor name and desc are NUL-terminated
    (bsc#1258210).
  - cpufreq/amd-pstate: drop stale @epp_cached kdoc (bsc#1258210).
  - spi: cadence-quadspi: fix unclocked access on unbind
    (bsc#1258210).
  - ALSA: seq: dummy: fix UMP event stack overread (bsc#1258210).
  - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain()
    on linked streams (bsc#1258210).
  - time: Fix off-by-one in settimeofday() usec validation
    (bsc#1258210).
  - hyperv: Clean up and fix the guest ID comment in hvgdk.h
    (bsc#1258210).
  - signal: clear JOBCTL_PENDING_MASK for caller in
    zap_other_threads() (bsc#1258210).
  - selftests: harness: fix pidfd leak in __wait_for_test
    (bsc#1258210).
  - drm/hyperv: During panic do VMBus unload after frame buffer
    is flushed (bsc#1258210).
  - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
    (bsc#1258210).
  - Drivers: hv: VMBus protocol version 6.0 (bsc#1258210).
  - sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1258210).
  - net/802/mrp: fix vector attribute parsing in
    mrp_pdu_parse_vecattr (bsc#1258210).
  - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    (bsc#1258210).
  - vxlan: vnifilter: fix spurious notification on VNI update
    (bsc#1258210).
  - vxlan: vnifilter: send notification on VNI add (bsc#1258210).
  - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
    (bsc#1258210).
  - sctp: validate cached peer INIT chunk length in COOKIE_ECHO
    processing (bsc#1258210).
  - net/sched: fix pedit partial COW leading to page cache corruption
    (bsc#1258210).
  - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata
    dst teardown (bsc#1258210).
  - net: airoha: Fix use-after-free in metadata dst teardown
    (bsc#1258210).
  - ptp: vclock: Switch from RCU to SRCU (bsc#1258210).
  - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1258210).
  - af_unix: Fix inq_len update problem in partial read
    (bsc#1258210).
  - octeontx2-af: Fix initialization of mcam's entry2target_pffunc
    field (bsc#1258210).
  - octeontx2-pf: Fix NDC sync operation errors (bsc#1258210).
  - xsk: cache csum_start/csum_offset to fix TOCTOU in
    xsk_skb_metadata() (bsc#1258210).
  - Bluetooth: MGMT: Fix backward compatibility with userspace
    (bsc#1258210).
  - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
    (bsc#1258210).
  - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route
    calls (bsc#1258210).
  - Bluetooth: ISO: Fix not releasing hdev reference on
    iso_conn_big_sync (bsc#1258210).
  - Bluetooth: fix memory leak in error path of hci_alloc_dev()
    (bsc#1258210).
  - Bluetooth: bnep: reject short frames before parsing
    (bsc#1258210).
  - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
    extension handling (bsc#1258210).
  - Bluetooth: RFCOMM: validate skb length in MCC handlers
    (bsc#1258210).
  - Bluetooth: MGMT: validate advertising TLV before type checks
    (bsc#1258210).
  - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
    (bsc#1258210).
  - wifi: fix leak if split 6 GHz scanning fails (bsc#1258210).
  - ipv6: anycast: insert aca into global hash under idev->lock
    (bsc#1258210).
  - net: fec: fix pinctrl default state restore order on resume
    (bsc#1258210).
  - net: lan743x: permit VLAN-tagged packets up to configured MTU
    (bsc#1258210).
  - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    (bsc#1258210).
  - hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1258210).
  - net: Annotate sk->sk_write_space() for UDP SOCKMAP (bsc#1258210).
  - pcnet32: stop holding device spin lock during napi_complete_done
    (bsc#1258210).
  - wifi: mac80211: limit injected antenna index in
    ieee80211_parse_tx_radiotap (bsc#1258210).
  - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
    (bsc#1258210).
  - devlink: Release nested relation on devlink free (bsc#1258210).
  - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
    (bsc#1258210).
  - 6lowpan: fix off-by-one in multicast context address compression
    (bsc#1258210).
  - net/sched: act_api: use RCU with deferred freeing for action
    lifecycle (bsc#1258210).
  - dm cache policy smq: check allocation under invalidate lock
    (bsc#1258210).
  - netfilter: bridge: make ebt_snat ARP rewrite writable
    (bsc#1258210).
  - netfilter: nft_ct: bail out on template ct in get eval
    (bsc#1258210).
  - netfilter: conntrack_irc: fix possible out-of-bounds read
    (bsc#1258210).
  - netfilter: synproxy: add mutex to guard hook reference counting
    (bsc#1258210).
  - ipvs: clear the svc scheduler ptr early on edit (bsc#1258210).
  - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id (bsc#1258210).
  - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break
    notifiers (bsc#1258210).
  - wifi: iwlwifi: mvm: don't support the reset handshake for old
    firmwares (bsc#1258210).
  - erofs: fix use-after-free on sbi->sync_decompress (bsc#1258210).
  - erofs: tidy up synchronous decompression (bsc#1258210).
  - tee: qcomtee: add missing va_end in early return
    qcomtee_object_user_init() (bsc#1258210).
  - tee: fix tee_ioctl_object_invoke_arg padding (bsc#1258210).
  - soc: qcom: ice: Return -ENODEV if the ICE platform device is
    not found (bsc#1258210).
  - ARM: dts: microchip: sam9x7: fix GMAC clock configuration
    (bsc#1258210).
  - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus)
    and reserve its pins (bsc#1258210).
  - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
    (bsc#1258210).
  - tee: optee: prevent use-after-free when the client exits before
    the supplicant (bsc#1258210).
  - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing
    local DoS (bsc#1258210).
  - ipv6: mcast: Fix use-after-free when processing MLD queries
    (bsc#1258210).
  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (bsc#1258210).
  - KVM: arm64: Take the SRCU lock for page table walks in fault
    injection and AT emulation (bsc#1258210).
  - ARM: fix branch predictor hardening (bsc#1258210).
  - ARM: fix hash_name() fault (bsc#1258210).
  - ARM: allow __do_kernel_fault() to report execution of memory
    faults (bsc#1258210).
  - ARM: group is_permission_fault() with is_translation_fault()
    (bsc#1258210).
  - bpf: Free reuseport cBPF prog after RCU grace period
    (bsc#1258210).
  - commit 0175c69
  - Delete
    patches.kernel.org/drm-gem-Try-to-fix-change_handle-ioctl-attempt-4.patch.
  - commit 4ce1d5d

++++ kernel-obs-build:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-obs-qa:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-syms:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kernel-syms-longterm:

  - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE
    then SMB2_CANCEL (git-fixes).
  - Revert "ALSA: timer: Fix UAF at snd_timer_user_params()"
    (git-fixes).
  - commit 9f02549
  - Update config files for v6.18.36.
  - commit 1b24aff
  - Linux 6.18.36 (bsc#1258210).
  - netfilter: require Ethernet MAC header before using eth_hdr()
    (bsc#1258210).
  - cfi: Include uaccess.h for get_kernel_nofault() (bsc#1258210).
  - vsock/virtio: fix skb overhead overflow on 32-bit builds
    (bsc#1258210).
  - block: fix handling of dead zone write plugs (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt
    100 CPU (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    (bsc#1258210).
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    (bsc#1258210).
  - arm64: cputype: Add C1-Premium definitions (bsc#1258210).
  - arm64: cputype: Add C1-Ultra definitions (bsc#1258210).
  - vsock/virtio: fix skb overhead accounting to preserve full
    buf_alloc (bsc#1258210).
  - vsock/virtio: fix potential unbounded skb queue (bsc#1258210).
  - ipvs: skip ipv6 extension headers for csum checks (bsc#1258210).
  - RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1258210).
  - RDMA: Move DMA block iterator logic into dedicated files
    (bsc#1258210).
  - RDMA/umem: fix kernel-doc warnings (bsc#1258210).
  - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
    (bsc#1258210).
  - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
    (bsc#1258210).
  - RDMA/umem: Add helpers for umem dmabuf revoke lock (bsc#1258210).
  - RDMA/umem: Move umem dmabuf revoke logic into helper function
    (bsc#1258210).
  - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
    (bsc#1258210).
  - sched_ext: Don't warn on NULL cgrp_moving_from in
    scx_cgroup_move_task() (bsc#1258210).
  - wifi: mac80211: tests: mark HT check strict (bsc#1258210).
  - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check
    in non-strict mode (bsc#1258210).
  - driver core: reject devices with unregistered buses
    (bsc#1258210).
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    (bsc#1258210).
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
    (bsc#1258210).
  - drm/amd/display: Fix out-of-bounds read in
    dp_get_eq_aux_rd_interval() (bsc#1258210).
  - drm/amd/display: Fix NULL deref and buffer over-read in SDP
    debugfs (bsc#1258210).
  - drm/amd/display: add missing CSC entries for BT.2020 for DCE
    IPs (bsc#1258210).
  - drm/amd/display: Clamp VBIOS HDMI retimer register count to
    array size (bsc#1258210).
  - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
    (bsc#1258210).
  - drm/amd/display: Bound VBIOS record-chain walk loops
    (bsc#1258210).
  - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
    set_soft_freq_limited_range (bsc#1258210).
  - drm/amd/pm: mark metrics.energy_accumulator is invalid for
    smu 14.0.2 (bsc#1258210).
  - drm/amd/pm: fix smu13 power limit default/cap calculation
    (bsc#1258210).
  - drm/amdgpu: set noretry=1 as default for GFX 10.1.x
    (Navi10/12/14) (bsc#1258210).
  - drm/amdgpu: restart the CS if some parts of the VM are still
    invalidated (bsc#1258210).
  - drm/amdgpu: fix waiting for all submissions for userptrs
    (bsc#1258210).
  - drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1258210).
  - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
    (bsc#1258210).
  - drm/v3d: Fix global performance monitor reference counting
    (bsc#1258210).
  - drm/v3d: Wait for pending L2T flush before cleaning caches
    (bsc#1258210).
  - drm/xe: Clear pending_disable before signaling suspend fence
    (bsc#1258210).
  - drm/xe/display: fix oops in suspend/shutdown without display
    (bsc#1258210).
  - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore
    on GFX11 (bsc#1258210).
  - drm/amdkfd: fix NULL dereference in get_queue_ids()
    (bsc#1258210).
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Initialize controller resources in
    controller (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Register callbacks after creating the
    ngd (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Fix probe error path ordering
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
    (bsc#1258210).
  - slimbus: qcom-ngd-ctrl: fix OF node refcount (bsc#1258210).
  - thunderbolt: Limit XDomain response copy to actual frame size
    (bsc#1258210).
  - thunderbolt: Validate XDomain request packet size before type
    cast (bsc#1258210).
  - thunderbolt: Clamp XDomain response data copy to allocation size
    (bsc#1258210).
  - thunderbolt: Bound root directory content to block size
    (bsc#1258210).
  - thunderbolt: Reject zero-length property entries in validator
    (bsc#1258210).
  - sctp: stream: fully roll back denied add-stream state
    (bsc#1258210).
  - sctp: diag: reject stale associations in dump_one path
    (bsc#1258210).
  - rxrpc: Fix the ACK parser to extract the SACK table for parsing
    (bsc#1258210).
  - rtase: Reset TX subqueue when clearing TX ring (bsc#1258210).
  - rtase: Avoid sleeping in get_stats64() (bsc#1258210).
  - pmdomain: ti_sci: add wakeup constraint to parent devices of
    wakeup source (bsc#1258210).
  - pmdomain: imx: fix OF node refcount (bsc#1258210).
  - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    (bsc#1258210).
  - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (bsc#1258210).
  - mmc: litex_mmc: Set mandatory idle clocks before CMD0
    (bsc#1258210).
  - mmc: dw_mmc-rockchip: Add missing private data for very old
    controllers (bsc#1258210).
  - mmc: core: Fix host controller programming for fixed driver type
    (bsc#1258210).
  - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
    (bsc#1258210).
  - mm/list_lru: drain before clearing xarray entry on reparent
    (bsc#1258210).
  - mm/hugetlb: restore reservation on error in hugetlb folio copy
    paths (bsc#1258210).
  - mm/hugetlb: avoid false positive lockdep assertion (bsc#1258210).
  - mm/damon/reclaim: handle ctx allocation failure (bsc#1258210).
  - mm/damon/lru_sort: handle ctx allocation failure (bsc#1258210).
  - mm/cma_debug: fix invalid accesses for inactive CMA areas
    (bsc#1258210).
  - mm/cma: fix reserved page leak on activation failure
    (bsc#1258210).
  - io_uring/wait: fix min_timeout behavior (bsc#1258210).
  - io_uring/kbuf: don't truncate end buffer for bundles
    (bsc#1258210).
  - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
    (bsc#1258210).
  - octeontx2-af: fix memory leak in rvu_setup_hw_resources()
    (bsc#1258210).
  - nvmem: layouts: onie-tlv: fix hang on unknown types
    (bsc#1258210).
  - nvmem: core: fix use-after-free bugs in error paths
    (bsc#1258210).
  - net: sfp: initialize i2c_block_size at adapter configure time
    (bsc#1258210).
  - net: rds: clear i_sends on setup unwind (bsc#1258210).
  - net: phonet: free phonet_device after RCU grace period
    (bsc#1258210).
  - net: mv643xx: fix OF node refcount (bsc#1258210).
  - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    (bsc#1258210).
  - net: airoha: Add NULL check for of_reserved_mem_lookup()
    in airoha_qdma_init_hfwd_queues() (bsc#1258210).
  - net/mlx5: Reorder completion before putting command entry in
    cmd_work_handler (bsc#1258210).
  - firmware: samsung: acpm: Fix mailbox channel leak on probe error
    (bsc#1258210).
  - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    (bsc#1258210).
  - misc: fastrpc: fix DMA address corruption due to find_vma misuse
    (bsc#1258210).
  - misc: fastrpc: fix use-after-free race in fastrpc_map_create
    (bsc#1258210).
  - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue
    context (bsc#1258210).
  - memcg: use round-robin victim selection in refill_stock
    (bsc#1258210).
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    (bsc#1258210).
  - ipc/shm: serialize orphan cleanup with shm_nattch updates
    (bsc#1258210).
  - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
    (bsc#1258210).
  - Input: atkbd - skip deactivate for HONOR BCC-N's internal
    keyboard (bsc#1258210).
  - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    (bsc#1258210).
  - i2c: tegra: Fix NOIRQ suspend/resume (bsc#1258210).
  - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
    (bsc#1258210).
  - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
    (bsc#1258210).
  - i2c: imx: fix clock and pinctrl state inconsistency in runtime
    PM (bsc#1258210).
  - i2c: imx-lpi2c: fix resource leaks switching to
    devm_dma_request_chan() (bsc#1258210).
  - futex/requeue: Prevent NULL pointer dereference in
    remove_waiter() on self-deadlock (bsc#1258210).
  - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
    (bsc#1258210).
  - fuse: reject fuse_notify() pagecache ops on directories
    (bsc#1258210).
  - fs/qnx6: fix pointer arithmetic in directory iteration
    (bsc#1258210).
  - pidfd: refuse access to tasks that have started exiting harder
    (bsc#1258210).
  - inet: frags: fix use-after-free caused by the fqdir_pre_exit()
    flush (bsc#1258210).
  - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
    (bsc#1258210).
  - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
    (bsc#1258210).
  - bnxt_en: Fix NULL pointer dereference (bsc#1258210).
  - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in
    xMR write (bsc#1258210).
  - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
    (bsc#1258210).
  - timers/migration: Fix livelock in tmigr_handle_remote_up()
    (bsc#1258210).
  - vsock/vmci: fix sk_ack_backlog leak on failed handshake
    (bsc#1258210).
  - wifi: nl80211: reject oversized EMA RNR lists (bsc#1258210).
  - wifi: iwlwifi: pcie: simplify the resume flow if fast resume
    is not used (bsc#1258210).
  - xfs: fix rtgroup cleanup in CoW fork repair (bsc#1258210).
  - xfs: fix error returns in CoW fork repair (bsc#1258210).
  - mptcp: add-addr: always drop other suboptions (bsc#1258210).
  - selftests: mptcp: add test for extra_subflows underflow on
    userspace PM (bsc#1258210).
  - mptcp: sockopt: set sockopt on all subflows (bsc#1258210).
  - mptcp: sockopt: check timestamping ret value (bsc#1258210).
  - mptcp: pm: fix extra_subflows underflow on userspace PM subflow
    creation (bsc#1258210).
  - mptcp: allow subflow rcv wnd to shrink (bsc#1258210).
  - mptcp: close TOCTOU race while computing rcv_wnd (bsc#1258210).
  - mptcp: fix retransmission loop when csum is enabled
    (bsc#1258210).
  - arm64: mm: call pagetable dtor when freeing hot-removed page
    tables (bsc#1258210).
  - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
    (bsc#1258210).
  - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword
    I/O (bsc#1258210).
  - ARM: socfpga: Fix OF node refcount leak in SMP setup
    (bsc#1258210).
  - udp: clear skb->dev before running a sockmap verdict
    (bsc#1258210).
  - zram: fix use-after-free in zram_bvec_write_partial()
    (bsc#1258210).
  - RDMA/srp: bound SRP_RSP sense copy by the received length
    (bsc#1258210).
  - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
    (bsc#1258210).
  - RDMA/core: Validate the passed in fops for ib_get_ucaps()
    (bsc#1258210).
  - mm/huge_memory: update file PUD counter before folio_put()
    (bsc#1258210).
  - mm/damon/ops-common: call folio_test_lru() after folio_get()
    (bsc#1258210).
  - mm/huge_memory: update file PMD counter before folio_put()
    (bsc#1258210).
  - drm/amd/display: Reject gpio_bitshift >= 32 in
    bios_parser_get_gpio_pin_info() (bsc#1258210).
  - drm/virtio: fix dma_fence refcount leak on error in
    virtio_gpu_dma_fence_wait() (bsc#1258210).
  - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv
    retries (bsc#1258210).
  - ALSA: timer: Fix UAF at snd_timer_user_params() (bsc#1258210).
  - ALSA: timer: Forcibly close timer instances at closing
    (bsc#1258210).
  - USB: serial: kl5kusb105: fix bulk-out buffer overflow
    (bsc#1258210).
  - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    (bsc#1258210).
  - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
    (bsc#1258210).
  - USB: serial: io_ti: fix heap overflow in get_manuf_info()
    (bsc#1258210).
  - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
    (bsc#1258210).
  - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
    (bsc#1258210).
  - xfrm: espintcp: do not reuse an in-progress partial send
    (bsc#1258210).
  - ksmbd: fix use-after-free of a deferred file_lock on double
    SMB2_CANCEL (bsc#1258210).
  - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
    (bsc#1258210).
  - drm/i915/gem: Fix phys BO pread/pwrite with offset (bsc#1258210).
  - KVM: arm64: Restore POR_EL0 access to host EL0 (bsc#1258210).
  - KVM: SEV: Decouple the need to sync the GHCB SA from the need
    to free the SA (bsc#1258210).
  - KVM: Don't WARN if memory is dirtied without a vCPU when the
    VM is dying (bsc#1258210).
  - mshv: add a missing padding field (bsc#1258210).
  - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock
    calculation (bsc#1258210).
  - rust: kasan/kbuild: fix rustc-option when cross-compiling
    (bsc#1258210).
  - rust: arm64: set uwtable llvm module flag for
    CONFIG_UNWIND_TABLES (bsc#1258210).
  - ARM: Do not select HAVE_RUST when KASAN is enabled (bsc#1258210).
  - rust: x86: support Rust >= 1.98.0 target spec (bsc#1258210).
  - tracing/probes: Point the error offset correctly for eprobe
    argument error (bsc#1258210).
  - tracing: Fix CFI violation in probestub being called by tprobes
    (bsc#1258210).
  - accel/ivpu: Fix signed integer truncation in IPC receive
    (bsc#1258210).
  - accel/ivpu: Add buffer overflow check in MS get_info_ioctl
    (bsc#1258210).
  - accel/ivpu: Add bounds checks for firmware log indices
    (bsc#1258210).
  - mm/memory-failure: fix hugetlb_lock AA deadlock in
    get_huge_page_for_hwpoison (bsc#1258210).
  - soc: qcom: ice: Fix race between qcom_ice_probe() and
    of_qcom_ice_get() (bsc#1258210).
  - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
    (bsc#1258210).
  - Bluetooth: hci_sync: reject oversized Broadcast Announcement
    prepend (bsc#1258210).
  - tee: shm: fix shm leak in register_shm_helper() (bsc#1258210).
  - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR
    register (bsc#1258210).
  - netfilter: nft_tunnel: fix use-after-free on object destroy
    (bsc#1258210).
  - accel/amdxdna: Fix mm_struct reference leak in
    aie2_populate_range() (bsc#1258210).
  - drm/xe: fix refcount leak in xe_range_fence_insert()
    (bsc#1258210).
  - drm/vc4: fix krealloc() memory leak (bsc#1258210).
  - drm/virtio: Fix driver removal with disabled KMS (bsc#1258210).
  - drm/i915/edp: Check supported link rates DPCD read (bsc#1258210).
  - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at
    registration time (bsc#1258210).
  - clk: samsung: gs101: Fix missing USI7_USI DIV clock in
    peric0_clk_regs (bsc#1258210).
  - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
    getting parked (bsc#1258210).
  - KVM: VMX: Update SVI during runtime APICv activation
    (bsc#1258210).
  - ipv6: Fix a potential NPD in cleanup_prefix_route()
    (bsc#1258210).
  - net: txgbe: initialize module info buffer (bsc#1258210).
  - net: txgbe: rename the SFP related (bsc#1258210).
  - net: txgbe: support CR modules for AML devices (bsc#1258210).
  - net: txgbe: optimize the flow to setup PHY for AML devices
    (bsc#1258210).
  - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
    (bsc#1258210).
  - net: mvpp2: refill RX buffers before XDP or skb use
    (bsc#1258210).
  - net: mvpp2: limit XDP frame size to the RX buffer (bsc#1258210).
  - net: mvpp2: sync RX data at the hardware packet offset
    (bsc#1258210).
  - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
    (bsc#1258210).
  - netfilter: nf_log: validate MAC header was set before dumping it
    (bsc#1258210).
  - netfilter: x_tables: avoid leaking percpu counter pointers
    (bsc#1258210).
  - netfilter: nf_conntrack: destroy stale expectfn expectations
    on unregister (bsc#1258210).
  - netfilter: revalidate bridge ports (bsc#1258210).
  - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
    (bsc#1258210).
  - rds: mark snapshot pages dirty in rds_info_getsockopt()
    (bsc#1258210).
  - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
    (bsc#1258210).
  - tun: zero the whole vnet header in tun_put_user() (bsc#1258210).
  - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked
    atomic completion (bsc#1258210).
  - net: guard timestamp cmsgs to real error queue skbs
    (bsc#1258210).
  - sctp: validate embedded INIT chunk and address list lengths
    in cookie (bsc#1258210).
  - ip6_vti: set netns_immutable on the fallback device
    (bsc#1258210).
  - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
    (bsc#1258210).
  - ASoC: SOF: amd: fix for ipc flags check (bsc#1258210).
  - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred
    submission (bsc#1258210).
  - net: mctp: usb: fix race between urb completion and rx_retry
    cancellation (bsc#1258210).
  - gpio: rockchip: fix generic IRQ chip leak on remove
    (bsc#1258210).
  - gpio: zynq: fix runtime PM leak on remove (bsc#1258210).
  - r8152: handle the return value of usb_reset_device()
    (bsc#1258210).
  - net: openvswitch: fix possible kfree_skb of ERR_PTR
    (bsc#1258210).
  - ipv6: sit: reload inner IPv6 header after GSO offloads
    (bsc#1258210).
  - net/mlx5: Use effective affinity mask for IRQ selection
    (bsc#1258210).
  - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit
    failure (bsc#1258210).
  - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
    (bsc#1258210).
  - net: qrtr: fix refcount saturation and potential UAF in
    qrtr_port_remove (bsc#1258210).
  - net: phy: clean the sfp upstream if phy probing fails
    (bsc#1258210).
  - netdev: fix double-free in netdev_nl_bind_rx_doit()
    (bsc#1258210).
  - net: ibm: emac: Fix use-after-free during device removal
    (bsc#1258210).
  - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
    (bsc#1258210).
  - net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1258210).
  - tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1258210).
  - ASoC: wm_adsp: Fix NULL dereference when removing firmware
    controls (bsc#1258210).
  - gpio: mvebu: fix NULL pointer dereference in suspend/resume
    (bsc#1258210).
  - netlabel: validate unlabeled address and mask attribute lengths
    (bsc#1258210).
  - bnge: fix context mem iteration (bsc#1258210).
  - net: ena: PHC: Add missing barrier (bsc#1258210).
  - idpf: fix mailbox capability for set device clock time
    (bsc#1258210).
  - ice: fix missing priority callbacks for U.FL DPLL pins
    (bsc#1258210).
  - xfrm: policy: fix use-after-free on inexact bin in
    xfrm_policy_bysel_ctx() (bsc#1258210).
  - dma-debug: fix physical address retrieval in
    debug_dma_sync_sg_for_device (bsc#1258210).
  - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE
    segments (bsc#1258210).
  - xfrm: iptfs: fix use-after-free on first_skb in
    __input_process_payload (bsc#1258210).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1258210).
  - verification/rvgen: Fix ltl2k writing True as a literal
    (bsc#1258210).
  - verification/rvgen: Fix options shared among commands
    (bsc#1258210).
  - tools/rv: Fix cleanup after failed trace setup (bsc#1258210).
  - tools/rv: Fix substring match when listing container monitors
    (bsc#1258210).
  - tools/rv: Fix substring match bug in monitor name search
    (bsc#1258210).
  - tools/rv: Ensure monitor name and desc are NUL-terminated
    (bsc#1258210).
  - cpufreq/amd-pstate: drop stale @epp_cached kdoc (bsc#1258210).
  - spi: cadence-quadspi: fix unclocked access on unbind
    (bsc#1258210).
  - ALSA: seq: dummy: fix UMP event stack overread (bsc#1258210).
  - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain()
    on linked streams (bsc#1258210).
  - time: Fix off-by-one in settimeofday() usec validation
    (bsc#1258210).
  - hyperv: Clean up and fix the guest ID comment in hvgdk.h
    (bsc#1258210).
  - signal: clear JOBCTL_PENDING_MASK for caller in
    zap_other_threads() (bsc#1258210).
  - selftests: harness: fix pidfd leak in __wait_for_test
    (bsc#1258210).
  - drm/hyperv: During panic do VMBus unload after frame buffer
    is flushed (bsc#1258210).
  - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
    (bsc#1258210).
  - Drivers: hv: VMBus protocol version 6.0 (bsc#1258210).
  - sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1258210).
  - net/802/mrp: fix vector attribute parsing in
    mrp_pdu_parse_vecattr (bsc#1258210).
  - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    (bsc#1258210).
  - vxlan: vnifilter: fix spurious notification on VNI update
    (bsc#1258210).
  - vxlan: vnifilter: send notification on VNI add (bsc#1258210).
  - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
    (bsc#1258210).
  - sctp: validate cached peer INIT chunk length in COOKIE_ECHO
    processing (bsc#1258210).
  - net/sched: fix pedit partial COW leading to page cache corruption
    (bsc#1258210).
  - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata
    dst teardown (bsc#1258210).
  - net: airoha: Fix use-after-free in metadata dst teardown
    (bsc#1258210).
  - ptp: vclock: Switch from RCU to SRCU (bsc#1258210).
  - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1258210).
  - af_unix: Fix inq_len update problem in partial read
    (bsc#1258210).
  - octeontx2-af: Fix initialization of mcam's entry2target_pffunc
    field (bsc#1258210).
  - octeontx2-pf: Fix NDC sync operation errors (bsc#1258210).
  - xsk: cache csum_start/csum_offset to fix TOCTOU in
    xsk_skb_metadata() (bsc#1258210).
  - Bluetooth: MGMT: Fix backward compatibility with userspace
    (bsc#1258210).
  - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
    (bsc#1258210).
  - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route
    calls (bsc#1258210).
  - Bluetooth: ISO: Fix not releasing hdev reference on
    iso_conn_big_sync (bsc#1258210).
  - Bluetooth: fix memory leak in error path of hci_alloc_dev()
    (bsc#1258210).
  - Bluetooth: bnep: reject short frames before parsing
    (bsc#1258210).
  - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
    extension handling (bsc#1258210).
  - Bluetooth: RFCOMM: validate skb length in MCC handlers
    (bsc#1258210).
  - Bluetooth: MGMT: validate advertising TLV before type checks
    (bsc#1258210).
  - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
    (bsc#1258210).
  - wifi: fix leak if split 6 GHz scanning fails (bsc#1258210).
  - ipv6: anycast: insert aca into global hash under idev->lock
    (bsc#1258210).
  - net: fec: fix pinctrl default state restore order on resume
    (bsc#1258210).
  - net: lan743x: permit VLAN-tagged packets up to configured MTU
    (bsc#1258210).
  - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    (bsc#1258210).
  - hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1258210).
  - net: Annotate sk->sk_write_space() for UDP SOCKMAP (bsc#1258210).
  - pcnet32: stop holding device spin lock during napi_complete_done
    (bsc#1258210).
  - wifi: mac80211: limit injected antenna index in
    ieee80211_parse_tx_radiotap (bsc#1258210).
  - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
    (bsc#1258210).
  - devlink: Release nested relation on devlink free (bsc#1258210).
  - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
    (bsc#1258210).
  - 6lowpan: fix off-by-one in multicast context address compression
    (bsc#1258210).
  - net/sched: act_api: use RCU with deferred freeing for action
    lifecycle (bsc#1258210).
  - dm cache policy smq: check allocation under invalidate lock
    (bsc#1258210).
  - netfilter: bridge: make ebt_snat ARP rewrite writable
    (bsc#1258210).
  - netfilter: nft_ct: bail out on template ct in get eval
    (bsc#1258210).
  - netfilter: conntrack_irc: fix possible out-of-bounds read
    (bsc#1258210).
  - netfilter: synproxy: add mutex to guard hook reference counting
    (bsc#1258210).
  - ipvs: clear the svc scheduler ptr early on edit (bsc#1258210).
  - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id (bsc#1258210).
  - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break
    notifiers (bsc#1258210).
  - wifi: iwlwifi: mvm: don't support the reset handshake for old
    firmwares (bsc#1258210).
  - erofs: fix use-after-free on sbi->sync_decompress (bsc#1258210).
  - erofs: tidy up synchronous decompression (bsc#1258210).
  - tee: qcomtee: add missing va_end in early return
    qcomtee_object_user_init() (bsc#1258210).
  - tee: fix tee_ioctl_object_invoke_arg padding (bsc#1258210).
  - soc: qcom: ice: Return -ENODEV if the ICE platform device is
    not found (bsc#1258210).
  - ARM: dts: microchip: sam9x7: fix GMAC clock configuration
    (bsc#1258210).
  - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus)
    and reserve its pins (bsc#1258210).
  - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
    (bsc#1258210).
  - tee: optee: prevent use-after-free when the client exits before
    the supplicant (bsc#1258210).
  - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing
    local DoS (bsc#1258210).
  - ipv6: mcast: Fix use-after-free when processing MLD queries
    (bsc#1258210).
  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (bsc#1258210).
  - KVM: arm64: Take the SRCU lock for page table walks in fault
    injection and AT emulation (bsc#1258210).
  - ARM: fix branch predictor hardening (bsc#1258210).
  - ARM: fix hash_name() fault (bsc#1258210).
  - ARM: allow __do_kernel_fault() to report execution of memory
    faults (bsc#1258210).
  - ARM: group is_permission_fault() with is_translation_fault()
    (bsc#1258210).
  - bpf: Free reuseport cBPF prog after RCU grace period
    (bsc#1258210).
  - commit 0175c69
  - Delete
    patches.kernel.org/drm-gem-Try-to-fix-change_handle-ioctl-attempt-4.patch.
  - commit 4ce1d5d

++++ kernel-vanilla:

  - HID: Input: Add battery list cleanup with devm action
    (git-fixes).
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
    (git-fixes).
  - commit 396d3f6

++++ kubens:

  - use kubens completions, not the kubectx ones (boo#1268539)

++++ kubevirt1.8:

  - Provide/Obsolete the dashed kubevirt-1.8-* subpackages in addition to
    the unversioned kubevirt-* ones, so the rename kubevirt-1.8 -> kubevirt1.8
    cleanly replaces the binaries briefly shipped to Factory (renaming-a-package
    per openSUSE:Package_dependencies; versioned %{version}-%{release} form).

++++ libbacktrace:

  - Update to version 1.0+git20260601:
    * libbacktrace: support compressed block with no sequences
    * libbacktrace: Fix typos in various files
    * libbacktrace: support multiple zstd frames
    * libbacktrace: don't use ZSTD_CLEVEL_DEFAULT
    * Update copyright years.
    * Update copyright years.
    * libbacktrace: use correct names in #undef of ELF macros
    * libbacktrace: recognize PE bigobj objects at configure time
    * libbacktrace: Add hpux fileline support
    * bootstrap/119680 - fix cross-compiler build with --enable-host-shared
    * libbacktrace: Use correct type in backtrace_atomic_store_int

++++ libmlt:

  - Make build recipe compatible with POSIX sh

++++ libmseed:

  - update to 3.4.1:
    * A number of functional correctness bug fixes
    * A number of memory handling fixes
    * Fixes to undefined behavior and memory leaks

++++ ncurses:

  - Mark build recipe as requiring bash
  - Modernize specfile/drop old constructs

++++ openconnect:

  - Update to release 9.21:
    * Fix infinite loop in buf_append() when output exactly fills available buffer space
    * Accept base32 token secrets without trailing = padding
    * Fix crash on NULL passphrase from TPM2 auth dialog
    * Fix use of free_pass() on binary oath_secret.
    * Fix COPR builds for Amazon Linux 2023, EPEL 7/10, and MinGW.
    * Fix compiler warnings in fortinet.c, tun-win32.c, and compat.c.
    * Support both old and new pyOpenSSL API in test infrastructure.
  - Update to release 9.20:
    * Fix Cisco AnyConnect STRAP channel bindings with TLSv1.3
    * Change default user-agent string to be compatible with newer Cisco servers
    * Support JavaScript redirects from Fortinet 7.4.x.
    * Fix GlobalProtect config-parsing bug that misidentified IPv6
    * split-include routes as split-exclude.
    * Handle Pulse configuration packets up to 1 MiB
    * fix short reads during packet reassembly
    * Support otpauth:// URI format for HOTP/TOTP token secrets
    * honour non-default TOTP periods from PSKC or otpauth://
    * Fix Cisco DTLS MTU detection
    * Handle additional oNCP framing variations

++++ python314-core:

  - Fix shebang to use versioned Python interpreter.

++++ python314-nogil-nogil-core:

  - Fix shebang to use versioned Python interpreter.

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1081
  - fixed build on SLE 15
  - 4.5.333
  - merge gh#openSUSE/libstorage-ng#1080
  - improved usleep function
  - improved memory handling
  - improved error reporting
  - use RAII for pid of child
  - 4.5.332

++++ wireplumber:

  - Update to version 0.5.15:
    * Additions & Enhancements:
  - Added new WpPermissionManager API that centralizes access
    control for clients, with support for attaching permission
    managers to clients from Lua scripts; the client access
    scripts have been completely refactored to use the new API
    with a select-access event and a priority fallback
    mechanism: configuration, flatpak, snap, portal, and default
    (!797 (merged), !822 (merged), !825 (merged))
  - Added new WpStateMetadata class that mirrors the persistent
    state into a PipeWire metadata object, allowing users to
    clear or change saved device profiles at runtime using
    pw-metadata (!818 (merged))
  - Added set_param(), enum_params_sync() and params-changed
    signal to WpSpaDevice, and an event signal for SPA device
    events, allowing monitors to directly interact with SPA
    devices and react to profile changes without going through
    the global WpDevice object (!835 (merged), !842 (merged))
  - Added list subcommand to wpctl for displaying PipeWire
    objects in a script-friendly format, with bash completions
    (!805 (merged), !823 (merged))
  - Added reset command to wpctl to reset the state of
    WirePlumber and PipeWire to installation defaults
    (!848 (merged), !849 (merged))
  - Enhanced wpctl to connect to the manager socket when
    available, giving the tool unrestricted access to the
    PipeWire graph (!814 (merged))
  - Added new bluetooth.profile-preference setting to
    find-preferred-profile for selecting quality or latency A2DP
    profiles (!819 (merged))
  - Added a cache for camera permission checks in the portal
    access module to avoid frequent D-Bus calls; also added a
    3-second timeout and fixed the Set create parameter in
    portal-permissionstore (!820 (merged), !821 (merged))
    * Fixes:
  - Fixed wpctl set-volume by PID to apply the same volume level
    to all matching nodes (#944 (closed); !829 (merged))
  - Fixed portal clients to be un-gated immediately after
    permission setup, preventing them from remaining blocked
    (#941 (closed); !826 (merged))
  - Fixed ALSA monitor to set the device profile to Off and
    restore it when a node enters an error state, forcing a
    close/reopen of the device to recover from broken ALSA device
    states (!837 (merged))
  - Fixed voice call profile selection to not skip profiles with
    unknown availability (!834 (merged))
  - Fixed memory leak in Lua scripting by only holding a strong
    reference of the Lua state when a script is activated,
    preventing leaked proxy warning messages on core disconnect
    (!844 (merged))
  - Fixed state-stream to only use the media.role key when its
    value is Notification when forming the stream state lookup
    key (!845 (merged))
  - Fixed pw-obj-mixin to apply the active filter when
    enumerating cached params and to deduplicate subscribed param
    IDs (!839 (merged), !840 (merged))
  - Fixed m-lua-scripting to validate Bool values in
    Pod.Choice.Enum (!841 (merged))
  - Fixed shutdown sequence to properly deactivate all objects
    and plugins before teardown (#881; !833 (merged))
  - Fixed Bluetooth to not set bluez5.autoswitch-routes on BT
    devices (!811 (merged))
  - Fixed null pointer dereference in permission-manager
    (!812 (merged))
  - Fixed module destructor ordering to call the parent
    destructor before finalizing internal state (!813 (merged))
  - Fixed nil value when logging in state-profile (!815 (merged))
  - Fixed gobject-introspection issue on spa-pod to correctly
    generate Python bindings (!828 (merged))
  - Updated translations: Chinese, Serbian, Serbian Latin

++++ lima:

  - Update to version 2.1.3:
    * nerdctl: update from v2.2.2 to v2.3.3
    * guestagent: limit the socket access to the main user
    * templates: update
    * fix(makefile): propagate build failure for additional drivers
    * krunkit: disable ssh.overVsock by default
    * cidata: fix ubuntu-26.04 first-boot NIC rename failure
    * templates: switch the default image from `ubuntu-25.10` to `ubuntu-26.04`
    * fix(copytool): fallback to scp for remote src and dest in auto mode
    * limayaml: clarify TestContainerdUserDefaultPerOS comment scope
    * limayaml: clarify containerd.user default is Linux-only in default.yaml
    * limayaml: do not default containerd.user=true on non-Linux guests

++++ linkerd-cli-edge:

  - Update to version 26.6.3:
    * proxy: v2.359.0 (#15394)
    * build(deps): bump h2 from 0.4.14 to 0.4.15 (#15392)
    * build(deps): bump syn from 2.0.117 to 2.0.118 (#15390)
    * build(deps): bump openssl from 0.10.80 to 0.10.81 (#15388)
    * build(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15386)
    * build(deps): bump cc from 1.2.63 to 1.2.64 (#15385)
    * build(deps): bump zeroize from 1.8.2 to 1.9.0 (#15384)
    * proxy: v2.358.0 (#15389)

++++ mihomo:

  - Initial package, version 1.19.27
  - mihomo (formerly Clash.Meta) is the actively maintained successor to
    the archived Dreamacro/clash; this package obsoletes both clash and
    clash-meta

++++ nerdctl:

  - Update to version 2.3.3

++++ netbird:

  - Update to 0.73.1
  - Client Improvements
  - Fixed profile regressions affecting up --profile and status
    commands. #6479
  - Reduced false-positive DNS health warnings. #6453
  - Fixed DNS custom zone teardown issues, including handler
    leaks and external CNAME resolution. #6445
  - Management Improvements
  - Removed database calls from nested loops to improve
    efficiency. #6470
  - Fetched complete user data in ValidateTunnelPeer. #6457
  - Reduced sync and login transaction overhead. #6472
  - Added peer metadata diff logging. #6468
  - Infrastructure & Tooling
  - Removed the v prefix from Docker image tags. #6471
  - Improved FreeBSD port scripts to correctly handle release
    candidates when fetching tags. #6480

++++ nodejs26:

  - Update to 26.3.1
    (CVE-2026-48618, bsc#1268593) tls: normalize hostname for server identity checks
    (CVE-2026-48933, bsc#1268592) crypto: guard WebCrypto cipher output length
    (CVE-2026-48615, bsc#1268598) lib,test: redact proxy credentials in tunnel errors
    (CVE-2026-48619, bsc#1268618) http2: cap originSet size to prevent unbounded memory growth
    (CVE-2026-48928, bsc#1268605) tls: fix case-sensitive SNI context matching
    (CVE-2026-48930, bsc#1268606) dns,net: reject hostnames with embedded NUL bytes
    (CVE-2026-48934, bsc#1268608) tls: bind reusable sessions to authenticated host
    (CVE-2026-48617, bsc#1268554) permission: handle process.chdir on writereport
    (CVE-2026-48931, bsc#1268611) http: fix response queue poisoning in http.Agent
    (CVE-2026-48935, bsc#1268609) permission: disable FileHandle utimes with permission model
    (CVE-2026-48936, bsc#1268610) permission: guard pipe open and chmod with net scope
  - Changes in 26.3.0
    * buffer: increase Buffer.poolSize default to 64 KiB
    * crypto: update root certificates to NSS 3.123.1
    * http: add httpValidation option to configure header value validation
    * inspector: expose precise coverage start to JS runtime
    * lib,permission: add permission.drop
    For details, see https://github.com/nodejs/node/releases/tag/v26.3.0
  - v8-i586.patch: add i586 compat patch

++++ openQA:

  - Update to version 5.1781832185.5ddf5343:
    * fix: fix user namespace mapping errors in podman
    * chore(mergify): Update the number of required checks
    * fix: use webui cache for download all archives
    * chore(deps): Dependency cron 2026-06-18
    * refactor: Extract changing prio and computing sign
    * fix: Fix typos in `t/api/04-jobs.t` and `t/config.t`
    * feat: Throttle jobs not using Git-URL as `CASEDIR`
    * ci: Change repo paths for SLE-15-SP7 in consistency with os-autoinst
    * fix: Avoid unresolvable openQA-devel-test package for SLE-SP7
    * feat: improve detection of unexpanded variables in clone-job
    * feat: support expanding variables in openqa-clone-job

++++ openSUSE-release-tools:

  - Update to version 20260619.fab48a07:
    * Move dashboard to Leap 16.0 + 16.1

++++ openmw:

  - Update to version 0.51.0
  - full Changelog since 0.50.0 available at https://openmw.org/2026/openmw-0-51-0-released/

++++ opentofu:

  - Update to version 1.12.3:
    * BUG FIXES:
  - Properly handle TF_ENCRYPTION with only blank spaces. (#4265)
  - The value resulted from the lifecycle.enabled evaluation now
    has its deprecation marks processed correctly (#4162)
  - Update documentation to clarify the usage restriction of
    ephemeral values in lifecycle.enabled. (#4220)
  - tofu console -lock=false now works as intended. (#4291)
    * SECURITY ADVISORIES:
  - Previous releases in the v1.12 series could read an arbitrary
    file during certain git operations via a maliciously crafted
    URL (#4293)
  - Advisory: GHSA-q7j3-v8qv-22vq

++++ osv-scanner:

  - Update to version 2.4.0:
    * Features:
  - Feature #2815 Add support for the CycloneDX 1.7 specification
    (bumps cyclonedx-go to v0.11.0).
  - Feature #2799 Enable .csproj and Central Package Management
    (nugetcpm) source scanning plugins by default.
  - Feature #2871 Extract and parse Alpine OS distro version
    (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers
    to scan packages under their respective Alpine ecosystems.
  - Feature #2801 Enable the swift/packageresolved plugin by
    default to support SwiftURL vulnerability scans.
  - Feature #2666 Add a Docker-based variant of the pre-commit
    hook in .pre-commit-hooks.yaml to avoid local compilation.
  - Feature #2637 Add a new configuration setting
    ScanGoModVersion (disabled by default) to avoid parsing
    toolchain version directives directly from go.mod, preventing
    misleading warnings.
  - Feature #2772 Scan container images built with Canonical
    Chisel by enabling the os/chisel extractor plugin.
    * Fixes:
  - Bug #2807 Sanitize package name, source, and version fields
    in the vertical output format to prevent GitHub Actions
    workflow command injection vulnerabilities from crafted lock
    files.
  - Bug #2876 Improve HTML scan report usability by supporting
    standard click modifiers (Ctrl/Cmd/middle click) to open
    vulnerabilities in new tabs, and preserving scroll position
    when switching tabs.
  - Bug #2783 Keep transitive dependency scanning enabled when
    specifying the --offline-vulnerabilities flag.
  - Bug #2808 Deduplicate equivalent OSV matcher requests before
    executing bulk queries to reduce API overhead.
  - Bug #2837 Prevent panics during offline matcher scans (e.g.
    on unsupported GitHub Actions ecosystem) by avoiding parsing
    errors when checking version ranges.
  - Bug #2836 Ensure the scanner returns an exit code of 0 when
  - -help or -h is explicitly requested.
    * Misc:
  - Update Go version to 1.26.4.
  - Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
  - Tag built Docker and GitHub Action images with the major
    version (e.g. :v2) to allow users to pin to a major version
    (#2857).
    * Dependencies
  - chore(deps): update golang.org/x/{crypto,net,sys} (#2853)
  - chore(deps): update golang docker tag to v1.26.3 (#2811)
  - fix(deps): update osv-scanner minor (#2851)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 in the go_modules group across 1 directory (#2822)
  - chore(deps): update workflows (#2852)
  - chore(deps): update workflows (#2764)
  - fix(deps): update osv-scanner minor (#2812)
  - chore(deps): lock file maintenance (#2834)
  - build(deps): bump faraday from 2.14.1 to 2.14.2 in /docs in
    the bundler group across 1 directory (#2817)
  - fix(deps): update osv-scanner minor (#2763)
  - chore(deps): lock file maintenance (#2718)

++++ pacemaker:

  - Update to version 3.0.2+20260616.4544f351:
  - agents: Move pid file management into ClusterMon.in.
  - libcib: Remove an unnecessary coverity suppression. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
  - libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
  - libcrmcommon: Limit the max size of a remote message. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
  - libcrmcommon: Fix integer overflow in remote message code. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
  - libcrmcommon: Fix checks in localized_remote_header. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)

++++ pan:

  - Update to version 0.165:
    * task-xover: fix date parsing, a potential crash and a memory
    leak
    * group-prefs-dialog: fix missing spellcheck language entry
    * header-pane: fix crash when backspace key is hit wihout
    articles
    * Updated translations.

++++ perl-WWW-Mechanize:

  - updated to 2.220.0 (2.22)
    see /usr/share/doc/packages/perl-WWW-Mechanize/Changes
    2.22      2026-06-18 20:59:34Z
    [ENHANCEMENTS]
  - credentials() now warns when called with the two-argument form, which
    stores credentials globally; prefer the host-scoped four-argument form.
    (GH#420) (Olaf Alders)

++++ pgn-extract:

  - Update to 26.04
    * Added --fencommentformat.
    * Added --addelotags and --addplayeridtags.
    * ECO classification changed slightly to take into account which player is
    to move. This makes a difference in a few cases.
    * Fixed a bug with -Wxolalg format which resulted in a castling move that
    gives check outputting two + characters.
    * Added insufficient material to --fixresulttags.
    * Added --piececount following a suggestion by Asko Havumäki.

++++ python-billiard:

  - Skip a test that fails on 32 bit arches.

++++ python-Flask-Admin:

  - Update to 2.2.0:
    [#]# Deprecations:
    * Deprecate ModelView(Model, db.session) in favor of ModelView(Model, db)
    [#]# New Features:
    * SQLAlchemy filter classes (FilterEqual, FilterLike, etc.) now accept a
    dotted-path string for the column argument (e.g.
    FilterEqual(column="author.email", name="Author Email")); the path is
    resolved against the view's model and the necessary joins are added
    automatically.
    * Flask-SQLAlchemy-Lite support
    * Add page title header with icon above every view via new
    {% block page_title %}
    * Upgrade bundled Bootstrap from 4.2.1 to 4.6.2 and remove unminified files
    * Flash error message on form validation failure ("Failed to create/save
    record")
    [#]# Bugfixes:
    * Fix CSS class on column headers (dots replaced with dashes e.g.:
    col-user.email -> col-user-email)
    * Return HTTP 403 instead of 500 when inaccessible_callback returns None
    * FileAdmin: show empty date instead of 1970-01-01 when directory has no
    timestamp
    * Fix "Save & Add Another" using non-relative redirect URL (broke behind
    reverse proxies)

++++ python-Flask-SQLAlchemy-Lite:

  - Initial release of 0.2.1.

++++ python-aiofile:

  - Initial package (version 3.11.1)

++++ python-azure-mgmt-programenrollment:

  - Initial build
    + Version 1.0.0b1

++++ python-azure-mgmt-resiliencemanagement:

  - Initial build
    + Version 1.0.0b1

++++ python-caio:

  - Initial package (version 0.9.25)

++++ python-cyclopts:

  - Initial package (version 4.18.0)

++++ python-extra-platforms:

  - update to 13.0.1:
    * Add detection of macOS Golden Gate (v27.x).

++++ python-fastmcp:

  - Initial package (version 3.4.0)

++++ python-fastmcp-slim:

  - Initial package (version 3.4.0)

++++ python-httpx-retries:

  - Initial package (version 0.5.0)

++++ python-py-key-value-aio:

  - Initial package (version 0.4.5)

++++ python-pynetbox:

  - Update to version 7.8.0
    New Features
    * Plugin Extension Framework (#774).
    * Custom Thread Pool Executor (#633).
    * Cursor-Based Pagination (#764).
    Other New Features
    * #713 - Add sync() method to the data_sources endpoint.
    * #715 - Allow endpoints with underscores.
    Enhancements
    * #625 - Preserve JSON list fields instead of returning them as
    Records.
    Bug Fixes
    * #701 - Fix filtering for custom fields.
    * #749 - Don't treat Record methods as constructors in
    _parse_values.
    * #745 - Serialize list-Record items that lack an ID.
    * #519 - Fix link peer casting.
    * #688 - Skip network fetch for dunder attributes in
    Record.__getattr__ .
    * #748 - Stop re-sending PATCH for unchanged partial
    custom_fields.
    Compatibility
    * Supports NetBox 4.6

++++ python-pynitrokey:

  - update to 0.12.3:
    * Add support for nistp384 algorithm in PIV by @sosthene-nitrokey
    in #755
    * Further fixes after change to ruff by @mmerklinger in #757
    * Add import-pkcs12 command for NetHSM by @mmerklinger in #759
    * Add Jan Knittel to maintainers file by @robin-nitrokey in #760
    * Update dependencies and release v0.12.3 by @robin-nitrokey in
    [#764]

++++ python-pyramid:

  - Update to 2.1:
    * Add static license specifier LicenseRef-Repoze-BSD-derived to the package
    metadata to satisfy SPDX license format.
    * Add "Operating System :: Independent" trove classifier.
    * Add support for Python 3.12, 3.13, and 3.14.
    * Added HTTP 418 error code via pyramid.httpexceptions.HTTPImATeapot.
    * Base coverage reports in tests on Python 3.14 instead of Python 3.8.
    * Replace usage of md5 in the Pyramid view system with sha256. This
    is not a security-related feature and is considered an implementation
    detail.
    * Replace usage of pkg_resources in pyramid.path.DottedNameResolver.
    * Replace usage of pkg_resources in pdistreport and pshell CLI commands.
    * Remove internal usages of deprecated locale and datetime APIs to reduce
    deprecation warnings.
    * Fix issues where permissions may be checked on exception views.
    * Applications raising pyramid.exceptions.BadCSRFToken and
    pyramid.exceptions.BadCSRFOrigin were returning invalid HTTP status.
    * Drop support for Python 3.6, 3.7, 3.8, and 3.9.
    * Drop support for l*gettext() methods in the i18n module.
    * Add get_spec method to IPackageOverrides.
    * When using a cache buster with asset overrides, the cache buster will
    find the first existing file in the override stack, rather than taking
    the first override regardless of whether the file exists or not.
  - Drop patch py313-tests.patch, merged upstream.
  - Remove Python 2 leftovers.

++++ python-python-multipart:

  - Update to 0.0.32
    * Replace per-byte partial-boundary scan with rfind lookbehind
  - Update to 0.0.31 (fixes CVE-2026-53540 (bsc#1268488))
    * Speed up multipart header parsing and callback dispatch
    * Bound header field name size before validating
    * Validate Content-Length is non-negative in parse_form
  - Update to 0.0.30 (fixes CVE-2026-53537 (bsc#1268506),
    CVE-2026-53538 (bsc#1268496), CVE-2026-53539 (bsc#1268500))
    * Treat only & as the urlencoded field separator
    * Ignore RFC 2231 extended parameters in parse_options_header

++++ python-ruff:

  - update to 0.15.18
    * Preview features
    * Handle nested ruff:ignore comments
    * Stop displaying severity in output
    * Use human-readable names in CLI output
    * Use human-readable names in LSP and playground diagnostics
    * [pydocstyle] Prevent property docstrings starting with verbs (D421)
    * [flake8-pyi] Extend PYI033 to Python files
    * Bug fixes
    * Detect equivalent numeric mapping keys
    * Detect mapping keys equivalent to booleans
    * Detect repeated signed and complex dictionary keys
    * Rule changes
    * [flake8-pyi] Rename PYI033 to legacy-type-comment
    * Performance
    * Use ThinVec for call keywords
    * Inline parser recovery context checks
    * Match parser keywords as bytes
    * Move value parsing out of lexing
    * Server
    * Render subdiagnostics and secondary annotations as related information
    * Documentation
    * Update fix availability for always-fixable rules
    * [flake8-tidy-imports] Add fix safety section (TID252)
    * Parser
    * Reject __debug__ lambda parameters
    * Reject _ as a match-pattern target
    * Reject multiple starred names in sequence patterns
    * Reject parenthesized star imports
    * Reject starred comprehension targets
    * Reject unparenthesized generator expressions in class bases
    * Reject yield expressions after commas
    * Validate function type parameter default order
    * Playground
    * Make diagnostic links clickable
    * Use diagnostic tags

++++ python-sentry-sdk:

  - Update to 2.63.0:
    [#]# New Features
    * Add integration for aiomysql
    * Support HTTPX2
    * Add server.address to transformed spans when stream_gen_ai_spans=True
    * Allow integrations to define control flow exceptions
    * Disable string truncation for events by default
    [#]# Bug Fixes
    * Fastapi
    + Prevent double wrapping of sync handlers on FastAPI >= 0.137
    + Use effective_route_context path for prefixed routers
    * Other
    + (arq) Never capture control flow exceptions
    + (client) Guard against dotless qualified_name in _setup_instrumentation
    + (rq) Restore functools.wraps() for patched functions
    + (tracing_utils) Handle baggage values containing '=' in
    from_incoming_header
    + (utils) Handle image_url string shorthand in _is_image_type_with_blob_content
    * Langchain
    + Stop setting transaction status when child span fails
    + Catch TypeError on langchain.agents import
    * Openai Agents
    + Handle starting_agent keyword argument in runner patches
    + Remove hosted MCP tool spans
    + Use name, not description in start_span
    + Stop setting transaction status when child span fails
    * Pydantic AI
    + Only use hooks when ModelRequestContext.model exists
    + Stop setting tokens on Invoke Agent spans
    + Stop setting transaction status when child span fails
    + Remove Agent.run_stream_events() patch
    * Strawberry
    + Wrap yields in try-except to ensure span cleanup
    + Fix AttributeError on graphql_span in resolve
  - Refreshed patch build-pytest.patch

++++ python-uv:

  - update to 0.11.22
    * Enhancements
    * Publish wheels before sdists in uv publish
    * Add TY and RUFF env vars for providing paths for binaries used by uv format and uv check
    * Preview features
    * Allow configuring preview features in uv.toml and pyproject.toml
    * Update the lockfile during uv check --no-sync
    * Add --script to uv check and uv metadata
    * Report workspace-exclusive dependency groups in workspace metadata
    * Support SARIF as a uv audit output
    * Performance
    * Use a more deadlock-resistant concurrent hashmap in the resolver
    * Bug fixes
    * Update string marker ordering semantics to match upstream clarified rules
    * Reject extras that have the same normalized name
    * Reject dependency group include-group entries that have additional fields
    * Reject invalid UTF-8 URL credentials
    * Validate that PEP 517 backend-paths exist when building sdists
    * Validate that pylock.toml files do not have an unsupported a lock-version
    * Validate that the environment satisfies the packages.requires-python of a pylock.toml
    * Allow uv to be recursively invoked by PEP 517 build hooks
    * Allow empty credentials.toml files
    * Fix transparent Python upgrades in project environments
    * Handle non-file editable URLs in uv pip list
    * Fix incorrect output from uv tree --invert
    * Fix environment locking of uv venv in a project
    * Fix handling of workspace-exclusive dependency groups in uv tree

++++ python314:

  - Fix shebang to use versioned Python interpreter.

++++ python314-documentation:

  - Fix shebang to use versioned Python interpreter.

++++ python314-nogil:

  - Fix shebang to use versioned Python interpreter.

++++ rspamd:

  - Update to 4.1.1
  - Features
  - Neural: Add pluggable feature-provider and ANN-architecture
    registries, a sequence output mode with SIF word selection
    for fasttext_embed, a multi-head attention pooling operator
    in kann, and slice/concat graph transforms in lua_kann.
  - checkv3: Negotiate representation and compression via
    Accept/Accept-Encoding.
  - CSS: Detect more text-hiding tricks — off-screen positioning,
    clip, negative text-indent, and tiny fonts.
  - Lua libraries: Bound zip-bomb expansion with opt-in
    extraction limits (size, count, ratio) in lua_archive, add
    byte-distribution statistics methods (entropy, byte
    mean/deviation, serial correlation, Monte-Carlo Pi) in
    lua_text, and expose a zlib/YARA-compatible crc32 for
    rspamd_text, rspamd_util, and cryptobox hash.
  - Multipattern: Add an explicit SOM (start-of-match) flag and
    fix regex-fallback offsets.
  - Bug fixes
  - DNS: Do not defer resolver nameservers, fixing a SIGSEGV at
    worker startup (regression in 4.1.0).
  - Lua runtime: Add state/generation guards and refcounting to
    the coroutine thread pool to prevent use-after-free on async
    completion, and avoid a lua_worker deadlock when a spawned
    subprocess returns an invalid value.
  - Neural: Stabilise training on dense embedding inputs (funnel
    architecture, input-typed learning rate, single-class quality
    gate) and stop stranding trained ANNs behind stale
    high-version tombstones.
  - checkv3: Register the /checkv3 controller endpoint and use a
    case-preserving boundary for v3 HTTP multipart parsing.
  - URL: Scan bare query-embedded URLs containing = as a whole,
    and stop multiplying URLs that contain multiple @ signs and
    backslashes.
  - CSS: Detect text hidden via overflow clipping, opacity, and
    max-width/height.
  - Milter: Send QUARANTINE even with a caller-supplied reply
    (regression from 3.10.0).
  - Checks: Classify loopback-only MX as MX_LOCAL_ONLY instead of
    MX_BOGON_ONLY, use alphanumeric-only random DNS prefixes for
    random_monitored RBL checks, and fix timeout inflation in
    pre/postfilter priority grouping.
  - Build: Fix the build with OpenSSL 4.0 opaque ASN1_STRING,
    make the mime_string iterator const for the doctest 2.5.0
    build, and prioritise bundled simdutf headers over system
    ones.

++++ rumdl:

  - Update to version 0.2.19:
    * Added
  - md013: add code-spans option to exempt unbreakable inline
    code (78896f5)
  - lsp: document and workspace symbols for headings (2cef95b)
    * Fixed
  - parser: recognize reference definitions inside blockquotes
    (82f4567)
  - md034: don't flag reference definitions inside blockquotes
    (faf0fa4)
  - md013: reflow list items inside blockquotes (362b5a6)

++++ selinux-policy:

  - Mark all bash-using sections as requiring bash
  - Delete old %defattr, it's the default now anyway
  - Reduce %if BUILD_xxx to span just %files and triggers,
    that's all it needs
  - Fix syntax in scriptlets

++++ simple-obfs:

  - Fix build with GCC 15 (rescue from [botdel]): append -Wno-error so
    upstream's hardcoded -Werror no longer turns new
  - Wdiscarded-qualifiers warnings into a fatal FTBFS; upstream is
    archived, so the distro %{optflags} -Werror=return-type is kept as
    the only error gate

++++ tipcutils:

  - Modernize specfile constructs
  - Make build recipe compatible with POSIX sh

++++ trivy:

  - Update to version 0.71.2:
    * release: v0.71.2 [release/v0.71] (#10871)
    * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
    * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)

++++ trurl:

  - Make it build again on TW by temporary disable tests.
    see comments: https://github.com/curl/trurl/pull/441
  - Add patch:
    * fix-discarded-qualifiers.patch

++++ uki-default:

  - Make scriptlets compatible with POSIX sh

++++ uki-vanilla:

  - Make scriptlets compatible with POSIX sh

++++ warewulf4:

  - updated go-jose to fix CVE-2026-34986 (bsc#1262810)
  - chi is fixed in the upstream project

++++ waywall:

  - Update to version 0.2026.06.13

++++ yast2-storage-ng:

  - Add method to get the required package objects (needed for
    gh#agama-project/agama#3649).
  - 5.0.49

++++ zstd-jni:

  - Update to v1.5.7.11
    * no structured changelog provided by upstream

------------------------------------------------------------------
------------------  2026-6-18  -  Jun 18 2026  -------------------
------------------------------------------------------------------

++++ ComputeLibrary:

  - Update to 53.1.0:
    * Public minor release
    * Documentation (API, changelogs, build guide,
    contribution guide, errata, etc.) available here:
    https://arm-software.github.io/ComputeLibrary/v53.1.0
  - Skipped 53.0.0:
    * Public major release
    * Documentation (API, changelogs, build guide,
    contribution guide, errata, etc.) available here:
    https://arm-software.github.io/ComputeLibrary/v53.0.0

++++ Mesa:

  - Update to 26.1.3 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.3

++++ Mesa-drivers:

  - Update to 26.1.3 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.3

++++ MozillaFirefox:

  - Mozilla Firefox 152.0.1
    https://www.firefox.com/en-US/firefox/152.0.1/releasenotes/
    * Fix frequent crashes affecting users with Intel Raptor Lake
    processors (bmo#2039575)

++++ OpenRGB:

  - Build against mbedtls 2.x to avoid build failures with mbedtls 4.x

++++ account-utils:

  - Update to version 1.3.0+git20260618.66fbd03:
    * Release version 1.3.0
    * meson.build: try to autodetect distribution variable if not set
    * CI: add tests/ci, a nspawn container based test suite
    * INSTALL.md: document -Ddistribution=suse
    * chfn/chsh: fix return 0 in error case
    * passwd: fix -s in getopt()
    * pwupdd-chfn: move get peer_uid call to later when we need it
    * pwupdd: call getpwnam after unpacking p.name
    * Release version 1.2.1
    * Use strlcpy instead of strcpy
    * Fix several errors

++++ agama:

  - Validate the profile before parsing it (bsc#1268432).
  - Fix the "agama config validate" command to work with the
    server (gh#agama-project/agama#3641).
  - Limit the number of Tokio worker threads (gh#agama-project/agama#3646
    related to bsc#1265451).

++++ amazon-ecs-init:

  - Update to version 1.104.0
    * Feature - Add support for ECS S3 Files integration (#4962)
    * Feature - Add ECS_PROPAGATE_TASK_MEMORY_LIMIT_CGROUPV2
    opt-in config (#4986)
    * Enhancement - rename IMDSCredentialRefresher to
    IMDSCredentialsRefresher (#4969)
    * Enhancement - inject AWS_REGION and AWS_DEFAULT_REGION
    into task containers (#4946)
    * Enhancement - Export namespace prefix in IMDS scanner
    shared library. (#4977)
    * Enhancement - Add TrustedExecutionConfiguration to task payload
    models (#4980)
    * Enhancement - Add FailureTracker for DiscoverPollEndpoint +
    ACS/TCS onnect workflows (#4983)
    * Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1
    in /agent (#4976)
    * Enhancement - Bump github.com/containerd/containerd from 1.7.29
    to 1.7.32
    in /ecs-init (#4970)
    * Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.81.1
    in /ecs-agent (#4974)
    * Enhancement - Bump github.com/containerd/containerd from 1.7.29
    to 1.7.32 in /agent (#4982)
    * Enhancement - Bump github.com/opencontainers/image-spec from 1.1.0
    to 1.1.1 in /agent (#4987)

++++ arkade:

  - Update to version 0.11.100:
    * Include commit and build date on version and bump vendor
    * Use fstail directly instead of via go replace

++++ asciinema:

  - Update to version 3.2.1:
    * Improve error reporting for server API failures - server-
    provided error messages are now surfaced, with actionable
    guidance (e.g. running asciinema auth)
    * Upgrade the virtual terminal (avt) to the latest version
    * Upgrade dependencies, including security fixes

++++ backhand:

  - Enable build on riscv64

++++ bcc:

  - luajit: re-enable deterministic bytecode generation (boo#1236871)
    * add deterministic_luajit.patch
    * the bcc-lua package should now be reproducible again
    * see also https://github.com/iovisor/bcc/pull/5523
  - Add version postfix when calling clang and llvm-strip

++++ cargo-audit-advisory-db:

  - Update to version 20260618:
    * Assigned RUSTSEC-2026-0184 to git2
    * Update git2 advisory for release of 0.21.0
    * Add advisory for git2: buffer-created BlameHunk leads to null pointers
    * Assigned RUSTSEC-2026-0183 to git2
    * Update git2 advisory for release of 0.21.0
    * Add advisory for git2: Remote::list() with an empty list triggers UB
    * Assigned RUSTSEC-2026-0182 to wasmtime-wasi
    * Add a new Wasmtime advisory
    * Bump actions/checkout from 6.0.2 to 6.0.3
    * Assigned RUSTSEC-2026-0181 to vibeio-http

++++ cargo-packaging:

  - Update to version 1.4.0+0:
    * Add missing --release flag on install step (#16)
    * Add RPM 4.20 declarative build system macros (#15)

++++ cmake:

  - Reintroduce "cmake-fix-ruby-test.patch", this time as an
    commit from upstream, see
    https://gitlab.kitware.com/cmake/cmake/-/merge_requests/12189

++++ cmake-ui:

  - Reintroduce "cmake-fix-ruby-test.patch", this time as an
    commit from upstream, see
    https://gitlab.kitware.com/cmake/cmake/-/merge_requests/12189

++++ cmake-full:

  - Reintroduce "cmake-fix-ruby-test.patch", this time as an
    commit from upstream, see
    https://gitlab.kitware.com/cmake/cmake/-/merge_requests/12189

++++ cmake-mini:

  - Reintroduce "cmake-fix-ruby-test.patch", this time as an
    commit from upstream, see
    https://gitlab.kitware.com/cmake/cmake/-/merge_requests/12189

++++ containerd:

  - Add patch for CVE-2026-34986 (bsc#1262948)
    * 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch
  - Add patch for CVE-2026-39821 (bsc#1266640)
    * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch
  - Add patch for CVE-2026-33814 (bsc#1265794)
    * 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch

++++ glibc-cross-aarch64-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ glibc-cross-hppa-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ glibc-cross-loongarch64-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ glibc-cross-ppc64le-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ glibc-cross-riscv64-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ glibc-cross-s390x-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ docker-stable:

  - grpc: enforce strict path checking for incoming requests on the server
    Backport of <grpc/grpc-go@72186f1>
    (bsc#1260279, CVE-2026-33186)
    * 0023-CVE-2026-33186-grpc-enforce-strict-path-checking-for.patch
  - http2: prevent hanging Transport due to bad SETTINGS
    Backport of <golang/net@1e71bd8>
    (bsc#1265782, CVE-2026-33814)
    * 0024-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch
  - idna: update from x/text, fix ToUnicode and all-ASCII xn-- labels
    Backport of <golang/net@8c4c965>
    (bsc#1266625, CVE-2026-39821)
    * 0025-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch
  - daemon: Decompress archives before entering container filesystem
    Backport of <<moby@2022313>
    (bsc#1267827, CVE-2026-41567)
    * 0026-CVE-2026-41567-daemon-Decompress-archives-before-ent.patch

++++ falcosecurity-container-plugin:

  - Initial package (version 0.7.1):
    * Falcosecurity container plugin (libcontainer.so), split out of the
    copy bundled in falco/sysdig. C++ plugin with a vendored Go worker
    (libworker.a); loaded at runtime by the system libsinsp, so it links
    only the header-only plugin SDK, fmt and the shared re-flex - not
    libsinsp (ENABLE_TESTS=OFF avoids the from-source libsinsp the test
    suite would otherwise pull in).
    * container-plugin-use-system-deps.patch redirects the cmake
    FetchContent modules (fmt, re-flex, plugin-sdk-cpp, btrfs) to the
    system copies and fixes the go-worker byproduct path for Ninja.

++++ forgejo-runner:

  - fix version output
  - remove %ghost-ed configuration file

++++ freerdp:

  - Update to version 3.27.1:
    + Bugfix/regression fix and android feature release
    * Fixed a regression with gateway connections
    * Android client RDPECAM support
    * Android client RAILS support
    + CVE fixes:
    * CVE-2026-55827
    + Changes:
    * [core,utils] fix guid2str (#12898)
    * [client,android] Add RAIL/RemoteApp window support (#12887)
    * Bitmap decode (#12899)
    * [client,rdpecam,android] Add camera redirection support (#12894)
    * [tools] make the generator create more clang-format friendly code (#12900)
  - Update to version 3.27.0:
    + A major feature / bugfix / cleanup release
    * Password hash now uses a custom SSPI attribute on non windows systems
    * TLS seclevel now defaults to 2 and a minimum of TLS 1.2 is required.
    Client side the /tls:seclevel: and /tls:enforce: allow to override these.
    Server implementations can manually set these with rdpSettings::FreeRDP_TLSMinVersion and
    rdpSettings::FreeRDP_TlsSecLevel
    (See https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/ for more details)
    * The RDP proxy got a fix which removed (unstable) structs from public headers. There are no
    known users of that (internal) API, but if you happen to be one please ping us.
    * Android client got some huge updates again (thank @svncibrahim)
    * Enhancements with Azure/Entra support: some (known but not officially documented) extensions
    have been added to make these connections more stable.
    * keyboard mapping
    * Allow RDPDR channel to pass additional arguments to the channel. Does not break existing behaviour
    but allows a channel supporting this to query the additional arguments for further use.
    * Fix some WinPR deprecation handling, add WITHOUT_WINPR_3x_DEPRECATED that allows building
    without any symbol deprecated during the stable 3 series
    * Some client side statistics logging API was added. By default prints a (trace) log at the
    end of a session, but it can be queried at any time for some connection details.
    + CVE fixes:
    * CVE-2026-55194
    * CVE-2026-55193
    * CVE-2026-55192
    * CVE-2026-55191
    * CVE-2026-55648
    + Changes:
    * Call winpr_InitializeSSL in TestWinPRUtils/TestNTLM (#12746)
    * [core,codec] Fix invalid overlap check (#12753)
    * Improve clipboard massive files copying performance (#12743)
    * [crypto,certificate] Honor BIO_should_retry (#12755)
    * Unify PEM read routines (#12758)
    * Build updates (#12772)
    * Fix sdl3 clipboard for files (#12759)
    * url: replace http://www.freerdp.com (#12781)
    * Fuzz/analyzer fixes (#12791)
    * [winpr,sspi] replace password-length heuristic with explicit hash (#12782)
    * Claude suggestions (#12792)
    * Disp check fix (#12795)
    * [core,settings] Raise default security level (#12752)
    * [clang,tidy] use workflow from ZedThree (#12806)
    * Improve FIPS mode support (#12811)
    * Lots of android specific improvements (#12773, #12777, #12783, #12784, #12785,
    [#12786], #12787, #12788, #12807, #12812, #12815, #12818, #12819, #12820, #12822,
    [#12748], #12750)
    * [channels,audin] fix opensles error handling (#12751)
    * [channels,audin] fix iOS and mac backends (#12864)
    * [channels,cliprdr] refactor server channel (#12810)
    * [channels,cliprdr] reset stream after use (#12855)
    * [channels,drdynvc] add new PubSub events (#12760)
    * [channels,rail] fix client handshake response (#12780)
    * [channels,rdpdr] various enhancements (#12800, #12797, #12803)
    * [channels,rdpgfx] fix server frame command returning success on write failure (#12828)
    * [channels,rdpsnd] reject client audio formats with zero nChannels/nBlockAlign (server-side DoS) (#12829)
    * [channels,rdpsnd] skip unusable playback backend during selection (#12830)
    * Refactor printer queue (#12817)
    * [ci,freebsd] update ci (#12823, #12824, #12825)
    * [cmake,simd] guard CMAKE_OSX_ARCHITECTURES (#12802)
    * [cmake] replace find_package(GLOBAL) (#12837)
    * [cmake] fix use of pkg_check_module (#12838)
    * [winpr,input] complete japanese keyboard mapping (#12836)
    * winpr/input: Fix numpad mapping for japanese keyboards (#12845)
    * [core,gateway] validate auth blob length in rdg_process_extauth_sspi (#12856)
    * Restore fullscreen when maximizing a toggled fullscreen window (#12849)
    * Fix(wfreerdp): Refresh Windows frame after fullscreen restore (#12848)
    * Fix copying multiple items of the same type between xfreerdp sessions (#12834)
    * [core,event] add StateChanged event (#12858)
    * [core,nego] bound cookie tag check to remaining length (#12862)
    * codec stats (#12860)
    * Various warning fixes (#12749, #12813, #12866, #12831)
    * [core,client] add PubSub events (#12757)
    * [core,client] use correct interface pointer (#12766)
    * [client,rdpewa] filter UserNotify events (#12767)
    * [client,windows] honor /from-stdin in wfreerdp (#12821)
    * [client,x11] release normal keys before modifiers (#12868)
    * fix(client/SDL): do not treat an unrecognized mouse button as fatal (#12847)
    * Proxy client context (#12865)
    * [core,update] filter out unused/unknown (#12870)
    * Azure/Entra undocumented stuff and request compaction (#12872, #12871, #12770)
    * Various bounds checks (#12873, #12857)
    * Sspi separate ansi unicode (#12874)
    * Ci update qa (#12875)
    * [channels,gfx] extract remaining header length (#12876)
    * [cache,glyph] bound offset read to buffer length (#12881)
    * Expose the correlationId in settings (#12879)
    * [winpr,wtypes] fix WINPR_C23_ENUM_TYPE (#12882)
    * [server,proxy] pass ntlm hostname (#12877)

++++ gap-modulargroup:

  - Update to release 2.0.3
    * No changelog was provided

++++ ghc-crypto-token:

  - Update crypto-token to version 0.2.0.
    Upstream does not provide a change log file.

++++ glab:

  - Update to version 1.103.0:
    * Features
  - b39a801c: feat(container-registry): add container registry
    repository and tag commands (Jeroen Monteban
    jeroen.monteban@mgb.ch)
  - ea9fd25a: feat(packages): add packages command group with
    list (Oscar Tovar otovar@gitlab.com)
  - 1dd20b11: feat(stack): make switch interactive (Ahmed
    Abdelbaset a7med3bdulbaset@gmail.com)
  - 7b9703ab: feat(stacked-diffs): add --no-verify to 'stack
    amend' command (Kev Kloss kkloss@gitlab.com)
  - 6e4e3284: feat(stacked-diffs): add --no-verify to 'stack
    save' command (Kev Kloss kkloss@gitlab.com)
  - 481f63fb: feat: Handle glab mr checkout failure when there
    are non fast-forwarding conflicts (Gabriel Mazzetto
    gabriel@gitlab.com)
  - 84fd9f33: feat: compile arm64 windows bianry (Andrei Zubov
    azubov@gitlab.com)
    * Bug Fixes
  - 91eb7aad: fix(ci): set release token inline so project
    GITLAB_TOKEN can't shadow it (Jay McCure jmccure@gitlab.com)
  - 10561d78: fix(mcp): add content to structuredContent (Florian
    Imdahl git@ffflorian.de)
  - bcf700bd: fix(orbit): install dependency-free Linux build to
    fix glibc version errors (Dmitry Gruzd dgruzd@gitlab.com)
  - 0a119c02: fix(stacks): share stacks across worktrees (Ahmed
    Abdelbaset a7med3bdulbaset@gmail.com)
  - e3236d94: fix(update): give post-upgrade and skill nudges
    breathing room (Kai Armstrong karmstrong@gitlab.com)
    * Documentation
  - 913e5d9d: docs(api): add GLAB_DEBUG_HTTP example for
    debugging requests (Kai Armstrong karmstrong@gitlab.com)
  - 3a983d41: docs(variable): add synopsis and examples to
    variable commands (Brendan Lynch blynch@gitlab.com)
  - 98e70a25: docs: Remove manual (default false) flag
    annotations (Brendan Lynch blynch@gitlab.com)
  - 6c71e24c: docs: add troubleshooting guide for invalid_client
    OAuth error (Stan Hu stanhu@gmail.com)
  - e73a8cde: docs: move troubleshooting guide to the generated
    CLI docs page (Brendan Lynch blynch@gitlab.com)
    * Dependencies
  - 7779ffec: chore(deps): bump go to v1.26.4 (GitLab Renovate
    Bot gitlab-bot@gitlab.com)
  - 39cda83f: chore(deps): update dependency @commitlint/cli to
    ^21.0.2 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - f434057f: chore(deps): update dependency @commitlint/lint to
    ^21.0.2 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - c583440d: chore(deps): update module charm.land/bubbletea/v2
    to v2.0.7 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - a1898d01: chore(deps): update module github.com/docker/cli to
    v29.5.1+incompatible (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - f1b74aae: chore(deps): update module github.com/docker/cli to
    v29.5.2+incompatible (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - 6131acf7: chore(deps): update module github.com/docker/cli to
    v29.5.3+incompatible (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - 9b83a7ff: chore(deps): update module
    github.com/docker/docker-credential-helpers to v0.9.8 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 0767cd08: chore(deps): update module
    github.com/mattn/go-colorable to v0.1.15 (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - 765b526d: chore(deps): update module
    github.com/mattn/go-runewidth to v0.0.24 (GitLab Renovate Bot
    gitlab-bot@gitlab.com)
  - 756377a6: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.36.1 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 55a4f6b3: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.36.2 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 34a8e5b0: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.36.3 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - e500b3f4: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.39.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - bda16f22: chore(deps): update module golang.org/x/sync to
    v0.21.0 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - a27fa5a4: chore(deps): update module golang.org/x/term to
    v0.44.0 (GitLab Renovate Bot gitlab-bot@gitlab.com)
  - 79575672: chore(deps): update module golang.org/x/text to
    v0.38.0 (GitLab Renovate Bot gitlab-bot@gitlab.com)
    * Maintenance
  - 4c0cc23d: chore(ci): automate weekly release via pipeline
    schedule (Jay McCure jmccure@gitlab.com)
  - d0d9bc3e: chore: Refactor mr_checkout removing global var and
    moving dependencies to struct (Gabriel Mazzetto
    gabriel@gitlab.com)
  - 47eeadad: chore: Update MR review instructions YAML (Brendan
    Lynch blynch@gitlab.com)
  - b5ac12f9: chore: add support for modern linux-x64 duo cli
    binary (Andrei Zubov azubov@gitlab.com)
  - 7d26ca46: ci: update code-intelligence job to fix job
    failures (Oscar Tovar otovar@gitlab.com)
  - 45b9fcc3: ci: wire ci/cd inputs to release variables (Oscar
    Tovar otovar@gitlab.com)
    * Others
  - 080c4e2c: test: add archived field to label list JSON
    expectation (Tomas Vik tvik@gitlab.com)

++++ glibc:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ glibc-utils-src:

  - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is
    exactly 64 (BZ #34183)
  - struct-reserved-members.patch: Rename __unused fields to
    __glibc_reserved
  - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate
    errors with //TRANSLIT (BZ #34236)
  - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT
    trampolines (BZ #34144, BZ #15792)

++++ goshs:

  - Update to version 2.1.1
    New Features
    * TUI Dashboard (--tui).
    * TTL Self-Destruct (--ttl).
    Changes
    * ConPtyShell no longer embedded in the binary.

++++ grafana:

  - Update to version 12.4.4:
    * Security and quality updates.
    * Various bug fixes and enhancements.
  - Update to version 12.4.3:
    * Analytics: Keep internal dashboard id.
    * Go: Update to 1.25.9.
    * Reporting: Correctly apply appSubURL to report settings
    requests.
    * Alerting: Document Grafana HA Alertmanager cluster metrics
    prefix change.
  - Update to version 12.4.2:
    * Various bug fixes and performance improvements.
    * Dependency updates to core plugins and UI libraries.
  - Update to version 12.4.1:
    * Bug fixes and minor quality-of-life enhancements.
    * Updates to data source provisioning and dashboard schemas.
  - Update to version 12.4.0:
    * Introduced dynamic dashboards in public preview.
    * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
    * Added the ability to create dashboards from templates using
    sample data.
    * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
    * Added support to map one variable to multiple values.
    * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)
  - Update to version 12.3.0:
    * Released a completely redesigned logs visualization.
    * Added the ability to export dashboards directly as PNG images.
    * Introduced an interactive learning experience within the
    Grafana UI.
    * Added a Switch template variable type to quickly toggle between
    values in queries.
    * Added functionality to style table cells using CSS properties
    via the field cell option.
  - Update to version 12.2.0:
    * Routine feature enhancements, minor bug fixes, and security
    patches.
  - Update to version 12.1.0:
    * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
    * Redesigned the alert rule list page.
    * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
    * Added support for Service Account Impersonation in the BigQuery
    data source.
    * Introduced the Grafana Advisor in public preview.
  - Update to version 12.0.0:
    * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
    * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
    * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
    * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
    * Introduced a new dashboard schema to replace the original
    single grid layout.
  - Removed patches:
    * 0002-Drop-zanzana.patch
    * 0004-Bump-expr-lang.patch
    * 0006-Fix-CVE-2026-21725.patch
    * 0007-Bump-github.com-go-jose-go-jose.patch
    * 0008-Bump-github.com-apache-thrift.patch
    * 0009-Bump-golang.org-x-net.patch
  - Rebased 0005-Bump-edwards25519.patch

++++ gsoap:

  - Update to release 2.8.143
    * Update to support `PATCH` HTTP method that was disabled due to
    a typo in the original release.

++++ pipewire:

  - Update to version 1.6.7:
    * This is a bugfix release that is API and ABI compatible with
    the previous 1.6.x releases.
    * Highlights
  - Fix a race issue where some ports would stay silent after a
    rate change.
  - Fix sync regressions between ALSA cards in some cases.
  - Small fixes and improvements.
    * PipeWire
  - Fix a scheduler regression where some driver nodes would not
    run correctly and cause sync issues. (#5210 (closed))
  - Fix a race issue with suspend on samplerate changes. It can
    cause ports to be silent. (#3547 (closed))
    * Modules
  - There are some locking issues in the RT portal, for now
    reduce the DBus timeout to something more sane. Also disable
    portal RT for pipewire and the pulse server. These are not
    usually run in a sandbox and can go directly to RTKit.
  - Fix potential incorrect delay in combine-stream.
    * SPA
  - Fix a regression in ALSA period_size calculations. For
    non-power-of-2 periods, it would in some cases round down a
    a power-of-2, causing a mismatch between requested and
    configured period_size. (#5302 (closed))
  - Fix a potential segfault when removing a card because of bad
    ALSA api usage. (#5255 (closed))
  - Emit a route param update when card properties change.
    Otherwise, jack port updates are not always reflected
    correctly.
    * Misc
  - Make sure we don't deal with uninitialized spa_dict.

++++ inspektor-gadget:

  - Update to version 0.53.2:
    * Bugfixes
  - [Backport] container-hook: avoid fanotify self-deadlock by
    caching config.json by @burak-ok in #5574, original PR by
    @alban in #5572
    * Security
  - Bump Go toolchain and builder image pins to 1.26.4
    (CVE-2026-42504) (#5558)

++++ jfrog-cli:

  - Update to version 2.109.0:
    * New Features
  - [jfrog-cli] Add AI-agent help text to mcp and uv commands
    [#3545] (@ehl-jf)
  - [jfrog-cli-artifactory] JGC-492 - Add --format flag for
    release-bundle-create, promote, and distribute #488 (@ehl-jf)
    * Bug Fixes
  - [build-info-go] RTECO-1187 - Updated logic to skip cache
    check for empty depedency project #392 (@naveenku-jfrog)
    * Other Changes
  - [jfrog-cli-core] JGC-501 - Force non-interactive mode when
    CLI is invoked by an agent #1573 (@ehl-jf)

++++ k0sctl:

  - Update to version 0.31.0:
    * Handle unexpected names in the kubeconfig (#1087)
    * Bump github.com/k0sproject/rig from 0.21.8 to 0.21.10 (#1104)
    * Bump k8s.io/client-go from 0.36.1 to 0.36.2 (#1097)
    * Bump k8s.io/apimachinery from 0.36.1 to 0.36.2 (#1098)
    * Enable testifylint (#1102)
    * Don't autodetect CPLB IP as host private address (#1101)
    * Fix unnecessary reinstall when dynamicConfig is enabled (#1099)
    * Bump golang.org/x/text from 0.37.0 to 0.38.0 (#1091)
    * Bump github.com/go-playground/validator/v10 from 10.30.2 to
    10.30.3 (#1090)
    * Bump github.com/k0sproject/rig from 0.21.6 to 0.21.8 (#1089)
    * Bump k8s.io/client-go from 0.36.0 to 0.36.1 (#1083)
    * Bump golang.org/x/text from 0.36.0 to 0.37.0 (#1082)
    * Update AGENTS.md

++++ kernel-default:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-source:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-docs:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-kvmsmall:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-obs-build:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-obs-qa:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-syms:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kernel-vanilla:

  - Revert "ACPICA: Replace strncpy() with strscpy_pad() in
    acpi_ut_safe_strncpy()" (bsc#1268472).
  - commit 55dbe47

++++ kubeseal:

  - Update to version 0.38.1:
    * 7065289 Release notes v0.38.1 (#1989)
  - Update to version 0.38.0:
    * 8ba4b5b Adding default prometheusRule in helmChart to watch out
    of sync secrets (#1980)
    * 9a5984c Bump Golang to 1.26.4 (#1987)
    * 85834b4 Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0
    (#1976)
    * fddaab3 Bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.30.0
    (#1985)
    * 8bba338 Bump github.com/onsi/gomega from 1.40.0 to 1.41.0
    (#1975)
    * ae2c71d Bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#1977)
    * b7f2626 Bump golang.org/x/crypto from 0.52.0 to 0.53.0 (#1984)
    * fa71a75 Change oci registry for publishing the chart (#1970)
    * 5d360fd Migrate all bitnami-labs references to bitnami org
    (#1983)
    * dc9f8fc Release notes v0.38.0 (#1988)
    * 8a9e832 Revert "Fix oci push" (#1979)
    * 4e61da0 Update security context defaults to comply with
    restricted pod securi… (#1981)
    * 9d63881 feat: add ppc64le architecture support (#1973)
    * 5ba86c2 fix: add mutex locking to KeyRegistry to prevent data
    races (#1905)

++++ lhasa:

  - Update to release 0.6.0
    * This release fixes a read overflow in the -pm2- decoder.
    * Archived files with empty filenames are now skipped over
    during extract.

++++ libidn:

  - update to 1.44:
    * Fix read-out-of-bounds error in ToUnicode APIs
    * Fix strcpy buffer overflow in examples

++++ libupnp:

  - Update to release 2.0.2
    * Fixed Transfer-Encoding: chunked bodies bypassing the
    g_maxContentLength limit.
    * Fixed a NULL dereference in ixmlNode_compare.
    * Fixed a integer truncation in raw_to_int().

++++ mir:

  - Update to 2.28.0:
    * Drop 0002-correct-include-paths-pkgconfig.patch
    * ABI Changes:
  - mirwayland bumped to 6
  - miroil bumped to 9
    * Bugs Fixed:
  - Fix FDs being removed by libinput (gh#canonical/mir#4853)
  - restore previously active VT on LinuxVirtualTerminal teardown
    (gh#canonical/mir#4842)
  - (gh#canonical/mir#4552) gmtime is not thread safe
    (gh#canonical/mir#4972)
  - Fix input lockup after VT switch (gh#canonical/mir#4791)
  - Fix copy-paste error with setting positioner constraint
    adjustment (gh#canonical/mir#4869)
  - fix leak in DisplayInfo (gh#canonical/mir#4877)
  - fix boolean logic checking for DnD actions
    (gh#canonical/mir#4892)
  - fix-wrong-foreign-toplevel-logic (gh#canonical/mir#4952)
  - apply live touchpad config at startup and correct
    disable-with-external-mouse mapping (gh#canonical/mir#4943)
  - Fix environment variables being overwritten when they match
    on prefix (gh#canonical/mir#4966)
  - Upstream fixes to application switcher
    (gh#canonical/mir#4945)
    * Enhancements:
  - [wayland-rs]
    * Generating implementation for Wayland events so that they
    can be sent from C++ to Rust to Wayland clients
    (gh#canonical/mir#4785)
    * Generating global registration methods for wayland-rs
    (gh#canonical/mir#4825)
    * Adding the ability to post an error on any object
    (gh#canonical/mir#4843)
    * Implement a C++ friendly Wayland client and
    WaylandServerNotificationHandler for recieving
    notifications about new clients (gh#canonical/mir#4848)
  - [live config]
    * Re-implement array clearing in BasicStore and IniFile
    (gh#canonical/mir#4914)
    * Apply live configuration in start_callback()
    (gh#canonical/mir#4978)
    * Add tests for IniFile failure modes (gh#canonical/mir#4847)
  - Implement org_kde_kwin_server_decoration
    (gh#canonical/mir#4956)
  - Accept EGL_TEXTURE_EXTERNAL_WL (gh#canonical/mir#4888)
  - use std::format* instead of snprintf in xwayland_spawner.cpp
    (gh#canonical/mir#4793)
  - Fixes TICS violations in wayland_connector.cpp
    (gh#canonical/mir#4904)
  - Eliminate tmpnam (gh#canonical/mir#4813)
  - Fix TICS violation of pointer arithmetic on polymorphic
    object, Use void* as map key (gh#canonical/mir#4827)
  - Correct include paths pkgconfig (gh#canonical/mir#4907)
  - improve Ctrl+Shift+NumLock toggle shortcut
    (gh#canonical/mir#4812)
  - add MIR_PIN_COMPOSITING_TO to allow pinning a certain
    provider for display (gh#canonical/mir#4958)
  - Add implementation of the new logging API
    (gh#canonical/mir#4895)
  - Add support for WLCS keyboard (gh#canonical/mir#4716)

++++ libnbd:

  - add build condition for ublksrv

++++ libportal:

  - Update to version 0.10.0:
    + Features:
  - Support directory selection in xdp_portal_open_file()
  - Add clipboard API and support InputCapture session
    persistence
    + Bug fixes:
  - Replace deprecated Gio.UnixInputStream with
    GioUnix.InputStream in tests
  - Fix a memory leak in the background API
  - Specify --doc-format=gi-docgen when building introspection
  - Use canonical property names and G_PARAM_STATIC_STRINGS for
    all GObject properties in inputcapture
  - Fix invalid free of call-related data in inputcapture
  - Expose libportal/settings.h header in libportal/portal.h
  - Fix build with Qt 6.9+
  - Don't install glib-backports.h as part of public headers
  - Drop libportal-qt69.patch: Fixed upstream.

++++ libportal-qt5:

  - Update to version 0.10.0:
    + Features:
  - Support directory selection in xdp_portal_open_file()
  - Add clipboard API and support InputCapture session
    persistence
    + Bug fixes:
  - Replace deprecated Gio.UnixInputStream with
    GioUnix.InputStream in tests
  - Fix a memory leak in the background API
  - Specify --doc-format=gi-docgen when building introspection
  - Use canonical property names and G_PARAM_STATIC_STRINGS for
    all GObject properties in inputcapture
  - Fix invalid free of call-related data in inputcapture
  - Expose libportal/settings.h header in libportal/portal.h
  - Fix build with Qt 6.9+
  - Don't install glib-backports.h as part of public headers
  - Drop libportal-qt69.patch: Fixed upstream.

++++ libportal-qt6:

  - Update to version 0.10.0:
    + Features:
  - Support directory selection in xdp_portal_open_file()
  - Add clipboard API and support InputCapture session
    persistence
    + Bug fixes:
  - Replace deprecated Gio.UnixInputStream with
    GioUnix.InputStream in tests
  - Fix a memory leak in the background API
  - Specify --doc-format=gi-docgen when building introspection
  - Use canonical property names and G_PARAM_STATIC_STRINGS for
    all GObject properties in inputcapture
  - Fix invalid free of call-related data in inputcapture
  - Expose libportal/settings.h header in libportal/portal.h
  - Fix build with Qt 6.9+
  - Don't install glib-backports.h as part of public headers
  - Drop libportal-qt69.patch: Fixed upstream.

++++ re-flex:

  - Update to version 6.3.0:
    * new AbstractMatcher methods chr_last() and wchr_last() to
    extract the last character of a matching pattern
    * new AbstractMatcher methods chr_next() and wchr_next() to
    inspect the next character in the input without consuming it
    * new AbstractMatcher method empty() to check if a match is
    empty (same as size() == 0)
    * add new example words.l with %option find to search input
  - Rebase reflex-shared-soversion.patch (bump library VERSION to
    6.3.0; SOVERSION stays 6, ABI unchanged)
  - Build with CMake instead of autotools to produce a proper shared
    library (libreflex.so.6):
    * add reflex-shared-soversion.patch: build only the shared ReflexLib
    (drop the static library), give it a soversion, and link the reflex
    tool against it
    * package the shared library in a new libreflex6 subpackage and ship
    the CMake package config in -devel
    * install the manpage manually (the CMake build does not)
    * -devel requires the main package: the exported CMake config
    references the reflex tool target, so find_package(Reflex) needs it

++++ liburing:

  - disable failing tests via catch-all in SLE15, force bash

++++ lighttpd:

  - update to 1.4.84:
    * fix regression in mod_deflate

++++ linkerd-cli-edge:

  - Update to version 26.6.2:
    * chore(build): update golang to 1.25.11 (#15378)
    * build(deps): bump golang.org/x/tools from 0.45.0 to 0.46.0
    (#15375)
    * build(deps): bump memchr from 2.8.1 to 2.8.2 (#15377)
    * build(deps): bump smallvec from 1.15.1 to 1.15.2 (#15376)
    * build(deps): bump regex from 1.12.3 to 1.12.4 (#15371)
    * build(deps): bump zerocopy from 0.8.50 to 0.8.52 (#15370)
    * build(deps): bump regex-syntax from 0.8.10 to 0.8.11 (#15369)
    * build(deps): bump docker/setup-qemu-action (#15368)
    * build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0
    (#15367)
    * build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#15366)
    * build(deps): bump linkerd2-proxy-api from 0.18.0 to 0.20.0
    (#15353)
    * build(deps-dev): bump @babel/preset-env in /web/app (#15359)
    * build(deps): bump DavidAnson/markdownlint-cli2-action (#15241)
    * build(deps-dev): bump babel-jest from 30.3.0 to 30.4.1 in
    /web/app (#15281)
    * build(deps): bump dev container to v49 (#15287)
    * build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1
    (#15291)
    * build(deps): bump dessant/lock-threads from 6.0.0 to 6.0.2
    (#15310)
    * build(deps): bump docker/login-action from 4.1.0 to 4.2.0
    (#15311)
    * build(deps): bump docker/setup-buildx-action from 4.0.0 to
    4.1.0 (#15322)
    * build(deps-dev): bump @babel/eslint-parser in /web/app (#15360)
    * build(deps): bump github.com/linkerd/linkerd2-proxy-api
    (#15348)
    * build(deps): bump the grpc group with 3 updates (#15363)
    * build(deps-dev): bump @babel/runtime from 7.29.2 to 7.29.7 in
    /web/app (#15361)
    * build(deps-dev): bump @babel/core from 7.29.0 to 7.29.7 in
    /web/app (#15362)
    * build(deps): bump bitflags from 2.12.1 to 2.13.0 (#15364)
    * build(deps): bump log from 0.4.30 to 0.4.32 (#15356)
    * build(deps): bump chrono from 0.4.44 to 0.4.45 (#15355)
    * build(deps-dev): bump webpack from 5.106.2 to 5.107.2 in
    /web/app (#15335)
    * build(deps): bump date-fns from 4.1.0 to 4.4.0 in /web/app
    (#15336)

++++ melange:

  - Update to version 0.54.0:
    * feat(git-checkout): log resolved clone URL after successful
    clone (#2572)
    * build(deps): bump chainguard.dev/apko from 1.2.16 to 1.2.17 in
    the gomod group (#2571)

++++ miriway:

  - Update version 26.06.1
    * Mir 2.28 base
    * Uses miral::ApplicationSwitcher for better app switching
    * Migrates lots of options to .settings (which now auto-reloads)
    * Add functionality to bind unmodified keys
    (gh#Miriway/Miriway#202)
    * Fix alphabetic key shortcuts after live_config migration
    (gh#Miriway/Miriway#209)

++++ netbird:

  - Update to 0.73.0
  - Client Improvements
  - Added MDM configuration profile support for Windows Registry
    and macOS plist deployments. #6374
  - Improved DNS handling by answering NODATA instead of SERVFAIL
    when a host has no addresses of the requested family. #6418
  - Added WASM WebSocket dialing support. #5980
  - Added iOS debug bundle support in Go. #6270
  - Added IsLoginRequiredCached support for iOS clients. #6447
  - Improved exit-node handling by propagating deselect actions
    to synthesized IPv6 routes. #6296
  - Migrated profile identity from display name to ID and added
    support for profile renaming. #6367
  - Improved reliability by recovering from TUN device read/write
    panics and automatically restarting the client. #6419
  - Added detection and recovery for stalled signal receive
    streams. #6459
  - Fixed iOS route notification ordering. #6454
  - Dropped the signaling-side ICE filter and improved overlay
    STUN handling. #6142
  - Exposed relay transport and connection errors in client
    status output and metrics. #6342
  - Management Improvements
  - Skipped JWT group evaluation for embedded-IdP local users.
    [#6422]
  - Treated ci- builds as development builds for remote jobs.
    [#6436]
  - Optimized network map generation for affected peers. #6105
  - Deleted targets automatically when deleting exposed services.
    [#6442]
  - Removed network map calculation from login flow. #6449
  - Passed meta updates for browser clients. #6465
  - Fixed flaky SaveAccount tests caused by random IP collisions.
    [#6452]
  - Synced OpenAPI specifications and added workflow validation.
    [#6437]
  - Proxy Enhancements
  - Kept custom TCP listeners alive after mapping batches. #6415
  - Fixed UDP relay context handling. #6444
  - Signal Improvements
  - Serialized concurrent sends to peer streams to improve
    stability. #6463
  - Infrastructure & Tooling
  - Improved GoReleaser release candidate handling and updated
    Docker build workflows. #6438

++++ openbao:

  - Update to version 2.5.5:
    * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
    * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/<type> not returning versioned plugins.
    [GH-3186]

++++ os-autoinst:

  - Update to version 5.1781797043.0fb1077:
    * test: assert Level 3 pretty serial markers
    * fix: fallback pretty marker console to 'sut'
    * test: fix color test resilience to NO_COLOR
    * fix: stop QMP wait hangs on early QEMU exits
    * fix: stop autodie unlink crashes in qemu backend
    * fix: cleanly recreate virtio console pipe if already exists
    * fix: suppress spurious virtio console unlink warnings
    * test: reliably assert pipe size adjustments

++++ perl-JSON-Any:

  - updated to 1.410.0 (1.41)
    see /usr/share/doc/packages/perl-JSON-Any/Changes
    1.41      2026-06-18 03:44:01Z
  - fix test error with allow_non-ref and Cpanel::JSON::XS >= 4.42
    (RT#179192)

++++ pipewire-module-xrdp:

  - Update to the tag v0.2
    + Rename module-xrdp-pipewire into module-xrdp
    + load_pw_modules: Make it no-op if no pw-cli or pipewire is not
    running
    + Adjust LDFLAGS: drop -module, add PW_LIBS and SPA_LIBS

++++ plasma-branding-Kalpa:

  - add 0001-add-missed-locale1-in-sddm-config.patch

++++ plexus-archiver:

  - Upgrade to upstream version 4.12.0
    * Bug Fixes
    + Fix ZIP CRC regression in OffloadingOutputStream
    + Fix NPE when reading posixfileattributes on windows
    * Dependency updates
    + Bump commons-io:commons-io from 2.21.0 to 2.22.0
    + Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1
    + Bump com.github.luben:zstd-jni from 1.5.7-6 to 1.5.7-9
    + Bump org.tukaani:xz from 1.11 to 1.12
    + Bump org.eclipse.sisu:org.eclipse.sisu.inject from 0.9.0.M4
    to 1.0.0
    + Bump org.assertj:assertj-core from 3.27.6 to 3.27.7
    + Bump release-drafter/release-drafter from 6 to 7

++++ postfix:

  - update to 3.11.4
    * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
    * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
    * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
    * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
    * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.

++++ postfix-bdb:

  - update to 3.11.4
    * Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer
    read and heap data overread in the Postfix SMTP client's
    smtp_dns_reply_filter.
    * Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic
    (assertion failure and voluntary crash) while parsing a TLSA reply
    with length 3.
    * Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness:
    the Postfix SMTP server will no longer receive (and discard) an
    unlimited amount of text while receiving a long SMTP command line.
    * Bug 4 Robustness: with the above change the Postfix SMTP client will
    no longer receive (and discard) an unlimited amount of text while
    receiving a long SMTP response line.
    * Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness:
    do not receive (and discard) unlimited amounts of data with BDAT
    commands.

++++ postsrsd:

  - Update to release 2.2.0
    * Reimplemented milter without external LibMilter dependency.
    * PostSRSd milter supports not rewriting locally delivered
    mails now.

++++ python-Authlib:

  - Split test package and use multibuild, so it can be excluded from
    the build.

++++ python-Pint:

  - Don't test with python311-dask-array: no longer available, SPEC 0

++++ python-asdf:

  - Update to 5.3.1
    * Fix bug where add_history_entry incorrectly used a custom
    schema if available. #2044

++++ python-click-extra:

  - update to 7.20.1:
    * Fix the MkDocs plugin and Sphinx directives leaving Rich-based
    CLIs (such as rich-click) colorless in rendered documentation.
  - update to 7.20.0:
    * Add MultiChoice to click_extra.types: a Click ParamType for
    comma-separated multi-pick from a fixed set of values, the
    pick-many counterpart to click.Choice.
    * Extend the --show-params table with seven new columns (Is flag,
    Flag value, Is bool flag, Multiple, Nargs, Prompt, Confirmation
    prompt).
    * Add the --columns option (ColumnsOption, @columns_option) for
    SQL SELECT-style column selection on both --show-params and the
    standalone click-extra show-params subcommand.
    * Add a click:tree Sphinx directive that walks a Click command
    tree and expands into a summary table plus one {click:run}
  - -help block per command. MyST-only.
    * Fix click-extra show-params ignoring the top-level
  - -table-format option and rendering its default as the enum
    name instead of the kebab-case ID.
    * Fix click-extra show-params and click-extra man resolving
    auto-generated environment variables as empty; the envvars
    column now matches what Click reads at runtime.
    * Fix the MkDocs plugin stripping ANSI escape codes but rendering
    no colors: it now generates the ANSI Pygments stylesheet and
    registers it through extra_css, so the -Ansi-* classes it emits
    are styled.
    * Drop duplicate and dead CSS classes from ANSI HTML rendering:
    compound tokens like Token.Ansi.Bold.Cyan now emit -Ansi
  - Ansi-Bold -Ansi-Cyan instead of repeating -Ansi-Bold and
    adding an unstyled -Ansi-Bold-Cyan.
  - update to 7.19.0:
    * Add an --output-dir DIR option to the click-extra man
    subcommand. With it set, the command writes one .1 file per
    (sub)command in the resolved tree into DIR (created if missing)
    instead of printing a single page to stdout. Suitable for
    invocation from a release pipeline or a distributor's build
    phase (Debian's override_dh_installman, Guix'
    install-man-page), without a project-local wrapper script.
    * Add a click_extra_manpages Sphinx configuration value (and the
    matching click_extra.sphinx.manpages module) and a
    click-extra-manpages directive. Projects enabling
    click_extra.sphinx can declare one or more {"script",
    "prog_name", "output_dir", "render_html"} entries to emit the
    corresponding Click command tree(s) as roff .1 files into
    <outdir>/<output_dir>/ on every HTML build. Each script is
    resolved the same way click-extra man does (console-script
    entry point, module:function, .py path, or module name); only
    HTML-family builders trigger the hook. When mandoc or groff is
    on PATH, every .1 also gets a browser-viewable .html sibling.
    The click-extra-manpages directive renders a relative-URL
    bullet list of all declared pages; it works at any depth in the
    doc tree.
    * Fix ExtraVersionOption.package_version resolving to None when
    the package's top-level module name differs from its installed
    distribution name (PIL vs Pillow, jwt vs PyJWT). The lookup now
    falls back to importlib.metadata.packages_distributions() on
    PackageNotFoundError. Ambiguous mappings (one import name to
    several distributions) still return None and log a debug
    message; pass package_name explicitly to disambiguate. Mirrors
    the upstream fix in PR pallets/click#3582.

++++ python-cotengra:

  - Update to 0.8.1
    * fix Contractor called with explicit backend (#83).
  - Release v0.8.0
    [#]# Enhancements
    * "auto" and "auto-hq" presets now default to parallel="auto"
    * HyperOptimizer: now defaults to using subtree reconfiguration
    (turned off if any other refinement options are explitly given)
    * ContractionTree.subtree_reconfigure: add maxiter="auto" option,
    which defaults to min(tree.N, maxiter_auto_cap), where
    maxiter_auto_cap is a new argument to the preset constructors
    (default 128 for auto and 1024 for auto-hq).
    * Added a benchmarking example - Benchmarking and cotengra
    * Default node type for ContractionTree changed to SSA-based
    representation, which is faster and uses less memory for big
    trees. Factored out node logic into a new nodeops module, with
    dynamic namespaces supporting both frozenset-based and
    SSA-based nodes.
    * ContractionTree: add get_peak_size, reorder_for_peak_size, and
    max_contraction_size.
    * ContractionTree: support single input "contractions" (trivial
    trees with a single tensor).
    * HyperOptimizer.search: support single terms (#77).
    * Change default finishing optimize step (e.g. for
    slicing/subtree reconfigure) to "auto".
    * Subtree reconfigure: add select="descend" mode.
    * PartitionTreeBuilder.build_divide: default to random-greedy-128
    for super_optimize.
    * Greedy optimizers: add max_neighbors option to limit candidate
    pair generation, which helps for graphs with very large batch
    indices.
    * Allow hashing optimize when given as a list of lists (e.g.
    nested SSA paths).
    * Refactor the optlib interface for cleaner integration of
    multiple Bayesian / population-based optimizers; add sbplx,
    sses (steady-state evolutionary strategy), and neldermead /
    neldermead-adapt simple internal optimizers.
    * Add implementation="pytblis" for contraction via pytblis.
    * Update parallel logic for sub-workers, allowing nested
    parallelism without oversubscription.
    * DiskDict: add get, keys, values, items, __delitem__; enhance
    clear and cleanup methods.
    * Python optimal optimizer: accept float factors (#58).
    * Update schematic module with improvements pulled in from quimb.
    * einsum via bmm (implementation="cotengra"): update
    einsum-string parsing to follow more recent numpy behavior.
    [#]# Bug fixes
    * Fix a rare bug relating to wrongly cached index ordering in
    ContractionTree.
    * Fix + test tensorflow contraction with strip_exponent (#81).
    * ContractionTree.contract_nodes: always check for root, fixing
    an edge case in incremental contraction.

++++ python-joserfc:

  - Update to 1.7.1
    * jwe: When decrypt, use the original aad base64 value
  - Update to 1.7.0
    * jwk: As_dict, as_pem, as_der export public key by default
    * typing: Update type hints for dropping python 3.9
    * typing: Use Iterator for _filter_keys_by_parameters return value
  - Update to 1.6.8 (fixes CVE-2026-48990 (bsc#1268515),
    CVE-2026-49852 (bsc#1270234))
    * Reject empty OctKey.
  - drop support-cryptography-47.patch, merged upstream

++++ python-libtmux:

  - update to 0.58.1:
    libtmux 0.58.1 restores compatibility with pytest 9.1. libtmux's
    bundled pytest plugin no longer aborts at import time, so
    projects that rely on libtmux's fixtures can move to the latest
    pytest without their test suite failing before collection.
    pytest 9.1 rejects marks applied to fixture functions during
    plugin import — before collection begins. Because the plugin
    ships as an installed entry point, this aborted the entire test
    session for any downstream project that has libtmux installed
    (for example, tmuxp). The fix removes a no-op skipif mark from
    the zshrc fixture; the real zsh handling lives in conftest.py and
    is unchanged, so behavior is identical for zsh and non-zsh users.
    This is a bug-fix-only patch release, per libtmux's pre-1.0
    version policy (patch = bug fixes; minor = features/breaking
    changes).
    See the CHANGES entry for full details.
  - Fix pytest 9.1 fixture-mark import failure by @tony in #687

++++ python-ndtiff:

  - skip build for python311

++++ python-nltk:

  - Update to 3.10.0rc1 (CVE-2026-54293, bsc#1268526)
    * Let TextCat.guess_language return Unknown for ties (optional)
    * fix(security): block XML entity expansion in downloader index parsing
    * Fix FunctionalCategory.substitute() ignoring substituted direction
    * Fix APP_RE rejecting variable direction underscore
    * Precompute unigram fallback per candidate in TnT decoder
    * fix(security): prevent DNS-rebinding SSRF in pathsec.urlopen
    * fix(security): block URL-encoded path traversal in nltk: resource URLs
    * fix(security): block path traversal in NKJPCorpusReader
    * fix(security): block path traversal in FramenetCorpusReader.frame()
    * fix(security): prevent ReDoS in ReviewsCorpusReader FEATURES regex (CWE-1333)
    * Document NLTK's new security policy

++++ python-openapi-pydantic:

  - Initial package (version 0.5.1)

++++ python-pyUSID:

  - skip build for python311

++++ python-rich-rst:

  - Initial package (version 2.0.1)

++++ python-scikit-hep-testdata:

  - Update from 0.5.4 to 0.6.5
    * feat: add more MC lhe files for pylhe by @APN-Pucky in #180
    * feat: add unbinned HS3 workspace for pyhs3 validation tests by
    @kratsg in #182
    * fix: Add JSON file as valid extension for file list by @kratsg
    in #184
    * feat: add imported NanoAOD RNTuple by @ariostas in #186
    * refactor: Use pathlib over os by @matthewfeickert in #196
    * fix: use the same cache directory for remote and local files by
    @ariostas in #197
    * feat: Migrate project metadata to pyproject.toml by
    @matthewfeickert in #201
    * fix: Update HS3 Workspace to match schema changes by @kratsg in
    [#212]
    * feat: add RNTuple with inherited structs by @mrzimu in #216
    * feat: add large-valued int{16,32,64} field rntuples by
    @wdconinc in #218
    * feat: read TMatrixTSym from TTree by @mrzimu in #220

++++ python-sidpy:

  - skip build for python311

++++ python-sparse:

  - Don't test dask-array on python311: No longer available, SPEC 0

++++ python-sybil:

  - Update to 10.1.0:
    * Ignore trailing whitespace in doctest output by default, see
    :data:`~sybil.evaluators.doctest.KEEP_TRAILING_WHITESPACE` if you need
    whitespace sensitivity.
    * Make :func:`~sybil.testing.run_pytest` runs immune to ambient color
    environment variables.
    * Re-work :func:`~sybil.testing.run_pytest` to fix problems caused by
    re-invoking external plugins during the nested runs.
    * Moved to a uv-based, pyproject.toml-driven project layout.
    * Introduce ruff code formatting.
    * Fixed several issues with lexing of Markdown fenced code blocks.
    * Add :func:`~sybil.testing.run_pytest` to for in-process pytest execution
    of example tests that use :any:`fixtures <fixture>` in documentation.
    * Supported Python versions are now 3.11 onwards.

++++ python-testfixtures:

  - Update to 12.1.0:
    * :func:`compare` now supports :doc:`numpy <numpy>` arrays.
    * Added a helper for :doc:`testing command-line scripts <command>`.

++++ python-uncalled-for:

  - Initial package (version 0.3.2)

++++ python-uproot:

  - Update to 5.7.4
    * fix: issues with freethreading and include Python 3.14t in CI
    by @ariostas in #1619
    * fix: TProfile reading and writing logic by @ariostas in #1609
    * fix: FreeSegments end calculation when crossing 2 GB boundary
    by @ariostas in #1622
  - Release v5.7.3
    [#]# New features
    * feat: add awkward_form method for TMatrixTSym-v5 model by
    @mrzimu in #1610
    [#]# Bug-fixes and performance
    * fix: logical bug in boundary check for unique RField names by
    @mrzimu in #1602
    * fix: bug in num_entries to properly use regularize_files by
    @nickwp in #1603
    * fix: resolve issue mktree/mkrntuple creating subdirectories by
    @ariostas in #1599
    * fix: fix rare issue that causes corrupted free_num_bytes by
    @ariostas in #1601
    * fix: allow tuples and slightly more generic NumPy dtypes in
    mktree and mkrntuple by @ariostas in #1604
    * fix: use Python ints for start/stop when reading a single
    basket by @ariostas in #1605
    * fix: make step sizes of iterate more accurate by @ariostas in
    [#1606]
  - Release v5.7.2
    [#]# Bug-fixes and performance
    * fix: make Library.eq safe for invalid comparisons by @Rachit931
    in #1565
    * fix: respect entry bounds for RNTuple.iterate and add of
    regressions tests for out of bounds by @KaranSinghDev in #1573
    * fix: resolve issues with pyroot buffer reallocation by
    @ariostas in #1569
    * fix: GPU interpretation of RNTuple data working and implement
    nvCOMP decompression with nvCOMP library by @fstrug in #1557
    * fix: allow mkrntuple to accept wider range of objects that can
    be reduced to RecordArray/RecordForm by @ariostas in #1577
    * fix: ensure RNTuple _from_zigzag applies bit shift on unsigned
    integers by @wdconinc in #1593
    * fix: make inherited fields accessible by @ariostas in #1589
    * fix: reading RNTuple fields into NumPy by @ariostas in #1591
    * refactor: Removes optional handling for required dependencies.
    by @Rachit931 in #1579
  - Release v5.7.1
    [#]# Bug-fixes and performance
    * fix: Defer default timeouts to underlying libraries where
    possible by @chaen in #1560
  - Release v5.7.0
    [#]# New features
    * feat: set divisions to unknown if we expect a read error report
    in uproot.dask by @ikrommyd in #1543
    [#]# Bug-fixes and performance
    * fix: Remove spaces in class names when TBranch matching
    streamer by @mrzimu in #1542
    * fix: allow start=stop=0 for empty files in uproot.dask by
    @ikrommyd in #1540
    * fix: exit early from uproot.iterate when no branches/fields
    match the filters by @Rachit931 in #1554
  - More changes sbetwen 5.6.2 and 5.7.0 see
    https://uproot.readthedocs.io/en/latest/changelog.html

++++ python-validate-pyproject:

  - Skip more tests that require network access.

++++ python-watchfiles:

  - Split test package and use multibuild, so that the test package
    can be excluded from the build.

++++ quickjs:

  - Explicitly add -fPIC to fix:
    /usr/lib/quickjs//libquickjs.a(libregexp.o): warning: relocation
    against `lre_ctype_bits' in read-only section `.text'
    /usr/lib/quickjs//libquickjs.a(quickjs.o): relocation R_X86_64_PC32
    against symbol `lre_ctype_bits' can not be used when making a
    shared object; recompile with -fPIC

++++ reuse:

  - Update to version 6.2.0 (fixes the build; the package was flagged
    for removal by botdel after >= 6 weeks of build failures):
    * file-type detection moved from binaryornot to python-magic
    (libmagic) — this also resolves the test_project failure that
    broke the build on Tumbleweed, where binaryornot misclassified a
    tiny ASCII file as binary
    * see the upstream CHANGELOG for the full 5.0.2 -> 6.2.0 feature set
  - Adjust dependencies for 6.2.0: require python >= 3.10; replace
    python3-binaryornot with python3-python-magic; drop the explicit
    python3-boolean.py (now pulled in transitively via
    license-expression); raise the floors on attrs (>= 23.2), click
    (>= 8.1), license-expression (>= 21.6.14) and python-debian
    (>= 0.1.48)
  - Enable the optional encoding-detection backends (python3-chardet,
    python3-charset-normalizer; file-magic comes from the file package)
    so the TestEncodingModule suite runs against all backends
  - Run the doc build with src/ on PYTHONPATH (apidoc/autodoc imports
    the modules) and SPHINXOPTS= so the offline intersphinx warning is
    not fatal; point %check at tests/ with the installed package on
    PYTHONPATH so the subprocess-based tests can import reuse

++++ rumdl:

  - Update to version 0.2.18:
    * Fixed
  - md013: preserve MyST directives and roles during reflow
    (a31a602)
  - positions: char-based marker columns in MD018, MD029, MD069
    (97212f3)
  - positions: address review - MD037 filter, boundary-safe
    parser conversions, MD063 column (6fd43f7)
  - positions: char-based end column in MD070; document the
    column convention (039a334)
  - positions: use character-based end columns across remaining
    rules (efc29da)
  - positions: report character-based columns in inline-content
    rules (e7fd2ee)
  - positions: make shared column helpers character-based
    (5ca4814)
  - md057: report character-based columns for non-ASCII lines
    (d8d07eb)
  - Update to version 0.2.17:
    * Fixed
  - md077: skip footnote definition bodies in list continuation
    check (#669) (388b63f) - thanks @vEnhance
  - lsp: offer quick fixes across a diagnostic's full line span
    (c533b75)

++++ selinux-policy:

  - Update to version 20260618:
    * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
    * Add sysnet_mount_file() interface

++++ soapy-uhd:

  - Fix the build against UHD 4.x and recent Boost (the package was
    flagged for removal by botdel after >= 6 weeks of build failures):
    * cxx17.patch (pothosware/SoapyUHD#75): build with C++17, required by
    UHD 4.x public headers (std::optional, std::is_convertible_v)
    * boost-lexical-cast.patch (pothosware/SoapyUHD#76): include
    boost/lexical_cast.hpp explicitly; recent Boost no longer pulls it
    in transitively

++++ transmission:

  - Add arm to ExcludeArch, 32bit arm does not build either.

++++ tinyproxy:

  - Add 0001-reqs-prevent-request-smuggling-via-both-content-leng.patch
    0001-reqs-prevent-multiple-content-lengths-getting-emitte.patch
    [boo#1268474, CVE-2026-54387]
    [boo#1268475, CVE-2026-54388]
  - Add 0001-reqs-improve-stathost-detection-606.patch
    [boo#1268476, CVE-2026-55202]

++++ wireguard-tools:

  - Remove selinux specific code from dns hatchet, as it allows for a
    cleaner handling in the selinux policy (bsc#1243148)
    adding Revert-dns-hatchet-apply-resolv.conf-s-selinux-conte.patch

++++ xdg-desktop-portal-wlr:

  - Update maintainer GPG key.
  - Update to 0.8.3:
    * Fix low FPS during screencasting.

++++ xorgxrdp:

  - Update to 0.10.5:
    + Fix bug in Chrome pointer detection (#394 #396)
  - Changes from 0.9.20
    + Update to version 0.10.4:
  - Internal Changes
    + The dixGetDisplayName() function is used to access the
    display name where available (#367).
    + FreeBSD CI testing is now performed (#379).
    + autoconf version is changed from 2.65 to 2.69 (#378).
  - Changes for Packagers or Developers
    + This version is intended to be used together with xrdp
    v0.10.3 or later.
    + Update to version 0.10.3:
  - New Features
    + H.264 capture is now supported (#355).
    + Frame capture interval can now be configured separately
    via xrdp for H.264 and RFX (#347, #353).
  - Bug Fixes
    + Fix dependency when building without glamor (#330).
    + RandR is now aware of physical monitor sizes if passed
    to the client (#337).
    + Glamor whitelist now supports amdgpu (#329) and msm
    (#346) drivers.
  - Changes for Packagers or Developers
    + This version is intended to be used together with xrdp
    v0.10.2 or later.
    + Update to version 0.10.2:
  - New Features
    + Check list of support devices in glamor (backport of
    [#322]).
    + Support NULL cursors and large mono cursors (#320,
    backport of #323).
  - Bug Fixes
    + Separate out key frame request from MAX_INT frame ACK to
    prevent multi-monitor screen corruption (backport of
    [#288]).
    + Fixes complex dirty region causing overflow of xrdp
    comms buffer (#318, backport of #319).
  - Known Issues
    + The backport of #322 can cause some working systems using
    amdgpu to no longer use Glamor acceleration (#341).
    + Update to version 0.10.1:
  - New Features
    + Switch to wyhash from CRC for capture tile diff and
    introduce lazy color conversion (#167, #301).
    + Update to version 0.10.0:
  - Highlights
    + Added Graphic Pipeline Extension (GFX) support,
    achieving higher frame rates and less bandwidth
    utilization.

++++ xrdp:

  - Recommend pipewire-module-xrdp to bridge pipewire audio.

++++ yambar:

  - Add yambar-gcc15-const.patch: fix the GCC 15 build failure
    (-Werror=discarded-qualifiers) in tag.c and modules/script.c, where
    strchr()/memchr() on a const string now preserve const; cast where
    the buffer is written in place, use const where it is only read
    (submitted upstream). Package was flagged for removal by botdel.
  - Apply patches with %%autosetup -p1 so the modules/ subdir patch lands

------------------------------------------------------------------
------------------  2026-6-17  -  Jun 17 2026  -------------------
------------------------------------------------------------------

++++ ImageMagick:

  - disable dpc support [bsc#1268117] [bsc#1268113]

++++ MozillaThunderbird:

  - Enable clang_build to allow building with the latest versions of
    llvm/clang due to them dropping support for update-alternatives.

++++ agama:

  - Import statically defined schemas when generating OpenAPI schema
  - Schemas moved from agama-lib/share to share/
  - agama monitor: Properly report as waiting for user when
    agama is busy and has some question to answer
    (gh#agama-project/agama#3638)

++++ alloy:

  - Update to version 1.17.0:
    * Features
    Add GraphQL server and gql subcommand
    otelcol: Add Nginx receiver
    otelcol.exporter.prometheus: Convert classic histograms to NHCB
    database_observability: Various enhancements for MySQL and Postgres
    faro.receiver: Support gzip-compressed request bodies
    Update to Beyla 3.9.8
    * Bug Fixes
    Address Critical CVE's From Scanner
    security: Update x/crypto, x/net, jackc/pgx/v5, and obi
    cluster: Fix nodes failing to join the cluster with TLS enabled
    loki.process: Fix potential deadlocks and limit stage shutdown
    Update go to v1.26.4
    * CVE-2026-44740: Fix potential DoS via infinite loops, panics or
    resource consumption by bumping
    go-git/go-billy/v5 to 5.9.0 (bsc#1267333)
    * CVE-2026-45678: Fix Postgres BIND parsing by bumping
    go.opentelemetry.io/obi to 0.9.0 (bsc#1267481)
    * CVE-2026-45682: Fix memory leak in OpenTelemetry eBPF
    instrumentation by bumping
    go.opentelemetry.io/obi to 0.9.0 (bsc#1267485)
    * CVE-2026-45686: Fix integer overflow in memcached text protocol
    parser by bumping go.opentelemetry.io/obi to
    version 0.9.0 (bsc#1267489)
    * CVE-2026-45685: Fix DoS in MongoDB TCP parser by bumping
    go.opentelemetry.io/obi to 0.9.0 (bsc#1267488)
  - Drop patches:
    * 0001-Bump-sql_exporter.patch
    * 0002-Bump-Apache-Thrift.patch
    * 0003-Bump-jackc-pgx.patch
  - Update to version 1.16.3:
    * Bug Fixes
    cluster: Fix nodes failing to join the cluster when TLS is
    enabled
  - Update to version 1.16.2:
    * Bug Fixes
    loki.process: No longer mutate rules in stage.truncate causing
    every config update to reload pipeline when this
    stage is used
    loki.process: Potential deadlock on update with stage and
    receiver changes
    otelcol.exporter.awss3: Add missing unique_key_func_name
    attribute
    security: Address Critical CVE's From Scanner
    security: Update x/crypto and x/net for CVEs: CVE-2026-39827,
    CVE-2026-39834, CVE-2026-39828, CVE-2026-39829,
    CVE-2026-39831, CVE-2026-42508, CVE-2026-39833,
    CVE-2026-39830, CVE-2026-39832, CVE-2026-46597,
    CVE-2026-46598, CVE-2026-46595, CVE-2026-39835
    (bsc#1266196)
    CVE-2026-39821: Fix validation bypass and privilege escalation
    by bumping x/net/idna (bsc#1266654)
    security: Fix multiple issues when parsing HTML files:
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136,
    CVE-2026-25681, CVE-2026-42506 (bsc#1267185)
    CVE-2026-33532: Remove dependency on vulnerable yaml library
    (bsc#1260981)

++++ amarok:

  - Update to 3.3.3
    https://blogs.kde.org/2026/06/17/amarok-3.3.3-released/
    * Restore functionality for inhibiting system suspend when music is playing
    * Fix restoring main window layout after restart (kde#514963)
    * Fix context applet height saving sometimes not working (kde#514190)
    * Adapt parsing in Wikipedia applet to handle some page syntax changes
    * Don't multiply tracks when dragging from file browser to PUD (kde#521425)
  - Drop gcc16.patch

++++ baresip:

  - Update to versoin 4.9.0
    * tls: change to non-deprecated TLS_METHOD_XXX.
    * ua: emit event for failed incoming INVITE.
    * ua: avoid fallback 500 after unsupported address family.
    * ua: stop processing INVITE after 421 response.
    * test: add 100rel required reject testcase.
    * docs: minor cleanup of example config.
    * contact: add command to clear all contacts.
    * uag: check registration state of fallback UA.
    * call: make call_supported() input argument const.

++++ bpftrace:

  - Add version postfix when calling Clang

++++ bshoshany-thread-pool:

  - Initial package (version 4.1.0):
    * Header-only BS::thread_pool C++17 thread pool library, needed to
    enable the inspector thread pool (ENABLE_THREAD_POOL) in falco-libs.
    * Run the upstream test suite during %%check.

++++ chromium:

  - Use version suffix for llvm/clang commands
  - added patches:
    * chromium-149-strip-path.patch
  - Chromium 149.0.7827.155 (boo#1268373):
    * CVE-2026-12437: Use after free in WebShare
    * CVE-2026-12438: Inappropriate implementation in WebView
    * CVE-2026-12439: Use after free in Digital Credentials
    * CVE-2026-12440: Use after free in DigitalCredentials
    * CVE-2026-12441: Use after free in File Input
    * CVE-2026-12442: Use after free in Passwords
    * CVE-2026-12443: Use after free in Web Authentication
    * CVE-2026-12444: Out of bounds read in Chromoting
    * CVE-2026-12445: Use after free in Extensions
    * CVE-2026-12446: Insufficient data validation in Passwords
    * CVE-2026-12447: Heap buffer overflow in WebRTC
    * CVE-2026-12448: Inappropriate implementation in WebView
    * CVE-2026-12449: Use after free in Chromoting
    * CVE-2026-12450: Inappropriate implementation in Media
    * CVE-2026-12451: Use after free in DigitalCredentials
    * CVE-2026-12452: Use after free in Downloads
    * CVE-2026-12453: Insufficient validation of untrusted input in Input
    * CVE-2026-12454: Race in Safe Browsing
    * CVE-2026-12455: Use after free in Tab Strip
    * CVE-2026-12456: Insufficient validation of untrusted input in Extensions
    * CVE-2026-12457: Insufficient data validation in Extensions
    * CVE-2026-12458: Incorrect security UI in Passwords
    * CVE-2026-12459: Inappropriate implementation in Serial
    * CVE-2026-12460: Insufficient policy enforcement in File System Access
    * CVE-2026-12461: Out of bounds read in WebRTC
    * CVE-2026-12462: Use after free in Media
    * CVE-2026-12463: Inappropriate implementation in Views
    * CVE-2026-12464: Use after free in Browser
    * CVE-2026-12465: Insufficient validation of untrusted input in Metrics
    * CVE-2026-12466: Heap buffer overflow in WebRTC
    * CVE-2026-12467: Use after free in Extensions
    * CVE-2026-12468: Inappropriate implementation in Updater
    * CVE-2026-12469: Uninitialized Use in GPU

++++ cmake:

  - update to 4.3.4
    * cmake-instrumentation(7), introduced in 4.3.0, has been changed
    to generate index files and snippet files with a new version
    field format.
  - update to 4.3.3
    * The export(PACKAGE_INFO) command now writes to the
    cps/<package-name> subdirectory of the current build directory,
    rather than directly to the current build directory.

++++ cmake-ui:

  - update to 4.3.4
    * cmake-instrumentation(7), introduced in 4.3.0, has been changed
    to generate index files and snippet files with a new version
    field format.
  - update to 4.3.3
    * The export(PACKAGE_INFO) command now writes to the
    cps/<package-name> subdirectory of the current build directory,
    rather than directly to the current build directory.

++++ cmake-full:

  - update to 4.3.4
    * cmake-instrumentation(7), introduced in 4.3.0, has been changed
    to generate index files and snippet files with a new version
    field format.
  - update to 4.3.3
    * The export(PACKAGE_INFO) command now writes to the
    cps/<package-name> subdirectory of the current build directory,
    rather than directly to the current build directory.

++++ cmake-mini:

  - update to 4.3.4
    * cmake-instrumentation(7), introduced in 4.3.0, has been changed
    to generate index files and snippet files with a new version
    field format.
  - update to 4.3.3
    * The export(PACKAGE_INFO) command now writes to the
    cps/<package-name> subdirectory of the current build directory,
    rather than directly to the current build directory.

++++ containerized-data-importer-1.65:

  - Fork of containerized-data-importer 1.65.0 as the versioned package containerized-data-importer-1.65,
    so multiple minor releases can be maintained in parallel
    (packaged like kubectl). Provides/Obsoletes the unversioned
    containerized-data-importer-* subpackages.

++++ containerized-data-importer1.65:

  - Fork of containerized-data-importer 1.65.0 as the versioned package containerized-data-importer1.65,
    so multiple minor releases can be maintained in parallel
    (packaged like kubectl). Provides/Obsoletes the unversioned
    containerized-data-importer-* subpackages.

++++ duplicity:

  - Update to version 3.1.0
    * new:usr: Add include/exclude restore filtering using archive-relative paths
  - Update to version 3.0.8
    * fix:usr: Unnecessary passphrase prompt with --encrypt-key --no-check-remote.
    * fix:usr: Handle local version identifiers in b2backend
    * temporarily disable remote validation introduced in 3.0.6.3
    (gl#duplicity/duplicity#924)
    * new:usr: Add --full-if-n-inc flag for count-based full backup.
    * fix:usr: Fix so GNUPGHOME is not changed in production.
    (gl#duplicity/duplity#922)

++++ edge-addition-planarity-suite:

  - Update to release 5.0.0.0
    * Refactored the libPlanarity graph library APIs. The header
    files were reorganized so that the public APIs are exactly
    characterized by declarations reachable by including
    graphLib.h.

++++ falco-libs:

  - Initial package (version 0.25.4): the falcosecurity libs (libscap
    and libsinsp) built as shared libraries
  - Enable the inspector thread pool (ENABLE_THREAD_POOL) using the
    system bshoshany-thread-pool
  - Run the libsinsp gtest unit-test suite (844 tests) during %%check
  - Ship the libscap test_input engine: with CREATE_TEST_TARGETS libsinsp
    links it (DT_NEEDED), so libsinsp0 needs it at runtime
  - Restrict to the arches whose modern-BPF vmlinux.h is vendored
    (x86_64 aarch64 ppc64le s390x)
  - Trim BuildRequires to the set the build actually uses (drop unused
    grpc/protobuf/libcurl/libcares/openssl/luajit/ncurses/yaml-cpp/
    libb64/libjq) and drop cmake flags that are not real options in
    this release

++++ ffmpeg-8:

  - Update to release 8.1.2
    * Fix some buffer overflows, integer overflows, negative
    indices, off-by-one erros and double frees in various codecs,
    muxers and filters.

++++ ffmpeg-8-mini:

  - Update to release 8.1.2
    * Fix some buffer overflows, integer overflows, negative
    indices, off-by-one erros and double frees in various codecs,
    muxers and filters.

++++ firefox-esr:

  - Enable clang_build to allow building with the latest versions of
    llvm/clang due to them dropping support for update-alternatives.

++++ gap-digraphs:

  - Add eaps5.patch

++++ gap-linearalgebraforcap:

  - Update to release 2026.05.04
    * No changelog was provided

++++ gap-localizeringforhomalg:

  - Update to release 2026.05.01
    * No changelog was provided

++++ gh:

  - Update to version 2.94.0:
    * Add gh discussion and Issues 2.0 reference to the `gh` skill, plus a README note (#13631)
    * fix(discussion comment): fix bug in requiring body/body-file in add/edit mode
    * chore(discussion/client): rename client files
    * test(acceptance): fix discussion comment acceptance tests
    * fix(discussion/shared): error on out-of-range discussion number in URL
    * fix(discussion view): print only requested items in non-tty output
    * docs(discussion list): clarify answered examples refer to Q&A discussions
    * fix(discussion view): show comments and replies in chronological order
    * refactor(discussion list): simplify no-results message and use success icon helper
    * fix(discussion view): use color scheme method for success icon
    * fix(discussion view): error when --comments is used with a comment argument
    * test(acceptance): use positional comment argument in discussion view test
    * refactor(discussion/client): take host instead of repo in GetComment
    * refactor(discussion view): replace --replies flag with positional comment argument
    * chore: fix formatting
    * test(acceptance): cover discussion comment URLs in comment and view tests
    * feat(discussion): support comment URLs in --replies and comment command
    * test(discussion comment): add non-tty delete flag validation test case
    * test(acceptance): add discussion comment acceptance test
    * refactor(acceptance): use discussion comment command instead of raw API calls
    * feat(discussion): add discussion comment command
    * feat(discussion/client): add comment manipulation methods
    * chore: apply formatting
    * chore(discussion): remove unused HttpClient field from create and edit
    * fix(discussion): remove redundant error wrapping on ListCategories
    * test(discussion list): rename TestNewCmdList2 to TestNewCmdList
    * Add terminal-mockup canvas extension for marketing screenshots (#13612)
    * fix(discussion): add missing repo flag override
    * test(discussion list): consolidate tests into table-driven format
    * docs(acceptance): add new jq2env and jq-assert functions
    * test(discussion): add acceptance tests for discussion commands
    * fix(discussion list): print "answered" instead of checkmark in non-tty mode
    * refactor(discussion/client): precheck discussions enabled via getRepositoryMeta
    * refactor(discussion): add Cursor field and ExportData to DiscussionListResult
    * feat(extension): alias `uninstall` to `remove`
    * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3
    * chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1
    * chore(deps): bump charm.land/bubbletea/v2 from 2.0.6 to 2.0.7
    * docs(discussion view): improve long help text for clarity
    * fix(discussion): handle partial failure on create/update label mutations
    * Clean up deferred issue update helper (#13584)
    * Auto-install official extension stubs in CI (#13581)
    * chore(discussion/client): fix formatting
    * docs(discussion/client): add godoc to exported consts
    * refactor(discussion list): make pager call/error consistent with view command
    * refactor(discussion): extract command-level consts for enums
    * fix(discussion): various polish and small fixes
    * Merge pull request #13057 from cli/kw/issues-2.0
    * Bump Go to 1.26.4
    * chore(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15
    * address review comments
    * feat(discussion edit): add discussion edit command
    * feat(discussion create): add discussion create command
    * feat(discussion view): add discussion view command
    * feat(discussion list): add discussion list command
    * feat(discussion/shared): add shared utilities for discussion commands
    * feat(discussion/client): add discussion client package
    * Use github-copilot agent ID in skill list tests and help text
    * Rename hosts field and helpers to agentHosts in skill list
    * Stat SKILL.md before reading in skill list
    * Sanitize terminal control characters in skill list output
    * chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
    * chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10
    * address copilot comments, clarify text
    * address copilot comments
    * handle skills in skills/ folder when running list command, by marking them as published
    * address bagtoad's feedback
    * add --all flag to install all skills in a repo
    * fix warning message to make it clear
    * skip prompting for skills without metadata when running gh skill update --all
    * add logic to preview too
    * fix discovery support in nested dirs
    * fix test
    * fix tests
    * fix linting
    * add skill list command

++++ ghc-http-client-restricted:

  - Update http-client-restricted to version 0.1.1.
    http-client-restricted (0.1.1) unstable; urgency=medium
    * Allow building with http-client-tls 0.4.x
  - - Joey Hess <id@joeyh.name>  Wed, 17 Jun 2026 16:28:27 -0400

++++ ghc-vector:

  - Update vector to version 0.13.2.0 revision 5.
    Upstream has revised the Cabal build instructions on Hackage.

++++ google-osconfig-agent:

  - Packaging improvements:
    * Remove define github project name components no longer needed
    * Define shortname corresponding to binary name when different
    from package name. Use shortname where applicable to normalize
    common lines across Go app packages, similar to name macro.
    * Drop BuildRequires: golang-packaging. The original macros for
    file movements into GOPATH are obsolete with Go modules. Macro
    go_nostrip is no longer needed with current binutils and Go.
    * Remove go_nostrip macro which is no longer recommended
    * Re-enable binary stripping and debuginfo boo#1210938
    * Remove goprep macro which is no longer recommended
    * Build PIE with pattern that may become recommended procedure:
    %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build
    A go toolchain buildmode default config would be preferable
    but none exist at this time.
    * Drop export CGO_ENABLED="0". Use the default unless there is a
    defined requirement or benefit.
    * For this package, we were seeing the expected error
    "-buildmode=pie requires external (cgo) linking, but cgo is not
    enabled" when using buildmode=pie and CGO_ENABLED=0. The error
    manifested only on s390x and i586 architectures, which was not
    expected. Resolve by using default CGO_ENABLED.
    * Remove ldflags -s (Omit symbol table and debug info) and -w
    (Omit DWARF symbol table). This information is used to produce
    separate debuginfo packages and binaries are stripped for
    reduced size by GNU strip during RPM build.
    * Remove ldflags -X entry for embedding build version metadata.
    This information is embedded in binaries with go1.18+ and
    available via go version -m or runtime/debug.ReadBuildInfo().
    * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
    * Raise minimum golang API version to 1.25.5 to match go.mod file
    * Use explicit upstream GitHub homepage in URL field
    * Use single invocation of %setup with -a1 to unpack both tarballs

++++ guile-arguments:

  - Update to version 0.2.0:
    * Release 0.2.0.
    * arguments: Add structured subcommand support.
    * arguments: Document why record predicates are duplicated.

++++ helmfile:

  - Update to version 1.5.5:
    * fix: restore s3:: vhost-style remote source support (#2643) by
    @yxxhero in #2644
    * feat: add helm 4 --server-side flag support for diff and bump
    helm-diff to v3.15.10 by @yxxhero in #2645

++++ iproute2:

  - Update to release 7.1
    * mptcp: monitor: add JSON support
    * iplink: bond_slave: print actor and partner churn state
    * dpll: add client-side filtering for device show, pin show
    * dpll: add pin filtering by parent-device and parent-pin
    * tc: Add JSON output support to HFSC/QFQ/multiq
    * ss: add support for showing TCP delack timers
    * Remove support for hamradio protocols

++++ kdeplasma6-addons:

  - Disable Kameleon QMK integration for now, review still pending
    (boo#1267818)

++++ kopia:

  - Update to version 0.23.1:
    * Summary
  - Bugfix release which fixes a rare race condition which might lead to a data loss - an upgrade is recommended
    * Repository
  - Basic tests for getting epoch manager blob set (#5418) by Julio López
  - selection of next epoch to compact (#5373) by Julio López
    * Storage Providers
  - no_extra_providers build tag (#5375) by Julio López
    * Linter
  - annotations for other platforms (#5413) by Julio López

++++ libfwevt:

  - Update to release 20260616
    * Added support for codepages; relaxed the hardcoded treatment of
    data items as windows-1252.

++++ libupnp:

  - Update to release 2.0.1
    * miniserver: Nagle algorithm on accepted TCP sockets is now
    disabled.
    * Use poll() to support fds higher than 1024.
    * chore: Normalized HTTP response header names to title-case.
    * Added UpnpGetSsdpReqPort4/6() to query SSDP M-SEARCH source
    port.
    * Explicitly-named non-multicast interfaces in UpnpGetIfInfo are
    now allowed.
    * Now rejects oversized HTTP POST body before buffering.
    * Now accepts RFC 1918 cross-subnet delivery URLs in GENA
    subscriptions.
    * Removed UpnpPrintf from public API.

++++ mbedtls:

  - Update to 4.1.0, a breaking major release of the Mbed TLS 4.x
    line:
    * The cryptography implementation has moved to the separate
    TF-PSA-Crypto library (libtfpsacrypto.so.2); PSA Crypto is
    now the primary cryptographic interface
    * libmbedcrypto is now a backward-compatibility library sharing
    the TF-PSA-Crypto SONAME
    * Numerous API/ABI changes; consumers must be rebuilt against
    the 4.x libraries
  - Packaging changes for the 4.x library layout:
    * SONAMEs bumped: libmbedtls 21 -> 23, libmbedx509 7 -> 9,
    libmbedcrypto 16 -> 18
    * New subpackage libtfpsacrypto2, which also ships the
    libmbedcrypto compatibility library (same SONAME)
    * Dropped the libeverest and libp256m subpackages; these are no
    longer built as separate shared libraries
  - Switch to the official mbedtls-4.1.0.tar.bz2 release tarball
    (bundles TF-PSA-Crypto) and drop the _service git checkout
  - Drop mbedtls-enable-pthread.patch and mbedtls-enable-srtp.patch;
    enable MBEDTLS_THREADING_C, MBEDTLS_THREADING_PTHREAD and
    MBEDTLS_SSL_DTLS_SRTP via the upstream scripts/config.py tool
  - Add mbedtls-fix-libmbedcrypto-compat-install.patch to install
    the libmbedcrypto compatibility library with executable
    permissions (gh#Mbed-TLS/mbedtls#10777)

++++ openjph:

  - Update to 0.29.0:
    * Bug fixes #284
    * fix: size precinct_scratch from per-component (COC) geometry #286
    * A bug fix #288
    * S390x Support #290

++++ re:

  - Update to version 4.9.0
    * tls: remove deprecated TLS_METHOD_xxx.
    * ci related changes.

++++ libreoffice:

  - Add upstream b08afae7e41fd5ca3a4101de07366783b17b3887.patch: Fix
    build with poppler 26.06

++++ rpm:

  - switch from rpmpgp_legacy to libpgpr
    * multiple bug fixes, support for v5 and v6 signatures
    * updated patch: pgpreleasemtime.diff
  - turn on imaevm file signature support and move the imaevm code
    that needs the libimaevm library into a plugin. Put this
    plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246]
    * new patch: imaevmsignplugin.diff

++++ sqlcipher:

  - Update to version 4.16.0:
    * Update SQLite baseline from 3.46.1 to 3.53.1
    * Sanitize source database name passed to sqlcipher_export
    (security hardening reported by Deutsche Telekom Security)
    * Add PRAGMA cipher_status to verify a database handle is
    using encryption
    * Restore and improve the LibTomCrypt provider; remove the
    deprecated LibTomCrypt and NSS providers
    * Numerous error-handling, logging and build fixes across the
    4.7.0 - 4.16.0 releases
  - Adapt packaging to upstream's new SQLite autosetup build system,
    which now installs sqlite3/libsqlite3 names by default:
    * Build the shared library as libsqlcipher.so.0 via
  - -dll-basename and an explicit soname, and rename the
    binary, manpage, pkgconfig file and headers back to
    sqlcipher to avoid colliding with the system sqlite3
    package (matches Debian and Arch packaging)
    * Rename the library subpackage from libsqlcipher-3_46_1-0 to
    the soname-based libsqlcipher0; update baselibs.conf
    * Drop the tcl-sqlcipher subpackage: upstream's new build no
    longer produces a standalone sqlcipher Tcl binding
    * Select the OpenSSL crypto provider through CFLAGS defines and
  - lcrypto instead of the removed --with-crypto-lib option

++++ libzim:

  - Update to version 9.8.0:
    * Speed-up ZIM creation with buffered IO
    * Allow compiling only the reader part of the library
    * Make the code base C++23 compatible
    * Fix compilation against Xapian 2.0
    * Better handling of ICU library dependence
    * Documentation improvements and CI updates

++++ liferea:

  - Update to version 1.16.12:
    + This is a security bugfix release.
    + Fixes a RCE vulnerability when importing OPML files containing
    script commands. Now script commands from untrusted OPML files
    are always dropped.
    + Fixes a RCE vulnerability in the download manager plugin where
    a command could have been injected into file paths.

++++ lighttpd:

  - update to 1.4.83:
    * add PQC hybrid KEM X25519MLKEM768 to default TLS groups
    * mod_sockproxy can now route connections based on TLS SNI
    * mod_proxy proxy.header enhanced config for url-path mapping of response headers
    * HTTP Incremental header support
    * portability/compatibility with library updates (lighttpd dependencies)
    * HTTP/1.1 Upgrade: h2c has been deprecated; set default to
    disabled in lighttpd, but can still be enabled in config, and
    http2 prior knowledge is still enabled

++++ lite-xl-plugin-manager:

  - Update to version 1.4.7+git20260506.ece8d63:
    * Fixed update-checksums, and and ensured we don't symlink lite-xl because of how it resolves things.
    * Typo.
    * Updated zlib.
    * Added in arch.
    * Fixed test.
    * Added cjson.
    * Don't bother installing local lite-xls.
    * Fixed an issue with plugins with different modversions but same version not appearing.
    * Changed switch slightly.
    * Paid more attention to the SYMLINK flag.
    * Added in new switch logic.
    * Updated CHANGELOG.md.
    * Added a UTC timestamp.
    * Added in removal for reinstalls of lite-xl, and added a local guard.
    * Updated CHANGELOG.md.
    * Due to a change in how libgit2 handles shallow clones, it's best if these are not enabled by default. If you shallow clone something, and try to update, it'll just regrab everything as of at least 1.9.1.
    * Improved update to not update only repos, but also to update SKIP checksum files.
    * Updated CHANGELOG.md.
    * Ensured that we only try to copy the system config when it actually exists.
    * Added in distinctions for different platforms for constructed bottles.
    * Removed simplfied.
    * Updated CHANGELOG.md.
    * Ensured version comes out in JSON.
    * Added in the capability of specifying a bottle's location, and constructing them as folders outside the normal flow.
    * Added in the ability to specify the system config.
    * Updated CHANGELOG.md.
    * Fixed deleting the wrong directories.
    * Ensured that --reinstall also reinstalls lite-xls.
    * Updated quickstart.

++++ neovim-gtk:

  - Update to version 1.0.1+279 (git snapshot):
    * Update to gtk-rs 0.21 / gtk4-rs 0.10 and nvim-rs 0.9.0
    * Fix tree filename sorting to implement a total order,
    avoiding panics with dead symlinks (gh#Lyude/neovim-gtk#138)
    * Emulate 'l' when pasting in insert/normal mode so the cursor
    moves after the pasted text (gh#Lyude/neovim-gtk#82)
    * Avoid panics during shutdown (missing nvim client, UI shut
    down before command completion)
    * Don't warn about the nocombine highlight attribute (used by
    Neovim 0.11 and newer)
    * Various dependency updates
  - Restrict the source service tag matching to v* so the upstream
    rolling "nightly" tag no longer breaks version detection

++++ nginx:

  - Extend keyring file based on https://nginx.org/en/pgp_keys.html
    https://github.com/nginx/nginx/issues/1477
  - Update to 1.31.2
    * ) Security: use-after-free might occur when using HTTP/3 and
    processing a specially crafted QUIC session, allowing an
    attacker to cause worker process memory corruption or
    segmentation fault in a worker process (CVE-2026-42530).
    Thanks to Trung Nguyen of CyStack.
    * ) Security: a heap memory buffer overflow might occur in a
    worker process when using a configuration with
    "ignore_invalid_headers off;" and
    "large_client_header_buffers" with large configured values
    when proxying a specially crafted request to HTTP/2 or gRPC
    backend, allowing an attacker to cause worker process memory
    corruption or segmentation fault in a worker process
    (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
    * ) Security: a heap memory buffer overread might occur in a
    worker process while handling a specially sent response with
    decoding from UTF-8 via the "charset_map" directive, allowing
    an attacker to cause a limited disclosure of worker proccess
    memory or segmentation fault in a worker process
    (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of
    CYBERONE.
    * ) Change: now the $request_id variable uses SipHash-2-4.
    * ) Feature: the $ssl_sigalgs variable.
    * ) Bugfix: a variable defined by the "split_clients" directive
    might be empty if all percentages were specified explicitly
    and summed up to 100%.
    * ) Bugfix: constant time "secure_link" hash comparison.
    Thanks to kodareef5.

++++ nvidia-open-driver-G07-signed-cuda:

  - changes to build also against the nvidia kernel, which is planned
    to be available for SLE16.1-aarch64

++++ nvidia-open-driver-G07-signed:

  - changes to build also against the nvidia kernel, which is planned
    to be available for SLE16.1-aarch64

++++ obs-studio:

  - Update to version 32.1.2:
    * libobs: Update version to 32.1.2
    * frontend: Fix nested menu styling
    * frontend: Optimize audio mixer updates
    * frontend: Rename MixerScrollArea in the Classic theme
    * frontend: Remove unused parameters from Classic theme
    * frontend: Remove unused parameters from System theme
    * frontend: Remove unused parameters from Rachni theme
    * frontend: Remove unused parameters from Light theme
    * frontend: Remove unused parameters from Acri theme
    * frontend: Fix contributing link in About
    * README.rst: Update contrib link and add codestyle
    * Update contributing and code style guidelines (#13296)
    * Clean up %files section and include SECURITY.md in %doc.
    * Move CONTRIBUTING.md and CODESTYLE.md to the -devel package
    * Drop stale _scmsync.obsinfo

++++ openQA:

  - Update to version 5.1781712973.4c20e5c1:
    * test: make search API tests robust
    * fix: resolve openqa-llm-server crash on startup
    * chore(deps): Dependency cron 2026-06-17
    * feat: Improve job archive generation efficiency and UI
    * feat: Efficiently serve job archives via web server redirect
    * feat: Add 'Download All' ZIP archive button to job downloads page

++++ os-autoinst:

  - Update to version 5.1781702821.22ced0d:
    * ci: Avoid unresolvable os-autoinst-openvswitch-test package for SLE-SP7
    * fix: Avoid unresolvable os-autoinst-devel-test package for SLE-SP7
    * feat: expose detect_serial_marker_capability as public
    * chore(mergify): adjust expectations to current OBS checks
    * style(perlcritic): Add BuiltinFunctions::RequireBlockGrep

++++ perl-Chart:

  - Add removed-rgb-method.patch to fix build
    https://github.com/lichtkind/Chart/pull/7

++++ perl-Spreadsheet-ParseXLSX:

  - updated to 0.370.0 (0.37)
    see /usr/share/doc/packages/perl-Spreadsheet-ParseXLSX/Changes
    0.37  2026-06-16
  - fixed build on open suse by adding NoLWP to XML::Twig constructor

++++ plugin-sdk-cpp:

  - Initial package (version 0.3.0):
    * Header-only C++ SDK for writing Falcosecurity plugins; build
    dependency of the falcosecurity container plugin.

++++ product-composer:

  - update to version 0.9.8
    * Support/fix checksums configurations per flavor

++++ python-Quart:

  - Skip a test broken by click.

++++ python-astropy:

  - Update to 7.2.1
    [#]# Bug Fixes
    [#]## astropy.config
    * Disabling thread concurrency within set_temp_cache and
    set_temp_config context managers, ensuring thread safety.
    [#19559]
    [#]## astropy.coordinates
    * The refresh_cache parameter of EarthLocation.of_site() and
    EarthLocation.get_site_names() methods now works. [#18687]
    * Relativistic Doppler shifts are now applied to SpectralCoord in
    the correct direction even if the astropy.units.spectral()
    equivalency is enabled. Previously enabling the equivalency
    could cause wrong results with the SpectralCoord.to_rest(),
    SpectralCoord.with_observer_stationary_relative_to() or
    SpectralCoord.with_radial_velocity_shift() methods. [#19001]
    * Fixed a broadcasting bug in
    astropy.uncertainty.distributions.uniform where
    multi-dimensional inputs (ndim >= 2) would raise a ValueError.
    [#19308]
    * Send a User-Agent header to the OpenStreetMap API in
    EarthLocation.of_address to fix access denied errors. [#19330]
    * Fixed a missing f-string in a TypeError from
    BaseAffineTransform._apply_transform that caused
    {data.__class__} to appear literally in the error message.
    [#19403]
    [#]## astropy.io.fits
    * Fix getdata()’s lower and upper keywords. [#19023]
    * np.char.chararray being deprecated in Numpy 2.5, in a future
    version io.fits will return a normal array instead of a
    chararray for string columns. As a consequence the special
    chararray methods will be deprecated in version 8.0 (e.g.,
    .rstrip() or .decode()). In version 7.2.x deprecation warnings
    from Numpy are simply filtered. [#19335]
    * Fix a bug which caused CompImageHDU to have both SIMPLE and
    XTENSION keywords when initialized from a PrimaryHDU header.
    [#19362]
    * Fix support for reading FITS files using image tile compression
    with UNCOMPRESSED_DATA columns. [#19363]
    * Fixed a bug that caused reading FITS files to not work properly
    on WASM when relying on the default memmap settings. [#19367]
    * Fixed silent data corruption in FITS_rec.__setitem__ when using
    negative slice indices. Assigning to slices like data[-2:] =
    new_rows previously wrote to the wrong rows because negative
    indices were clamped to 0 instead of being resolved relative to
    the array length. [#19404]
    * Fixed a bug that caused compressed FITS files to become
    corrupted when opened in update mode and modifying the header.
    [#19416]
    * Fix a bug that caused header verification for CompImageHDU to
    not work correctly and in some cases produce corrupt files when
    the decompressed header was a primary HDU header not an
    extension header. [#19438]
    * Prevent creating RICE_1 or PLIO_1 compressed files with
    (u)int64 data. If possible without overflow data is converted
    to (u)int32, otherwise an error is raised. [#19592]
    * Fix a bug that caused uint64 data to be silently shifted by
    2**63 when round-tripping through compressed FITS files (the
    FITS BZERO=2**63 offset was missing at compression time but
    still applied on read). Extend the existing RICE_1 and PLIO_1
    64-bit-to-32-bit conversion fallback to also cover uint64 input
    and HCOMPRESS_1, and fix big-endian 64-bit input being silently
    truncated by the conversion check instead of raising. Reject
    PLIO_1 with unsigned multi-byte input outright, since the BZERO
    convention used to store unsigned FITS data produces negative
    values that PLIO cannot encode. [#19670]
    * Fix a bug that caused int8 data to be shifted by 128 when
    round-tripping through compressed FITS files (the FITS
    BZERO=-128 offset was missing at compression time but still
    applied on read), so writing [0, 1] and reading back returned
    [-128, -127]. [#19738]
    [#]## astropy.modeling
    * Bugfix for Parameter.value accessor when the parameter value
    has not been set yet. [#19189]
    [#]## astropy.nddata
    * Fix unexpected behavior in Cutout2D.plot_on_original(). The
    displayed region spanned pixels not included in the cutout
    array. [#19829]
    [#]## astropy.stats
    * Fixed pickling of SigmaClip objects when Bottleneck is
    installed. _dtype_dispatch returned a local closure which
    cannot be pickled; replaced with a picklable _DtypeDispatch
    class. [#19372]
    [#]## astropy.table
    * Tables can now be joined and stacked also if they contain
    columns with user-defined data types such as QuadPrecDtype.
    [#19199]
    * Fixed AssertionError when passing numpy.bool_ as the index
    argument to Table.to_pandas() or Table.to_dataframe(). The
    correct ValueError is now raised instead. [#19358]
    * Fixed table index getting corrupted when a row assignment
    raises an exception mid-update. The index is now properly
    restored to its original state on failure. [#19450]
    * Fixes a problem where deepcopying a MaskedColumn did not
    correctly create the info attribute. This resulted in an
    inability to print the column after the deepcopy. [#19466]
    [#]## astropy.time
    * Fixed missing goto fail in create_parser in parse_times.c after
    setting a ValueError for invalid parameter array size,
    preventing execution from continuing with an exception already
    set. [#19368]
    [#]## astropy.units
    * Fixed a bug in the np.average function when weights with units
    and a different shape to the input array were passed and the
    optionally-returned sum of the weights was requested. The sum
    of the weights now has correct units. [#19055]
    [#]## astropy.utils
    * AttributeError will no longer occur when attempting to pickle
    an unbound DataInfo instance. [#19141]
    * Pickling Masked subclasses with an initialized info attribute
    no longer fails. [#19142]
    * ShapedLikeNDArray.take() now raises NotImplementedError when
    out is passed, instead of returning the exception object.
    [#19351]
    * Ensure that utils.masked.get_data_and_mask works properly with
    containers, returning None for the mask if masked is not set
    (instead of returning an all-False array). [#19534]
    * The dummy file object used by astropy.utils.misc.silence to
    replace sys.stdout/sys.stderr now implements flush() and
    isatty(), so importing libraries that probe the stream (e.g.
    IPython 9.13 at import time) no longer raises AttributeError
    under silence. [#19594]
    * Fixed a bug where values returned by cache_contents could
    include files and symlinks, instead of just directories.
    [#19672]
    * Add missing stacklevel arguments in warnings emitted from
    astropy.utils.data APIs [#19700]
    [#]## astropy.visualization
    * Fixed issues with the placement of WCSAxes tick labels for
    non-perpendicular grids or ticks. [#19057]
    [#]## astropy.wcs
    * Fixed a bug where degree units were hardcoded into the FITS WCS
    APE 14 world_to_pixel method. [#19506]
    * Lazily-populated caches on a WCS (such as the internal
    world_axis_object_components/world_axis_object_classes cache)
    are no longer included in the pickled state. They are
    regenerated on demand after unpickling, which keeps pickling
    robust even when a cache entry holds a non-picklable value.
    * Fixed a bug where the preserve_units option passed to the WCS
    constructor was silently reset to False when a WCS object was
    pickled and unpickled. [#19591]
    * Fix reference-count handling after PyList_SetItem steals
    references. [#19720]
    * Made the WCS coordinate transform paths (pixel_to_world,
    world_to_pixel, all_pix2world, wcs_pix2world, wcs_world2pix,
    mix) safe to call concurrently on a shared WCS instance from
    multiple threads. [#19819]
  - Drop upstreamed posix-c-source.patch
  - Pin wcslib to < 8.8: gh#astropy/astropy#19728

++++ python-azure-mgmt-managednetworkfabric:

  - New upstream release
    + Version 2.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Adjust upstream source name in spec file
  - Drop extra LICENSE.txt as upstream now ships its own
  - Remove unzip package from BuildRequires
  - Rename LICENSE.txt to LICENSE in %files section
  - Switch source archive format to TAR.GZ
  - Update Requires from pyproject.toml

++++ python-black:

  - Update to 26.5.1:
    Stable style:
    * Fix unstable formatting of annotated assignments whose subscript
    annotation contains an inline comment
    (e.g. x: list[  # pyright: ignore[...]) (#5130)
    * Preserve inline comments (including # type: ignore) immediately
    before a # fmt: skip line, avoiding AST equivalence failures
    (#5139)
    Packaging:
    * Correct the version in the published executables (#5137)
    Version 26.5.0
    Highlights:
    * Add support for unpacking in comprehensions (PEP 798) and for lazy
    imports (PEP 810), both new syntactic features in Python 3.15
    (#5048)
    * Python 3.15 is now supported. Compiled wheels are not yet provided
    for Python 3.15, so performance may be slower than on existing
    Python versions. Wheels will be provided once Python 3.15 is later
    in its release cycle. (#5127)
    Stable style:
    * Fix # fmt: skip being ignored in nested if expressions with
    parenthesized in clauses (#4903)
    * Add syntactic support for Python 3.15 (#5048)
    * Fix crash when an f-string follows a # fmt: off comment inside
    brackets (#5097)
    * Preserve multiline compound statement headers when # fmt: skip is
    placed on the colon line (#5117)
    Preview style:
    * Improve heuristics around whether blank lines should appear
    before, within and after groups of same-name decorated functions
    (such as @overload groups) in .pyi stub files (#5021)
    * Fix blank lines being removed between a function and a decorated
    class in .pyi stub files (#5092)
    * Prevent string merger from creating unsplittable long lines when a
    pragma comment (e.g. # type: ignore) follows the closing bracket
    (#5096)
    Output:
    * Improve parse error readability by showing multi-line output with
    an error pointer. (#5068)
    * Add SourceASTParseError to distinguish source parse failures from
    internal safety errors, improving error reporting when Black's
    lenient parser accepts input that ast.parse() rejects (#5080)
    Blackd:
    * Return HTTP 400 (Bad Request) for source parse failures instead of
    HTTP 500, keeping HTTP 500 only for genuine internal safety errors (#5080)
    Integrations:
    * Added documentation for doctest formatting tools and updated the
    integrations index to match (#4916)
    Documentation:
    * Use "Version X.Y.Z" headings in changelog for stable permalink
    anchors on ReadTheDocs (#5063)
    * Note in the editor integrations that the SublimeText sublack
    plugin is archived and unmaintained (#5082)

++++ python-consolekit:

  - Add upstream patch click-8.4.0.patch, to fix tests with click >=
    8.4.0: gh#domdfcoding/consolekit#133

++++ python-httpx2:

  - Use pytest-benchmark rather than pytest-codspeed.
  - Loosen pytest requirement.

++++ python-pytest-arraydiff:

  - Update to 0.7.0:
    * CI: adding workflow dispatch
    * MNT: Use hash for Action workflow versions and update if needed
    * MAINT: remove py37
    * CI: update macos version
    * MNT: drop deprecated License classifier, update related metadata
    (PEP 639)
    * Fix compatibility with pytest-run-parallel and add free-threaded CI jobs

++++ python-pytools:

  - Update to 2026.1.1:
    * Add graph utilities for tag propagation
    * Extensive type-annotation coverage across the codebase
    * Numerous dependency and tooling updates
  - Switch to the hatchling build backend
  - Add python-siphash24 as a new mandatory dependency
  - typing_extensions (>= 4.5) is now an unconditional dependency
  - numpy is now an optional dependency, expressed as a Recommends
    instead of a hard Requires

++++ python-scikit-build:

  - Add scikit-build-pr1180-warnsetuptools.patch
    gh#scikit-build/scikit-build#1180

++++ python-siphash24:

  - Initial package (version 1.8)

++++ python-slycot:

  - Update to 0.7.0
    * Switch build system to scikit-build-core.

++++ python-sunpy:

  - Delete old astropy cache before tests

++++ python-uv-dynamic-versioning:

  - Enable the testsuite.
  - Add missing BuildRequires on update-alternatives.

++++ python-w3lib:

  - Update to 2.4.1:
    * safe_url_string now preserves IPv6 brackets in the URL netloc
    * Dropped Python 3.9 support; added Python 3.14 support
    * Improved performance of headers_raw_to_dict and
    headers_dict_to_raw
    * Removed the functions deprecated in 2.0.0 (str_to_unicode,
    to_native_str, unicode_to_str)
    * Fixed running tests with newer Python 3.10/3.11 point releases
  - Switch to the hatchling build backend
  - Drop do-not-add-invalid-ipv6.patch: upstream's test version
    gating now correctly excludes the openSUSE interpreters, so the
    test suite passes without it

++++ qt6-creator:

  - Update to 20.0.0
    https://www.qt.io/blog/qt-creator-20-released

++++ rubygem-diff-lcs:

  - Regenerate spec file to drop update-alternatives dependency

++++ shim-leap:

  - Apply nx-shim, create non-nx shim boot entry:
    shim-16.1-lp156.7.1.aarch64.rpm
    shim-16.1-lp156.7.1.x86_64.rpm
    RPMs are coming from openSUSE secure-boot shim 15.6:
    https://build.opensuse.org/projects/openSUSE:Factory:secure-boot/packages/shim/repositories/15.6/binaries
  - Version: 16.1, "Aug 14 2025"
  - Include the bug fixes for bsc#1205588
  - Use nx shim as the default shim binary.
    Add Microsoft-signed nx-shim:
    Source40        shim-opensuse.nx.x86.efi
    Source41        shim-opensuse.nx.aarch64.efi
  - Use ms-signed nx shim when the version equals with the version of
    newly built shim
  - Version mismatch indicates development of a new shim.
  - Create non-nx shim boot entry as a fallback option
    Because we apply nx shim as the default shim binary in
    /boot/efi/EFI/opensuse/shim.efi
    /boot/efi/EFI/boot/bootx64.efi or bootaa64.efi
    In case that user got any problem when the machine boots with nx-shim,
    so we create a new boot entry for non-nx shim as a fallback option by
    efibootmgr.
  - Removed the override shim-install. Let's direct use the shim-install
    script from shim-16.1*.rpm.

++++ siril:

  - Update to 1.4.4:
    * Fixed SirilInterface.save_undo_state in headless mode: this
    method no longer raises an exception when Siril is run without
    a graphical interface
    * Fixed incorrect dimension constraint in sirilpy: setting
    FFit.data no longer fails due to an erroneous dimensions check
    * Fixed use-after-free crash on Python module install failure: a
    memory safety issue that could cause a crash when the Python
    module failed to install has been resolved
    * Fixed Windows named pipes (#1921): corrects named pipe issue
    specific to the Windows platform
    * Fixed ‘Keep all samples’ option in background extraction: the
    option now behaves as expected when generating background
    correction samples
    * Added None as a valid keyword value for BAYERPAT: Siril now
    correctly handles FITS files where the BAYERPAT keyword is
    explicitly set to None
    * Fixed file extension handling in Save As dialog (#1748): the
    dialog now correctly manages file extensions when saving under
    a new name
    * Fixed crash when loading certain Hubble images (#1932): a crash
    affecting specific archival HST FITS files has been resolved
    * Fixed individual frame reading in mixed-size FITS sequences
    (!1021): browsing through a .fitseq file containing frames of
    varying dimensions no longer produces incorrect results

++++ squid:

  - Update to 7.6:
    * HTTP/1.1: Transfer-Encoding:identity is now prohibited
    * Harden peerDigestSwapInMask against an invalid cache digest
    reply
    * Fix parsing of legacy url_rewrite_program responses
    * Fix handling of truncated legacy errorpage %codes
    * Honor reply_header_max_size for received FTP control responses
    * Improve parsing of certain FTP directory listing formats
    * Support the Nettle 4.0 md5_digest API
    * Reject excessively large FTP control replies
  - Drop old_nettle_compat.patch: it was only applied on
    suse_version < 1500 (EOL distros) and no longer applies to the
    current sources

++++ stress-ng:

  - Update to 0.21.03:
    * New stressors
    * acct - acct(2) system call exercising stressor
    * Notable bug fixes
    * core-setting: ensure global setting flag is set for global stressor name

++++ ubi_reader:

  - Update to version 0.8.14
    * fix: handle negative node read size in ubifs walk.
    * Fix master node error #126
    * feat: add support for zstd compressed inodes #131

++++ virtualbox:

  - User note: Transitioning between virtualbox 7.2.8-or-earlier and
    7.2.10-or-newer requires reloading kvm.ko to avoid a kernel panic.
    Alternatively, reboot the system.
  - Update to release 7.2.10
    * VMM: Fixed issue when CentOS 10 VM was not booting with to the
    message "Fatal glibc error: CPU does not support x86-64-v3".
    * Devices/EFI: Fixed booting issue when ARM VM had less than 1024
    MiB of RAM assigned.
    * Storage: Fixed issue when VIRTIO-SCSI device was not recognized
    as SSD device by guest system.
    * Network: Fixed issue in E1000 emulation code which triggered
    debug log creation.
    * Network: Fixed issue in E1000 emulation code which prevented
    OS/2 guest from booting.
    * Linux Host: Fixed issue when VMs could not be started due to
    kernel oops.
    * Linux Host and Guest: Fixed issue when kernel modules were
    failing to build with openSUSE 16.0 kernel.
    * Linux Host and Guest: Added initial support for kernel 7.1.
    * Linux Host and Guest: Added extra fixes for RHEL 9.8 kernel.
    * Linux Host and Guest: Added possibility to build source code
    using NASM instead of YASM as the assembler.
    * Linux Guest Additions: Added initial support for Extended Data
    Control Protocol for clipboard sharing with Plasma on Wayland
    guests.
    * Linux Guest Additions: Added extra fixes for preventing
    vboxvideo kernel module build with kernel version 7.0 and
    newer.
    * OS/2 Guest Additions: Fixed issue when Shared Folders automount
    and clipboard sharing stopped working.
  - Delete 0001-7.2-Backported-r173880-Linux-vboxdrv-Add-initial-sup.patch
    (obsolete),
    0001-7.2-Backported-r173857-Additions-Linux-vboxsf-Add-in.patch
    (merged)

++++ virtualbox-kmp:

  - User note: Transitioning between virtualbox 7.2.8-or-earlier and
    7.2.10-or-newer requires reloading kvm.ko to avoid a kernel panic.
    Alternatively, reboot the system.
  - Update to release 7.2.10
    * VMM: Fixed issue when CentOS 10 VM was not booting with to the
    message "Fatal glibc error: CPU does not support x86-64-v3".
    * Devices/EFI: Fixed booting issue when ARM VM had less than 1024
    MiB of RAM assigned.
    * Storage: Fixed issue when VIRTIO-SCSI device was not recognized
    as SSD device by guest system.
    * Network: Fixed issue in E1000 emulation code which triggered
    debug log creation.
    * Network: Fixed issue in E1000 emulation code which prevented
    OS/2 guest from booting.
    * Linux Host: Fixed issue when VMs could not be started due to
    kernel oops.
    * Linux Host and Guest: Fixed issue when kernel modules were
    failing to build with openSUSE 16.0 kernel.
    * Linux Host and Guest: Added initial support for kernel 7.1.
    * Linux Host and Guest: Added extra fixes for RHEL 9.8 kernel.
    * Linux Host and Guest: Added possibility to build source code
    using NASM instead of YASM as the assembler.
    * Linux Guest Additions: Added initial support for Extended Data
    Control Protocol for clipboard sharing with Plasma on Wayland
    guests.
    * Linux Guest Additions: Added extra fixes for preventing
    vboxvideo kernel module build with kernel version 7.0 and
    newer.
    * OS/2 Guest Additions: Fixed issue when Shared Folders automount
    and clipboard sharing stopped working.
  - Delete 0001-7.2-Backported-r173880-Linux-vboxdrv-Add-initial-sup.patch
    (obsolete),
    0001-7.2-Backported-r173857-Additions-Linux-vboxsf-Add-in.patch
    (merged)

++++ w_scan:

  - Update to 20210218 (upstream's final release):
    * Repackage of 20170107 with gcc-10 compile fixes only; no
    functional source changes
    * Upstream notes no newer versions are expected (development
    continues separately as w_scan_cpp)
  - Fetch the tarball from the Debian source mirror, as the
    original upstream site is no longer available

++++ xdg-desktop-portal:

  - Update to version 1.22.1:
    + Security fixes:
  - Fix a security issue which allows a malicious sandboxed
    applications to redirect drag-and-drop and copy-paste data to
    itself via a predictable key in FileTransfer.RetrieveFiles
    (GHSA-c5cf-79w8-pvfh)
  - Fix a security issue which allows a malicious sandboxed
    applications to gain arbitrary write access to nonexistent
    files outside of the sandbox via the "files" option in
    FileChooser.SaveFiles (GHSA-cm83-2936-gxjm)
  - Validate all App IDs in the Document Portal to prevent
    malicious applications from providing a well-crafted App ID
    which causes the parsing of arbitrary files on the host as
    Glib.KeyFiles
    + Enhancements: Disable PipeWire's realtime module to prevent
    deadlocks

++++ xdg-desktop-portal-devel-docs:

  - Update to version 1.22.1:
    + Security fixes:
  - Fix a security issue which allows a malicious sandboxed
    applications to redirect drag-and-drop and copy-paste data to
    itself via a predictable key in FileTransfer.RetrieveFiles
    (GHSA-c5cf-79w8-pvfh)
  - Fix a security issue which allows a malicious sandboxed
    applications to gain arbitrary write access to nonexistent
    files outside of the sandbox via the "files" option in
    FileChooser.SaveFiles (GHSA-cm83-2936-gxjm)
  - Validate all App IDs in the Document Portal to prevent
    malicious applications from providing a well-crafted App ID
    which causes the parsing of arbitrary files on the host as
    Glib.KeyFiles
    + Enhancements: Disable PipeWire's realtime module to prevent
    deadlocks

++++ xrdp:

  - Generate key/cert pair to enable ssl security layer by default
    + Add xrdp-ensure-cert.sh
    + Add xrdp-ensure-cert.patch

++++ you-get:

  - Use pyproject macros to build and install the module.
  - List directories under sitelib explicitly.

------------------------------------------------------------------
------------------  2026-6-16  -  Jun 16 2026  -------------------
------------------------------------------------------------------

++++ ART:

  - Update to 1.26.6 (no changelog).

++++ NetworkManager:

  - Drop initrd specific services, following debians workaround.

++++ agama:

  - Remove a TODO note that slipped into translatable CLI help
    (gh#agama-project/agama#3639).

++++ cacti:

  - Update to version 1.2.31+git0.1e8eaca2:
    * Prepare for 1.2.31 release
    * chore:Remove entry from CHANGELOG from PHP deprecation (#7207)
    * Fix: #6945 PHP 8.5 Deprecation Warning (#7205)
    * fix #7202 uninstalling plugins may leave orphan entries in tables (#7203)
    * fix 7199 - import color (#7201)
    * hardening(1.2.x): input validation, path containment, and auth boundary tightening (#7194)
    * security(hardening): cacti_form_action_label() and html_escape graph_list (1.2.x) (#7171)
    * fix(rrdcheck): RRA comparison and info-parse correctness (#7184)
    * fix(test): align OrderBySessionHardeningTest with shipped get_order_string (#7185)
    * fix(rrd): correctness fixes in graph rendering and rrdtool output handling (#7183)
    * fix(sanitize_uri): stop stripping URL-valid chars (+ ( ) |) from query strings (#7182)
    * fix(poller): coerce invalid SCRIPT/SCRIPT_PHP output to U in cmd.php (#7180)
    * security(hardening): escape SNMP trap notification arguments per-arg (#7179)
    * fix(security): anchor thumbnails filter and parameterize header-node query (#7176)

++++ cacti-spine:

  - cacti-spine1.2.31
    * issue#365: Removing Backtrace Support
    * issue#366: Failing to actually a poll device that returns "NoSuchObject"
    * issue#370: Errors experienced with very long OIDs
    * issue#373: Spine SNMPv3 SHA-512 auth doesn't work
    * issue#374: Error DES is no longer supported on this system
    * issue#383: Spine returns Segmentation fault
    * issue#384: ICMP Buffer overflows on Debian/Unbuntu related recvfrom() calls
    * issue: Clear up a few very minor leaks in spine
  - Removed cacti-spine-gcc15.patch. no longer needed.

++++ cgit:

  - Update to release 1.3.1
    * Allow link following to be disabled per-repo, so that this CPU
    intensive operation can be disabled on specific repos.
    * More gracefully error out if a bad grep pattern is passed.
    * Truncate cache slots before writing them, so that old cache
    contents are not mixed with new cache contents improperly.
    * Do not accept newlines in config items. This fixes an issue
    with `git-config` based configuration settings being able to
    inject cached global settings or per-repo settings for
    different repos, which might be crossing a privilege barrier.

++++ conky:

  - Enable BUILD_LUA_TEXT
  - Enable BUILD_INTEL_GPU=ON
  - Enable BUILD_LUA_CAIRO_XLIB for clarity
  - Disable the following flags that are reported as unused by cmake
    * BUILD_ARGB
    * BUILD_BMPX
    * BUILD_EVE
    * BUILD_WEATHER_METAR
    * BUILD_WEATHER_XOAP
  - Disable docs in places pandoc doesn't exist
  - Update to 1.24.0 (Combined Notes)
    * Upgrade Notes
    * conky_surface() is now the preferred Lua API for obtaining
    the current Cairo drawing surface. It works across graphical
    backends, including Wayland, and the older X11-specific
    Cairo surface API now emits deprecation warnings.
    * own_window_colour now carries background opacity through
    its alpha channel. The older own_window_argb_visual,
    own_window_argb_value, and own_window_transparent settings
    are deprecated but remain backward-compatible, aside from
    corrected opacity resolution behavior.
    * BUILD_ARGB was removed; ARGB support is treated as part
    of the X11 path.
    * BUILD_XINPUT was removed; XInput2 is now used directly for
    X11 mouse input, and the legacy non-XInput2 fallback was
    removed.
    * Lua and Graphical Output
    * Added conky_surface() for backend-neutral Cairo drawing
    from Lua, including Wayland support, and updated
    conky_window.width / conky_window.height from
    Wayland output (#2342).
    * Added conky_window.pixel_size.x, conky_window.pixel_size.y,
    and conky_window.scale for Lua scripts that need pixel-aware
    drawing (#2342).
    * Simplified window background alpha handling around
    own_window_colour and fixed several compositor and opacity
    edge cases (#2344).
    * Fixed stale window width and height updates (#2345).
    * Fixed graph gradient rendering (#2336).
    * Improved cairo/lua text rendering support.
    * Text Objects
    * Added sysfs-backed bar variables for Linux hardware
    monitoring: hwmonbar, i2cbar, and platformbar. These let
    configs render sensor values as bars without shelling out
    through execbar.
    * Added an optional width argument to hr and stippled_hr,
    allowing horizontal rules to be capped at a specific pixel
    width while preserving existing defaults.
    * X11 Mouse Input
    * Various Fixes
    * Reliability and Diagnostics
    * Replaced legacy stderr/debug macros with structured
    spdlog-based logging, runtime log levels, source locations,
    span context, and cleaner termination handling (#1899).
    * Improved parser error recovery so invalid variables can be
    rendered literally instead of crashing in more cases (#1899).
    * Security and Platform Fixes
    * Various Hardening and Security related fixes
    * Runtime Fixes
    * Aligned periodic updates to wall-clock second boundaries
    so ${time} output updates on time instead of drifting up
    to nearly a second late.
    * Fixed a crash when XDG_SESSION_TYPE is present but empty.
    * Fixed X11 mouse event propagation regressions that could
    duplicate clicks and scroll events on other windows.
    * Fixed a graph argument parsing edge case for leading -m /
    minheight values.

++++ dt:

  - Update to version 26:
    * Add I/O latency support to dt workloads
    * Fix writing files with random read percentages and
    variable file sizes
    * Fix creating subdirectories with a relative directory path
    * Add new workloads and help files (many dirs, hammer, sio)
  - Drop dt-manpage.patch: merged upstream (.tP -> .TP, issue #4)
  - Spec cleanup:
    * Use %make_build for the build step
    * Drop obsolete Group tag
    * Use %{version} consistently in the Source URL

++++ firefox-esr:

  - Firefox Extended Support Release 140.12.0 ESR
    * Fixed: Various security fixes.
  - Mozilla Firefox ESR 140.12.0
    https://www.mozilla.org/security/advisories/mfsa2026-58
    MFSA 2026-58 (boo#1268071)
    * CVE-2026-12289 (bmo#2023443)
    Privilege escalation in the Graphics: WebRender component
    * CVE-2026-12290 (bmo#2024852)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12291 (bmo#2036929)
    Use-after-free in the Networking: HTTP component
    * CVE-2026-12292 (bmo#2038465)
    Incorrect boundary conditions in the Web Audio component
    * CVE-2026-12294 (bmo#2039873)
    Sandbox escape in the DOM: Workers component
    * CVE-2026-12295 (bmo#2040160)
    Sandbox escape in the DOM: Navigation component
    * CVE-2026-12298 (bmo#2041981)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12296 (bmo#2040515)
    Sandbox escape in the Security: Process Sandboxing component
    * CVE-2026-12297 (bmo#2041610)
    Sandbox escape due to incorrect boundary conditions in the
    Networking component
    * CVE-2026-12299 (bmo#2043139)
    JIT miscompilation in the DOM: Core & HTML component
    * CVE-2026-12329 (bmo#2044738)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12302 (bmo#2034489)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12304 (bmo#2034944)
    Same-origin policy bypass in the Networking: Cookies
    component
    * CVE-2026-12305 (bmo#2037290)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12306 (bmo#2037323)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12307 (bmo#2038133)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12308 (bmo#2038302)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12309 (bmo#2038476)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12310 (bmo#2039707)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12311 (bmo#2040177)
    Information disclosure, sandbox escape in the Security:
    Process Sandboxing component
    * CVE-2026-12312 (bmo#2040383)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12313 (bmo#2040477)
    Information disclosure, sandbox escape in the Security:
    Process Sandboxing component
    * CVE-2026-12314 (bmo#2041856)
    Memory safety bug fixed in Firefox ESR 140.12
    * CVE-2026-12315 (bmo#2042058)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12330 (bmo#2029326)
    Incorrect boundary conditions in the Internationalization
    component
    * CVE-2026-12324 (bmo#2038444)
    Incorrect boundary conditions in the Graphics: CanvasWebGL
    component
    * CVE-2026-12325 (bmo#2039443)
    Denial-of-service in the Graphics: ImageLib component
    * CVE-2026-12327 (bmo#2011842, bmo#2023902, bmo#2025512,
    bmo#2027312, bmo#2029444, bmo#2036571, bmo#2036900,
    bmo#2036936, bmo#2037995, bmo#2038551, bmo#2040717,
    bmo#2042724)
    Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird
    ESR 140.12, Firefox 152 and Thunderbird 152
    * CVE-2026-12328 (bmo#2029402, bmo#2038477, bmo#2039726,
    bmo#2041373, bmo#2042268, bmo#2042451, bmo#2042782,
    bmo#2042858, bmo#2042929, bmo#2042965, bmo#2043213)
    Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR
    140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird
    152

++++ fontforge:

  - Add fontforge-fix-buffer-overflow-in-SCDefWidthVal.patch:
    Backport e5f110c9 from upstream, fix buffer overflow in
    SCDefWidthVal() function.
  - Add fontforge-fix-crash-in-LoadPluginMetadata.patch:
    Backport 763b8fc6 from upstream, fix crash in LoadPluginMetadata
    when distribution not found.
    * Don't DECREF borrowed reference from PyDict_GetItemString
    * Fix memory leak: DECREF globals and locals dictionaries
    * Handle Py_None return (not just NULL) when no distribution matches
    * Print original Python exception if present, then set formatted error
  - Add fontforge-fix-crash-in-LoadPluginMetadata-shim01-fbc4114e.patch:
    Backport fbc4114e from upstream, Use importlib in plugin manager.
    This is for support the following patch to fix LoadPluginMetadata
    crash.
  - Add fontforge-fix-memory-allocation-in-utf8toutf7-copy.patch:
    Backport a4533e93 from upstream, fix memory allocation in
    utf8toutf7_copy() function.
  - Add fontforge-fix-crashes-on-importing-dfontNFNT-fonts.patch:
    Backport cb443433e from upstream, fix crashes on importing
    Mac-style dfont/NFNT bitmap fonts with some legal (but unusual?)
    values.

++++ ghc-yesod:

  - Update yesod to version 1.6.2.3.
    [#]# 1.6.2.3
    * Support `yesod-core` 1.7
    [#]# 1.6.2.2
    * Set `base >= 4.11` for less CPP and imports [#1876](https://github.com/yesodweb/yesod/pull/1876)

++++ ghc-yesod-form:

  - Update yesod-form to version 1.7.9.3.
    [#]# 1.7.9.3
    * Support `yesod-core` 1.7

++++ ghc-yesod-persistent:

  - Update yesod-persistent to version 1.6.0.9.
    * Support `yesod-core` 1.7
  - Refresh "dont-depend-on-obsolete-persistent-template.patch" to
    avoid depending on the obsolete persistent-templates package.
  - Update yesod-static to version 1.6.1.3.
    * Support `yesod-core` 1.7
  - Apply "support-modern-crypton-versions.patch" to support building
    with crypton version 1.1.x.

++++ google-osconfig-agent:

  - Update to version 20260615.01
    * Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
    (bsc#1266171, CVE-2026-39827, CVE-2026-39834, CVE-2026-39828,
    CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833,
    CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598,
    CVE-2026-46595, CVE-2026-39835) (bsc#1266603, CVE-2026-39821)
  - from version 20260615.00
    * Add unit tests for ospatch_apt_upgrade.go (#938)

++++ goreleaser:

  - Remove unnecessary files: _scmsync.obsinfo build.specials.obscpio

++++ govulncheck-vulndb:

  - Update to version 0.0.20260616T235518 2026-06-16T23:55:18Z.
    Refs jsc#PED-11136
    Go CVE Numbering Authority IDs added or updated with aliases:
    * GO-2026-5041 CVE-2026-44981 GHSA-273h-gvwr-c3qj
    * GO-2026-5042 CVE-2026-47243 GHSA-2gv2-cffp-j227
    * GO-2026-5043 CVE-2026-30963 GHSA-2ww6-hf35-mfjm
    * GO-2026-5049 CVE-2026-47725 GHSA-273q-qgh5-wrj6
    * GO-2026-5054 CVE-2026-48113 GHSA-24fp-5v3p-rvpw
    * GO-2026-5055 CVE-2026-54094 GHSA-239w-m3h6-ch8v

++++ gparted:

  - Update license to GPL-2.0-or-later
    + Change was noticed during legaldb review
    + See https://gparted.org

++++ gpxsee:

  - Update to version 16.9
    * Added track waypoints display option.
    * Major GUI polishing on macOS.
    * Minor GUI polishing on other platforms.
    * GeoTIFF images on Windows now support JPEG compression like on
    Linux.

++++ gsasl:

  - Update to release 2.2.4
    * NTLM client (not enabled in openSUSE):
    Avoid use-of-unitialized-value inside libntlm

++++ vim:

  - Update apparmor.vim to latest version (from AppArmor 5.0.1)
  - several updates for highlighting file rules

++++ helmfile:

  - Update to version 1.5.4:
    * build(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by
    @dependabot[bot] in #2629
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.23 to 1.32.24 by @dependabot[bot] in #2627
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.103.2 to 1.103.3 by @dependabot[bot] in #2628
    * fix: Fix broken trackLogs functionality in Kubedog tracker by
    @ggillies in #2630
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.24 to 1.32.25 by @dependabot[bot] in #2632
    * Bump Helm support to 4.2.1 and 3.21.1 by @Copilot in #2635
    * build(deps): bump github.com/helmfile/vals from 0.44.0 to
    0.44.1 by @dependabot[bot] in #2637
    * build(deps): bump github.com/helmfile/chartify from 0.26.4 to
    0.26.5 by @dependabot[bot] in #2636
    * Add App.WithFileSystem by @toyamagu-2021 in #2638
    * fix: include release values in .Values for patch template
    rendering by @yxxhero in #2556
    * build(deps): bump helm-diff to v3.15.9 by @yxxhero in #2642
    * feat: add support for helm 4 --server-side upgrade flag by
    @yxxhero in #2641

++++ jsoncpp:

  - Update to 1.9.8:
    * Fix C++11 ABI breakage when compiled with C++17: restore
    the legacy const char*/const String& overloads that were
    dropped when JSONCPP_HAS_STRING_VIEW was defined
    * Fix CMake 4.0 compatibility in jsoncppConfig.cmake.in
    (minimum policy version raised to 3.5)
    * Prevent JSON_HAS_INT64 macro redefinition
    * Move to strict semantic versioning (qualifier removed from
    the version string); soversion stays 27
  - Fix baselibs.conf: libjsoncpp26 -> libjsoncpp27 to match the
    current library soname
  - Drop obsolete Group tags

++++ kiwi-templates-Minimal:

  - Enable KubeVirt-Cloud flavor for aarch64 as well

++++ ksh:

  - Fix overlapping memory copy in hist_word [bsc#1261689]
    new patch: ksh93-edit_strcpy.dif
  - Fix wrong unset of LC_ env variables [bsc#1239568]

++++ kubevirt1.8:

  - Install data under the versioned /usr/share/kube-virt-1.8/ path
    (matching the kubevirt-1.6 convention) so parallel KubeVirt
    minor versions do not collide on shared files.

++++ labwc:

  - Update to version 0.20.1:
    * Bug fix release:
    https://github.com/labwc/labwc/releases/tag/0.20.1
  - Update to version 0.20.0:
    * Release changelog:
    https://github.com/labwc/labwc/releases/tag/0.20.0
    * Noteworthy highlights *
    * Add support for HDR10 output
    * Implement menu accelerators (one-letter mnemonics to quickly
    select/exec items from the current menu)
    * Install labwc-session.target systemd user unit when the systemd
    dependency is available
    * Add action ToggleShowDesktop to hide/unhide windows
    * Add support for color-management-v1 and
    color-representation-manager-v1

++++ libdispatch:

  - Update to version 6.3.2 (swift-6.3.2-RELEASE), tracking the
    Swift 6.3.2 release; notable changes since 6.1.1:
    * Worker-thread names and basic thread prioritisation on Linux
    * 16 KB page alignment on 64-bit Android
    * Support for building libdispatch statically
    * Build-system updates: CMake minimum requirement bumped,
    cross-compilation support removed, FreeBSD/OpenBSD fixes
  - Drop silence-signedness-change-through-implicit-conversion-error.patch:
    merged upstream (PR #880)
  - Rebase soversion.patch for the restructured src CMakeLists

++++ libexe:

  - Drop no longer needed autoreconf call (system-libs.patch is gone)

++++ lsof:

  - update to 4.99.7:
    * lsof_free_result(): handle result == NULL by @neek78
    * [linux] Fix missing parenthesis in lstat error message format
    by @cuiweixie
    * Fix use-after-free in lsof_select_process_regex
    * Fix truncated fd numbers in -F field output
    * Add -J/-j options for JSON and JSON Lines output format.  -J
    outputs a JSON envelope with process and file information; -j
    outputs JSON Lines format where each line is a JSON object
    representing a file descriptor
    * Document non-UTF-8 encoding behavior in JSON output by @kurok
    * Follow autoconf conventions for --enable/--disable help
    output
    * Skip building liblsof when --disable-liblsof is given
    * [linux] Display connection state for UDP sockets with -T
    option
    * Add more information to the tutorial about debugging busy
    mounts
    * Fix case sensitivity in INSTALL commands by @AngelofVerdant
  - update to 4.99.6:
    * [linux] Treat NFS ESTALE fds as unlinked for +L selection by
    @x-lugoo
    * [solaris] Update dlsof.h for Solaris NFS rnode4.h issues by
    @nic-kulowiec
    * [doc] fix minor doc errors in 00README by @nic-kulowiec
    * Fix null pointer exception by @admardare-cyber
  - update to 4.99.5:
    * [linux] fix legacy linux kernel compatibility due to missing
    /proc/self/ns
    * [linux] fix potential null pointer deference, reported by
    @mono-trip

++++ libnvme:

  - Update to version 1.16.2:
    * tree: fix nvme_subsystem_scan_namespaces() return handling
    * fabrics: issue a warning on invalid traddr format (bsc#1248750)
    * fabrics: sanitize FC traddr (bsc#1248750)
    * nvme: expose tls mode in use (bsc#1259672)
    * fabrics: add helper to update tls and concat (bsc#1259672)
    * tree: avoid updating --tls in nvme_read_sysfs_tls() (bsc#1259672)
    * fabrics: add additional debug messages for --tls and --concat (bsc#1256043)
    * fabrics: add error if no dhchap-secret is specified with --concat (bsc#1256043)
    * fabrics: add error if --tls and --concat are invoked together (bsc#1256043)
    * fabrics: fix concat during nvme connect-all (bsc#1256043)
    * tree: Fix potential NULL pointer dereference in nvme_host_get_ids()

++++ python314-core:

  - Update to 3.14.6:
  - Security
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error. (bsc#1267974, CVE-2026-9669)
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report (bsc#1265268, CVE-2026-8328).
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter (bsc#1267821, CVE-2026-7774).
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in:
  - code compilation - _winapi.CreateProcess()
  - Now these places raise proper MemoryError errors.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of elements “xmp”, “iframe”, “noembed”, “noframes”,
    and “plaintext” is no longer escaped. The “plaintext”
    element no longer have the closing tag.
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-90949: Add
    SetBillionLaughsAttackProtectionActivationThreshold() and
    SetBillionLaughsAttackProtectionMaximumAmplification() to
    xmlparser objects to tune protections against billion
    laughs attacks. Patch by Bénédikt Tran.
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - Documentation
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Refreshed patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch
  - CVE-2024-6923-follow-up-EOL-email-headers.patch
  - CVE-2025-12781-b64decode-alt-chars.patch
  - CVE-2025-15366-imap-ctrl-chars.patch
  - gh139257-Support-docutils-0.22.patch
  - test_UDPLITE_support.patch

++++ python314-nogil-nogil-core:

  - Update to 3.14.6:
  - Security
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error. (bsc#1267974, CVE-2026-9669)
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report (bsc#1265268, CVE-2026-8328).
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter (bsc#1267821, CVE-2026-7774).
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in:
  - code compilation - _winapi.CreateProcess()
  - Now these places raise proper MemoryError errors.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of elements “xmp”, “iframe”, “noembed”, “noframes”,
    and “plaintext” is no longer escaped. The “plaintext”
    element no longer have the closing tag.
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-90949: Add
    SetBillionLaughsAttackProtectionActivationThreshold() and
    SetBillionLaughsAttackProtectionMaximumAmplification() to
    xmlparser objects to tune protections against billion
    laughs attacks. Patch by Bénédikt Tran.
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - Documentation
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Refreshed patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch
  - CVE-2024-6923-follow-up-EOL-email-headers.patch
  - CVE-2025-12781-b64decode-alt-chars.patch
  - CVE-2025-15366-imap-ctrl-chars.patch
  - gh139257-Support-docutils-0.22.patch
  - test_UDPLITE_support.patch

++++ python315-core:

  - Update to 3.15.0~b2
  - Security
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report. (bsc#1265268, CVE-2026-8328)
  - gh-149474: Fix the binary writer in profiling.sampling not
    firing the audit (PEP 578) when creating the output file.
    The writer and the reader now accept any path-like object.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter. (bsc#1267821, CVE-2026-7774)
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs. (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-150374: Fix double release of the import lock on lazy
    import reification errors.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-148587: sys.lazy_modules is now a set instead of a dict
    as initially spelled out in PEP 810.
  - gh-150042: Fix refleak in queue.SimpleQueue.put if memory
    allocation fails.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149807: Fix hash(frozendict): compute the hash of each
    (key, value) pair correctly. Patch by Victor Stinner.
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-149676: Fix frozendict | frozendict hash.
  - gh-148829: sentinel objects now support a repr= argument
    and their __module__ attribute is writable.
  - gh-149642: Allow imports inside exec() calls within
    functions under PYTHON_LAZY_IMPORTS=all.
  - gh-144957: Fix lazy from imports of module attributes
    provided by module-level __getattr__.
  - gh-149459: Fix a crash in the JIT optimizer when
    a specialized LOAD_SPECIAL guard deoptimized after
    inserting the synthetic NULL stack entry.
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150228: The new site.StartupState class lets callers
    batch-process PEP 829 startup configuration files across
    multiple site directories before any startup code runs,
    with public addsitedir(), addusersitepackages(),
    addsitepackages(), and process() methods. The signature of
    site.addsitedir() is unchanged from Python 3.14. The
    defer_processing_start_files argument and the
    process_startup_files() function added earlier in the 3.15
    cycle have been removed; use site.StartupState instead.
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149189: Revert the changes to pprint defaults. Patch by
    Hugo van Kemenade.
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-142349: Add lazy to the list of support topic by help().
  - gh-149819: Fix regression in site.addsitedir() where .pth
    files were no longer processed in Python subprocesses. This
    happened because site.main() seeded known_paths with
    entries inherited from the parent process, causing
    addsitedir to skip .pth processing.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149718: Coalesce consecutive identical stack frames in
    Tachyon, so aggregating collectors (pstats, collapsed,
    flamegraph, gecko) receive one collect. Improves sample
    rate 3x, error rate and missed rate drop by 70%. Patch by
    Maurycy Pawłowski-Wieroński.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-149504: Fix site.addsitedir() to allow re-entrant calls
    from within startup files. Previously, a .pth file
    containing an import line that called site.addsitedir() (or
    a .start entry point doing the same) could crash with
    RuntimeError: dictionary changed size during iteration
    during site initialization, breaking tools such as uv run
  - -with.
  - gh-149584: Fix excessive overhead in the Tachyon profiler
    when inspecting a remote process by avoiding repeated
    remote page-cache scans, batching predicted remote reads,
    and reusing cached profiler result objects. Patch by Pablo
    Galindo and Maurycy Pawłowski-Wieroński.
  - gh-139489: Add xml.is_valid_text() to xml.__all__.
  - gh-149614: Fix a regression that broke the ability to
    deepcopy argparse.ArgumentParser instances.
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149534: Fix merging of collections.defaultdict and
    frozendict.
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of comments, processing instructions and elements
    “xmp”, “iframe”, “noembed”, “noframes”, and “plaintext” is
    no longer escaped. The “plaintext” element no longer have
    the closing tag. Add support of empty attributes (with
    value None).
  - gh-149056: Fix json.load() not forwarding the array_hook
    argument to json.loads(). Patch by Thomas Kowalski.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-86533: The os.makedirs() function and
    pathlib.Path.mkdir() method now have a parent_mode
    parameter to specify the mode for intermediate directories
    when creating parent directories. This allows one to match
    the behavior from Python 3.6 and earlier for os.makedirs().
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-133998: Fix struct.error exception when creating a file
    with gzip.GzipFile or compressing data with gzip.compress()
    if the system time is outside the range 00:00:00 UTC,
    January 1, 1970 through 06:28:15 UTC, February 7, 2106, or
    explicitly passed mtime argument is outside the range 0 to
    2**32-1.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-121109: Fix tarfile performance issue when reading
    archives in streaming mode (e.g. r|*).
  - bpo-45509: Gzip headers are now checked for corrupted NAME,
    COMMENT and HCRC fields.
  - Tests
  - gh-150387: Fix hang in
    test.test_profiling.test_sampling_profiler.test_live_collector_ui.TestLiveModeErrors.test_run_failed_script_live
    on slow buildbots. The test now always queues a final
    q keystroke so the live TUI loop exits even when the
    profiler collects enough samples to enter the post-finished
    input loop.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - gh-148260: On Linux when Python is linked to the musl
    C library, use a thread stack size of at least 1 MiB
    instead of musl default which is 128 kiB. Patch by Victor
    Stinner.
  - Tools/Demos
  - gh-150258: Update the tooltip on the Tachyon flame graph to
    show both absolute and relative percentages.
  - C API
  - gh-149725: Add PySentinel_CheckExact() for exact sentinel
    type tests to accompany the existing PySentinel_Check().
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Update to 3.15.0~b1:
  - Security
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.5.6.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-148252: Fixed string table and sample record bounds
    checks in _remote_debugging when decoding certain .pyb
    inputs on 32-bit builds. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping. (bsc#1262654,
    CVE-2026-6019)
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098,
    CVE-2026-6100).
  - gh-148252: Fixed stack depth calculation in
    _remote_debugging when decoding certain .pyb inputs on
    32-bit builds. Issue originally identified and diagnosed by
    Tristan Madani (@TristanInSec on GitHub).
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts.
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-137586: Fix a PATH-injection vulnerability in webbrowser
    on macOS where osascript was invoked without an absolute
    path. The new MacOS class uses /usr/bin/open directly,
    eliminating the dependency on osascript entirely.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method.
    (bsc#1261969, CVE-2026-1502)
  - Core and Builtins
  - gh-148940: Revert the process size based deferral of
    garbage collection (gh-133464). The performance issue this
    change resolves is also fixed by gh-142562. This approach
    has the problem that process size as seen by the OS (e.g.
    the resident size or RSS) does not immediately decrease
    after cyclic garbage is freed since mimalloc defers
    returning memory of the OS. This change applies to the
    free-threaded GC only.
  - gh-149243: Check for recursion limits in
    CALL_ALLOC_AND_ENTER_INIT opcode.
  - gh-126910: Add support for unwinding JIT frames using GNU
    backtrace. Patch by Diego Russo and Pablo Galindo
  - gh-149171: Allow assignment to the __module__ attribute of
    typing.TypeAliasType instances.
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-149049: Fix stack underflow for BINARY_OP in tier 2.
  - gh-83065: Fix a deadlock that could occur when one thread
    is importing a submodule (for example import pkg.sub.mod)
    while another thread is importing one of its parent
    packages (for example import pkg.sub) and that parent’s
    __init__.py itself imports the submodule. The import system
    now acquires module locks in hierarchical
    (parent-before-child) order so the two threads serialise
    instead of raising _DeadlockError.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148850: Fix the memory sanitizer false positive in
    os.getrandom().
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148829: Add sentinel, implementing PEP 661. PEP by Tal
    Einat; patch by Jelle Zijlstra.
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-148766: The interpreter help (such as python --help) is
    now in color. Patch by Hugo van Kemenade.
  - gh-148571: Fix a crash in the JIT optimizer when
    specialized opcode families inherited incompatible recorded
    operand layouts.
  - gh-148653: Forbid marshalling recursive code objects, slice
    and frozendict objects which cannot be correctly
    unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.15 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-146462: Added PyTypeObject.tp_basicsize,
    PyTypeObject.tp_dictoffset, and
    PyHeapTypeObject.ht_cached_keys offsets to _Py_DebugOffsets
    to support version-independent read-only dict introspection
    tools.
  - gh-145239: Unary plus is now accepted in match literal
    patterns, mirroring the existing support for unary minus.
    Patch by Bartosz Sławecki.
  - gh-148515: Fix a bug in the JIT optimizer reading operands
    for uops with multiple caches.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148398: Fix a bug in the JIT optimizer where class
    attribute loads were not invalidated after type mutation.
  - gh-146527: Add a GCMonitor class with a get_gc_stats method
    to the _remote_debugging module to allow reading GC
    statistics from an external Python process without
    requiring the full RemoteUnwinder functionality. Patch by
    Sergey Miryanov and Pablo Galindo.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-115802: Improve JIT code generation on Linux AArch64 by
    reducing the indirect call to external symbols. Patch by
    Diego Russo.
  - gh-148189: Repaired undercount of bytes in type-specific
    free lists reported by sys._debugmallocstats(). For types
    that participate in cyclic garbage collection, it was
    missing two pointers used by GC.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-95004: The specializing interpreter now specializes for
    enum.Enum improving performance and scaling in
    free-threading. Patch by Kumar Aditya.
  - gh-149202: Enable frame pointers by default for
    GCC-compatible CPython builds, including
  - mno-omit-leaf-frame-pointer, -marm on 32-bit ARM, and/or
  - mbackchain on s390x platforms when the compiler supports
    them, so profilers and debuggers can unwind native
    interpreter frames more reliably. Users can pass
  - -without-frame-pointers to ./configure to opt out.
  - gh-148014: Accept a function name in -X presite command
    line option and PYTHON_PRESITE environment variable. Patch
    by Victor Stinner.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - gh-146306: Specialize float true division in the tier
    2 optimizer with inplace mutation for uniquely-referenced
    operands.
  - gh-142186: Global sys.monitoring events can now be turned
    on and disabled on a per code object basis. Returning
    DISABLE from a callback disables the event for the entire
    code object (for the current tool).
  - gh-126910: Add support for unwinding JIT frames using GDB.
    Patch by Diego Russo and Pablo Galindo.
  - gh-146031: The unstable API
    _PyInterpreterState_SetEvalFrameFunc has a companion
    function
    _PyInterpreterState_SetEvalFrameAllowSpecialization to
    specify if specialization should be allowed. When this
    option is set to 1 the specializer will turn Python ->
    Python calls into specialized opcodes which the replacement
    interpreter loop can choose to respect and perform inlined
    dispatch.
  - gh-145278: The encodings is now partially frozen, including
    the aliases and utf_8 submodules.
  - The linecache is now frozen.
  - gh-134584: Optimize and eliminate redundant ref-counting
    for MAKE_FUNCTION in the JIT.
  - gh-143886: Reorder function annotations so positional-only
    arguments are returned before other arguments. This fixes
    how functools.singledispatch() registers functions with
    positional-only arguments.
  - gh-98894: Restore function__entry and function__return
    DTrace/SystemTap probes that were broken since Python 3.11.
  - gh-116021: Support for creating instances of abstract AST
    nodes from the ast module is deprecated and scheduled for
    removal in Python 3.20. Patch by Brian Schubert.
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-137600: ast: The constructors of AST nodes now raise
    a TypeError when a required argument is omitted or when
    a keyword argument that does not map to a field on the AST
    node is passed. These cases had previously raised
    a DeprecationWarning since Python 3.13. Patch by Brian
    Schubert.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-135357: Add support for socket.SO_PASSRIGHTS on Linux.
  - gh-134690: Removed deprecated in PEP 626 since Python 3.12
    codeobject.co_lnotab from types.CodeType.
  - gh-100239: Specialize BINARY_OP for concatenation of lists
    and tuples, and propagate the result type through
    _BINARY_OP_EXTEND in the tier 2 optimizer so that follow-up
    type guards can be eliminated.
  - Library
  - gh-148823: Defer the import of _colorize in argparse until
    needed for coloring output.
  - gh-141560: Add an annotation_format parameter to
    inspect.getfullargspec().
  - gh-139489: Add the xml.is_valid_text() function, which
    allows to check whether a string can be used in the XML
    document.
  - gh-142389: Add backticks to stdlib argparse help to display
    in colour. Patch by Hugo van Kemenade.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-142389: Add backtick markup support in argparse option
    help text to highlight inline code when color output is
    enabled. Patch by Hugo van Kemenade.
  - gh-148675: Remove F and D formats from array and
    memoryview. Patch by Victor Stinner.
  - gh-149342: Fix _remote_debugging binary writing so that
    sampling a thread whose Python frame stack is empty (for
    example while it is in a C call or mid-syscall) no longer
    raises RuntimeError("Invalid stack encoding type"), and so
    that BinaryWriter.total_samples after finalize() or
    context-manager exit includes samples flushed from the RLE
    buffer. Patch by Maurycy Pawłowski-Wieroński.
  - gh-149010: The inspect module CLI now reports as much
    information as it has available for non-source modules when
  - -details is specified, and provides an error message
    rather than a traceback when --details is omitted. It also
    reports improved information when the given target location
    is not the target’s defining location and when the given
    target is a data value rather than a class or function
    definition.
  - gh-146609: Use argparse for colour help timeit CLI. Patch
    by Hugo van Kemenade.
  - gh-142389: Add backticks for colour to regrtest and pdb’s
    help description. Patch by Hugo van Kemenade.
  - gh-144384: Lazily import _colorize. Patch by Hugo van
    Kemenade.
  - gh-149321: Fix import cycles exposed by running standard
    library modules with -X lazy_imports=none.
  - gh-145378: Generate consistent colors for pdb commands in
    pdb REPL.
  - gh-149296: Add a dump subcommand to profiling.sampling that
    prints a single traceback-style snapshot of a running
    process’s Python stack, including per-thread status, source
    line highlighting, optional bytecode opcode names, and
    async-aware task reconstruction. Patch by Pablo Galindo.
  - gh-143231: A module attribute has been added to
    warnings.WarningMessage.
  - gh-148675: ctypes: Change the _type_ of c_float_complex,
    c_double_complex and c_longdouble_complex from F, D and
    G to Zf, Zd and Zg for compatibility with numpy. Patch by
    Victor Stinner.
  - gh-148675: The array.typecodes type changed from str to
    tuple to support type codes longer than 1 character (Zf and
    Zd). Patch by Victor Stinner.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-143231: unittest.TestCase.assertWarns() and
    unittest.TestCase.assertWarnsRegex() no longer swallow
    warnings that do not match the specified category or regex.
    Nested context managers are now supported.
  - gh-149214: Fix _remote_debugging misreading non-ASCII
    Unicode strings (Latin-1, BMP and non-BMP) from a remote
    process. Filenames and function names that contain
    non-ASCII characters are now reported correctly in stack
    traces, the sampling profiler, and asyncio task
    introspection.
  - gh-149189: pprint now uses modern defaults: indent=4 and
    width=88, and the default compact=False output is now
    formatted similar to pretty-printed json.dumps(), with
    opening parentheses and brackets followed by a newline and
    the contents indented by one level. The expand parameter,
    added in 3.15.0a8, has been removed; compact=False (the
    default) now produces the former expand=True layout. Patch
    by Hugo van Kemenade.
  - gh-149173: Fix inverted PYTHON_BASIC_REPL environment check
    in pdb._pyrepl_available.
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-149009: Validate that profiling.sampling binary profiles
    do not contain more unique (thread, interpreter) pairs than
    declared in the header. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-148292: ssl: Update ssl.SSLSocket and ssl.SSLObject for
    OpenSSL 4. The classes now remember if they get
    a ssl.SSLEOFError. In this case, following read(),
    sendfile(), write(), and do_handshake() calls raise
    ssl.SSLEOFError without calling the underlying OpenSSL
    function. Thanks to that, ssl.SSLSocket behaves the same on
    all OpenSSL versions on EOF. Patch by Victor Stinner.
  - gh-149085: Add a max_threads keyword argument to
    faulthandler.dump_traceback(),
    faulthandler.dump_traceback_later(), faulthandler.enable(),
    and faulthandler.register().
  - gh-148641: pkgutil.resolve_name() gets a new optional,
    keyword-only argument called strict. The default is False
    for backward compatibility.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-149083: dataclasses.MISSING and dataclasses.KW_ONLY are
    now instances of sentinel.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-149026: Add colour to pickletools CLI output. Patch by
    Hugo van Kemenade.
  - gh-148991: Add colour to tokenize CLI output. Patch by Hugo
    van Kemenade.
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148981: Add color parameter to ast.dump().
  - gh-148849: Deprecate http.cookies.Morsel.js_output() and
    http.cookies.BaseCookie.js_output(), which will be removed
    in Python 3.19. Use http.cookies.Morsel.output() or
    http.cookies.BaseCookie.output() instead.
  - gh-146311: Add a canonical keyword-only parameter to the
    base16, base32, base64, base85, ascii85, and Z85 decoders
    in base64 and binascii. When true, encodings with non-zero
    padding bits (base16/32/64) or non-canonical encodings
    (base85/ascii85) are rejected. Single-character final
    groups in binascii.a2b_ascii85() and binascii.a2b_base85()
    are now always rejected as encoding violations, regardless
    of canonical; previously they were silently ignored and
    produced no output bytes.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-124397: The threading module added tooling to support
    concurrent iterator access: threading.serialize_iterator,
    threading.synchronized_iterator(), and
    threading.concurrent_tee().
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148688: bz2, compression.zstd, lzma, zlib: Fix a double
    free on memory allocation failure. Patch by Victor Stinner.
  - gh-148675: array, struct: Add support for Zd and Zf formats
    for double complex and float complex. Patch by Victor
    Stinner.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-148641: PEP 829 (package startup configuration files)
    implements a new format <name>.start parallel to <name>.pth
    files, to replace import lines in the latter.
  - gh-148639: Implement PEP 800, adding the
    @typing.disjoint_base decorator. Patch by Jelle Zijlstra.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148599: Update the socket module’s WSA error messages to
    match official documentation.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-144881: asyncio debugging tools (python -m asyncio ps
    and pstree) now retry automatically on transient errors
    that can occur when attaching to a process under active
    thread delegation. The number of retries can be controlled
    with the --retries flag. Patch by Bartosz Sławecki.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-121190: importlib.resources.files() now emits a more
    meaningful error message when module spec is None (as found
    in some __main__ modules).
  - gh-127012: importlib.abc.Traversable.read_text now
    allows/solicits an errors parameter.
  - gh-137855: Improve import time of dataclasses module by
    lazy importing re and copy modules.
  - gh-148352: Add more color to calendar’s CLI output. Patch
    by Hugo van Kemenade.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-130472: Integrate fancycompleter with import
    completions.
  - gh-148241: json: Fix serialization: no longer call str(obj)
    on str subclasses. Patch by Victor Stinner.
  - gh-148225: The profiling.sampling replay command now
    rejects non-binary profile files with a clear error
    explaining that replay only accepts files created with
  - -binary.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-148207: typing.TypeVarTuple now accepts bound,
    covariant, contravariant, and infer_variance parameters,
    matching the interface of typing.TypeVar and
    typing.ParamSpec.
  - gh-148100: Soft deprecate re.match() and re.Pattern.match()
    in favour of re.prefixmatch() and re.Pattern.prefixmatch().
    Patch by Hugo van Kemenade.
  - gh-147991: Improve tomllib import time (up to 10x faster).
    Patch by Victor Stinner.
  - gh-147957: Guarantees that collections.UserDict.popitem()
    will pop in the same order as the wrapped dictionary rather
    than an arbitrary order.
  - gh-146256: The profiling.sampling module now supports JSONL
    output format via --jsonl. Each run emits
    a newline-delimited JSON file that is sequentially
    parseable by external tools, scripts, and programmatic
    consumers. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146609: Add colour to timeit CLI output. Patch by Hugo
    van Kemenade.
  - gh-146563: xml.parsers.expat: add an exception note when
    a custom Expat handler return value cannot be properly
    interpreted. Patch by Bénédikt Tran.
  - gh-137586: Add MacOS to webbrowser for macOS, which opens
    URLs via /usr/bin/open instead of piping AppleScript to
    osascript. Deprecate MacOSXOSAScript in favour of MacOS.
  - gh-146406: Cross-language method suggestions are now shown
    for AttributeError on builtin types and their subclasses.
    For example, [].push() suggests append, (1,2).append(3)
    suggests using a list, None.keys() suggests expecting
    a dict, and 1.0.__or__ suggests using an int.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-146292: Add colour to BaseHTTPRequestHandler logs, as
    used by the http.server CLI. Patch by Hugo van Kemenade.
  - gh-145917: Add MIME types for TTC and Haptics formats to
    mimetypes. (Contributed by Charlie Lin in gh-145918.)
  - gh-145846: Fix memory leak in _lsprof when clear() is
    called during active profiling with nested calls.
    clearEntries() now walks the entire currentProfilerContext
    linked list instead of only freeing the top context.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145378: Use PyREPL as the default input console for pdb
  - gh-145244: Fixed a use-after-free in json encoder when
    a default callback mutates the dictionary being serialized.
  - gh-117716: Fix wave writing of odd-sized data chunks by
    appending the required RIFF pad byte and correcting the
    RIFF chunk size field accordingly.
  - gh-145200: hashlib: fix a memory leak when allocating or
    initializing an OpenSSL HMAC context fails.
  - gh-145056: Add support for frozendict in
    dataclasses.asdict() and dataclasses.astuple().
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-137855: Reduce the import time of dataclasses module by
    ~20%.
  - gh-70647: strptime() now raises ValueError when the format
    string contains %d without a year directive. Using %e
    without a year now emits a DeprecationWarning.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-108411: typing.IO and typing.BinaryIO method arguments
    are now positional-only.
  - gh-130273: Fix traceback color output with Unicode
    characters.
  - gh-142307: imaplib: deprecate support for IMAP4.file. This
    attribute was never meant to be part of the public
    interface and altering its value may result in unclosed
    files or other synchronization issues with the underlying
    socket. Patch by Bénédikt Tran.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-139489: Add the xml.is_valid_name() function, which
    allows to check whether a string can be used as an element
    or attribute name in XML.
  - gh-75707: Add optional mtime argument to tarfile.open(),
    for setting the mtime header field in .tar.gz archives.
  - gh-125862: The contextlib.contextmanager() and
    contextlib.asynccontextmanager() decorators now work
    correctly with generators, coroutine functions, and async
    generators when the wrapped callables are used as
    decorators.
  - gh-135528: http.cookiejar: add “tv”, “or”, “nom”, “sch”,
    and “web” to the default list of supported country code
    second-level domains.
  - gh-135056: Add a -H or --header CLI option to python -m
    http.server. Contributed by Anton I. Sipos.
  - gh-134551: Add t-strings support to pprint functions
  - gh-133956: Fix bug where @dataclass wouldn’t detect
    ClassVar fields if ClassVar was re-exported from a module
    other than typing.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-108951: asyncio: Add TaskGroup.cancel which cancels
    unfinished tasks and exits the group without raising
    asyncio.CancelledError.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-122476: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its local-part. Under a policy with utf8 set False,
    attempting to serialize such a message will now raise an
    HeaderWriteError. There is no valid 7-bit encoding for an
    internationalized local-part. Use email.policy.SMTPUTF8 (or
    another policy with utf8=True) to correctly pass through
    the local-part as Unicode characters.
  - gh-83938: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its domain. Under a policy with utf8 set False, attempting
    to serialize such a message will now raise an
    HeaderWriteError. Either apply an appropriate IDNA encoding
    to convert the domain to ASCII before serialization, or use
    email.policy.SMTPUTF8 (or another policy with utf8=True) to
    correctly pass through the internationalized domain name as
    Unicode characters.
  - gh-81074: The email module no longer treats email addresses
    with non-ASCII characters as defects when parsing a Unicode
    string or in the addr_spec parameter to
    email.headerregistry.Address. RFC 5322 permits such
    addresses, and they were already supported when parsing
    bytes and in the Address username parameter.
  - The (undocumented) email.errors.NonASCIILocalPartDefect is
    no longer used and should be considered deprecated.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-113471: Allow http.server to set a default content-type
    when serving files with an unknown or missing extension.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - gh-96894: Do not turn echo off for subsequent commands in
    batch activators (activate.bat and deactivate.bat) of venv.
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Tests
  - gh-149425: Increase time delta in
    test.test_zipfile.test_core.OtherTests.test_write_without_source_date_epoch
  - gh-148600: Add OpenSSL 4.0.0 support to test
    configurations.
  - Build
  - gh-149353: Avoid unnecessary JIT-related rebuilds during
    make install after --enable-optimizations builds.
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-149252: Update to WASI SDK 33.
  - gh-148690: Windows free-threaded builds now output to
    a different default path with default filenames, for
    example, PCbuild/amd64t/python.exe rather than
    PCbuild/amd64/python3.15t.exe. The PC/layout script has
    been updated to ensure compatibility of generated layouts.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148644: Errors during the PGO training job on Windows
    are no longer ignored, and a non-zero return code will
    cause the build to fail.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-148483: Use Py_GCC_ATTRIBUTE(unused) for stop_tracing
    label.
  - gh-148474: Fixed compilation of Python/pystrhex.c with
    older clang versions.
  - gh-146445: The Android build tools have been moved to the
    Platforms folder.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - gh-138451: Allow for custom LLVM path using
    LLVM_TOOLS_INSTALL_DIR during JIT build.
  - gh-133312: Add a new ./configure option
  - -enable-static-libpython-for-interpreter which, when used
    with --enable-shared, continues to build the shared library
    but does not use it for the interpreter. Instead, libpython
    is statically linked into the interpreter, as if
  - -enable-shared had not been used. This allows you to do
    a single build and get a Python interpreter binary that
    does not use a shared library but also get a shared library
    for use by other programs.
  - Windows
  - gh-149254: Updated bundled version of OpenSSL to 3.5.6.
  - gh-148690: Non-freethreaded builds on Windows now support
    extensions linked to python3t.dll, and will include a copy
    of that library in normal installs that references the
    non-freethreaded runtime.
  - gh-146458: Fix incorrect REPL height and width tracking on
    console window resize on Windows. macOS
  - gh-142295: For Python macOS framework builds, update
    Info.plist files to be more compliant with current Apple
    guidelines. Original patch contributed by Martinus Verburg.
  - gh-149254: Update macOS installer to use OpenSSL 3.5.6.
  - IDLE
  - gh-94523: Detect file if modified at local disk and prompt
    to ask refresh. Patch by Shixian Li.
  - gh-139551: Support rendering BaseExceptionGroup in IDLE.
  - gh-89520: Make IDLE extension configuration look at user
    config files, allowing user-installed extensions to have
    settings and key bindings defined in ~/.idlerc.
  - C API
  - gh-149225: PyCriticalSection and related functions are
    added to the Stable ABI.
  - gh-149216: PyType_WatchCallback callbacks registered via
    PyType_AddWatcher() are now also invoked when a watched
    heap type is deallocated. Previously, type watchers were
    only notified of modifications, which could cause stale
    references when a type was freed and its address was
    reused.
  - gh-149101: Implement PEP 788.
  - gh-149044: Implement PEP 820: Unified slot system for the
    C API.
  - gh-148267: Using Py_LIMITED_API on a non-Windows
    free-threaded build no longer needs an extra
    Py_GIL_DISABLED.
  - gh-145559: Rename _Py_DumpTraceback and
    _Py_DumpTracebackThreads to PyUnstable_DumpTraceback() and
    PyUnstable_DumpTracebackThreads().
  - gh-146636: Implement PEP 803 – abi3t: Stable ABI for
    Free-Threaded Builds.
  - gh-146302: Py_IsInitialized() no longer returns true until
    initialization has fully completed, including import of the
    site module. The underlying runtime flags now use atomic
    operations.
  - gh-146063: Add PyObject_CallFinalizerFromDealloc() function
    to the limited C API. Patch by Victor Stinner.
  - gh-145921: Add functions that are guaranteed to be safe for
    use in tp_traverse handlers:
    PyObject_GetTypeData_DuringGC(),
    PyObject_GetItemData_DuringGC(),
    PyType_GetModuleState_DuringGC(),
    PyModule_GetState_DuringGC(), PyModule_GetToken_DuringGC(),
    PyType_GetBaseByToken_DuringGC(),
    PyType_GetModule_DuringGC(),
    PyType_GetModuleByToken_DuringGC().
  - Remove upstreamed patches:
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-6100-use-after-free-decompression.patch
  - For &ix86 we build `--without-frame-pointers`

++++ python315-nogil-nogil-core:

  - Update to 3.15.0~b2
  - Security
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report. (bsc#1265268, CVE-2026-8328)
  - gh-149474: Fix the binary writer in profiling.sampling not
    firing the audit (PEP 578) when creating the output file.
    The writer and the reader now accept any path-like object.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter. (bsc#1267821, CVE-2026-7774)
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs. (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-150374: Fix double release of the import lock on lazy
    import reification errors.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-148587: sys.lazy_modules is now a set instead of a dict
    as initially spelled out in PEP 810.
  - gh-150042: Fix refleak in queue.SimpleQueue.put if memory
    allocation fails.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149807: Fix hash(frozendict): compute the hash of each
    (key, value) pair correctly. Patch by Victor Stinner.
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-149676: Fix frozendict | frozendict hash.
  - gh-148829: sentinel objects now support a repr= argument
    and their __module__ attribute is writable.
  - gh-149642: Allow imports inside exec() calls within
    functions under PYTHON_LAZY_IMPORTS=all.
  - gh-144957: Fix lazy from imports of module attributes
    provided by module-level __getattr__.
  - gh-149459: Fix a crash in the JIT optimizer when
    a specialized LOAD_SPECIAL guard deoptimized after
    inserting the synthetic NULL stack entry.
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150228: The new site.StartupState class lets callers
    batch-process PEP 829 startup configuration files across
    multiple site directories before any startup code runs,
    with public addsitedir(), addusersitepackages(),
    addsitepackages(), and process() methods. The signature of
    site.addsitedir() is unchanged from Python 3.14. The
    defer_processing_start_files argument and the
    process_startup_files() function added earlier in the 3.15
    cycle have been removed; use site.StartupState instead.
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149189: Revert the changes to pprint defaults. Patch by
    Hugo van Kemenade.
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-142349: Add lazy to the list of support topic by help().
  - gh-149819: Fix regression in site.addsitedir() where .pth
    files were no longer processed in Python subprocesses. This
    happened because site.main() seeded known_paths with
    entries inherited from the parent process, causing
    addsitedir to skip .pth processing.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149718: Coalesce consecutive identical stack frames in
    Tachyon, so aggregating collectors (pstats, collapsed,
    flamegraph, gecko) receive one collect. Improves sample
    rate 3x, error rate and missed rate drop by 70%. Patch by
    Maurycy Pawłowski-Wieroński.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-149504: Fix site.addsitedir() to allow re-entrant calls
    from within startup files. Previously, a .pth file
    containing an import line that called site.addsitedir() (or
    a .start entry point doing the same) could crash with
    RuntimeError: dictionary changed size during iteration
    during site initialization, breaking tools such as uv run
  - -with.
  - gh-149584: Fix excessive overhead in the Tachyon profiler
    when inspecting a remote process by avoiding repeated
    remote page-cache scans, batching predicted remote reads,
    and reusing cached profiler result objects. Patch by Pablo
    Galindo and Maurycy Pawłowski-Wieroński.
  - gh-139489: Add xml.is_valid_text() to xml.__all__.
  - gh-149614: Fix a regression that broke the ability to
    deepcopy argparse.ArgumentParser instances.
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149534: Fix merging of collections.defaultdict and
    frozendict.
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of comments, processing instructions and elements
    “xmp”, “iframe”, “noembed”, “noframes”, and “plaintext” is
    no longer escaped. The “plaintext” element no longer have
    the closing tag. Add support of empty attributes (with
    value None).
  - gh-149056: Fix json.load() not forwarding the array_hook
    argument to json.loads(). Patch by Thomas Kowalski.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-86533: The os.makedirs() function and
    pathlib.Path.mkdir() method now have a parent_mode
    parameter to specify the mode for intermediate directories
    when creating parent directories. This allows one to match
    the behavior from Python 3.6 and earlier for os.makedirs().
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-133998: Fix struct.error exception when creating a file
    with gzip.GzipFile or compressing data with gzip.compress()
    if the system time is outside the range 00:00:00 UTC,
    January 1, 1970 through 06:28:15 UTC, February 7, 2106, or
    explicitly passed mtime argument is outside the range 0 to
    2**32-1.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-121109: Fix tarfile performance issue when reading
    archives in streaming mode (e.g. r|*).
  - bpo-45509: Gzip headers are now checked for corrupted NAME,
    COMMENT and HCRC fields.
  - Tests
  - gh-150387: Fix hang in
    test.test_profiling.test_sampling_profiler.test_live_collector_ui.TestLiveModeErrors.test_run_failed_script_live
    on slow buildbots. The test now always queues a final
    q keystroke so the live TUI loop exits even when the
    profiler collects enough samples to enter the post-finished
    input loop.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - gh-148260: On Linux when Python is linked to the musl
    C library, use a thread stack size of at least 1 MiB
    instead of musl default which is 128 kiB. Patch by Victor
    Stinner.
  - Tools/Demos
  - gh-150258: Update the tooltip on the Tachyon flame graph to
    show both absolute and relative percentages.
  - C API
  - gh-149725: Add PySentinel_CheckExact() for exact sentinel
    type tests to accompany the existing PySentinel_Check().
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Update to 3.15.0~b1:
  - Security
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.5.6.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-148252: Fixed string table and sample record bounds
    checks in _remote_debugging when decoding certain .pyb
    inputs on 32-bit builds. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping. (bsc#1262654,
    CVE-2026-6019)
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098,
    CVE-2026-6100).
  - gh-148252: Fixed stack depth calculation in
    _remote_debugging when decoding certain .pyb inputs on
    32-bit builds. Issue originally identified and diagnosed by
    Tristan Madani (@TristanInSec on GitHub).
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts.
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-137586: Fix a PATH-injection vulnerability in webbrowser
    on macOS where osascript was invoked without an absolute
    path. The new MacOS class uses /usr/bin/open directly,
    eliminating the dependency on osascript entirely.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method.
    (bsc#1261969, CVE-2026-1502)
  - Core and Builtins
  - gh-148940: Revert the process size based deferral of
    garbage collection (gh-133464). The performance issue this
    change resolves is also fixed by gh-142562. This approach
    has the problem that process size as seen by the OS (e.g.
    the resident size or RSS) does not immediately decrease
    after cyclic garbage is freed since mimalloc defers
    returning memory of the OS. This change applies to the
    free-threaded GC only.
  - gh-149243: Check for recursion limits in
    CALL_ALLOC_AND_ENTER_INIT opcode.
  - gh-126910: Add support for unwinding JIT frames using GNU
    backtrace. Patch by Diego Russo and Pablo Galindo
  - gh-149171: Allow assignment to the __module__ attribute of
    typing.TypeAliasType instances.
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-149049: Fix stack underflow for BINARY_OP in tier 2.
  - gh-83065: Fix a deadlock that could occur when one thread
    is importing a submodule (for example import pkg.sub.mod)
    while another thread is importing one of its parent
    packages (for example import pkg.sub) and that parent’s
    __init__.py itself imports the submodule. The import system
    now acquires module locks in hierarchical
    (parent-before-child) order so the two threads serialise
    instead of raising _DeadlockError.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148850: Fix the memory sanitizer false positive in
    os.getrandom().
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148829: Add sentinel, implementing PEP 661. PEP by Tal
    Einat; patch by Jelle Zijlstra.
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-148766: The interpreter help (such as python --help) is
    now in color. Patch by Hugo van Kemenade.
  - gh-148571: Fix a crash in the JIT optimizer when
    specialized opcode families inherited incompatible recorded
    operand layouts.
  - gh-148653: Forbid marshalling recursive code objects, slice
    and frozendict objects which cannot be correctly
    unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.15 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-146462: Added PyTypeObject.tp_basicsize,
    PyTypeObject.tp_dictoffset, and
    PyHeapTypeObject.ht_cached_keys offsets to _Py_DebugOffsets
    to support version-independent read-only dict introspection
    tools.
  - gh-145239: Unary plus is now accepted in match literal
    patterns, mirroring the existing support for unary minus.
    Patch by Bartosz Sławecki.
  - gh-148515: Fix a bug in the JIT optimizer reading operands
    for uops with multiple caches.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148398: Fix a bug in the JIT optimizer where class
    attribute loads were not invalidated after type mutation.
  - gh-146527: Add a GCMonitor class with a get_gc_stats method
    to the _remote_debugging module to allow reading GC
    statistics from an external Python process without
    requiring the full RemoteUnwinder functionality. Patch by
    Sergey Miryanov and Pablo Galindo.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-115802: Improve JIT code generation on Linux AArch64 by
    reducing the indirect call to external symbols. Patch by
    Diego Russo.
  - gh-148189: Repaired undercount of bytes in type-specific
    free lists reported by sys._debugmallocstats(). For types
    that participate in cyclic garbage collection, it was
    missing two pointers used by GC.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-95004: The specializing interpreter now specializes for
    enum.Enum improving performance and scaling in
    free-threading. Patch by Kumar Aditya.
  - gh-149202: Enable frame pointers by default for
    GCC-compatible CPython builds, including
  - mno-omit-leaf-frame-pointer, -marm on 32-bit ARM, and/or
  - mbackchain on s390x platforms when the compiler supports
    them, so profilers and debuggers can unwind native
    interpreter frames more reliably. Users can pass
  - -without-frame-pointers to ./configure to opt out.
  - gh-148014: Accept a function name in -X presite command
    line option and PYTHON_PRESITE environment variable. Patch
    by Victor Stinner.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - gh-146306: Specialize float true division in the tier
    2 optimizer with inplace mutation for uniquely-referenced
    operands.
  - gh-142186: Global sys.monitoring events can now be turned
    on and disabled on a per code object basis. Returning
    DISABLE from a callback disables the event for the entire
    code object (for the current tool).
  - gh-126910: Add support for unwinding JIT frames using GDB.
    Patch by Diego Russo and Pablo Galindo.
  - gh-146031: The unstable API
    _PyInterpreterState_SetEvalFrameFunc has a companion
    function
    _PyInterpreterState_SetEvalFrameAllowSpecialization to
    specify if specialization should be allowed. When this
    option is set to 1 the specializer will turn Python ->
    Python calls into specialized opcodes which the replacement
    interpreter loop can choose to respect and perform inlined
    dispatch.
  - gh-145278: The encodings is now partially frozen, including
    the aliases and utf_8 submodules.
  - The linecache is now frozen.
  - gh-134584: Optimize and eliminate redundant ref-counting
    for MAKE_FUNCTION in the JIT.
  - gh-143886: Reorder function annotations so positional-only
    arguments are returned before other arguments. This fixes
    how functools.singledispatch() registers functions with
    positional-only arguments.
  - gh-98894: Restore function__entry and function__return
    DTrace/SystemTap probes that were broken since Python 3.11.
  - gh-116021: Support for creating instances of abstract AST
    nodes from the ast module is deprecated and scheduled for
    removal in Python 3.20. Patch by Brian Schubert.
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-137600: ast: The constructors of AST nodes now raise
    a TypeError when a required argument is omitted or when
    a keyword argument that does not map to a field on the AST
    node is passed. These cases had previously raised
    a DeprecationWarning since Python 3.13. Patch by Brian
    Schubert.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-135357: Add support for socket.SO_PASSRIGHTS on Linux.
  - gh-134690: Removed deprecated in PEP 626 since Python 3.12
    codeobject.co_lnotab from types.CodeType.
  - gh-100239: Specialize BINARY_OP for concatenation of lists
    and tuples, and propagate the result type through
    _BINARY_OP_EXTEND in the tier 2 optimizer so that follow-up
    type guards can be eliminated.
  - Library
  - gh-148823: Defer the import of _colorize in argparse until
    needed for coloring output.
  - gh-141560: Add an annotation_format parameter to
    inspect.getfullargspec().
  - gh-139489: Add the xml.is_valid_text() function, which
    allows to check whether a string can be used in the XML
    document.
  - gh-142389: Add backticks to stdlib argparse help to display
    in colour. Patch by Hugo van Kemenade.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-142389: Add backtick markup support in argparse option
    help text to highlight inline code when color output is
    enabled. Patch by Hugo van Kemenade.
  - gh-148675: Remove F and D formats from array and
    memoryview. Patch by Victor Stinner.
  - gh-149342: Fix _remote_debugging binary writing so that
    sampling a thread whose Python frame stack is empty (for
    example while it is in a C call or mid-syscall) no longer
    raises RuntimeError("Invalid stack encoding type"), and so
    that BinaryWriter.total_samples after finalize() or
    context-manager exit includes samples flushed from the RLE
    buffer. Patch by Maurycy Pawłowski-Wieroński.
  - gh-149010: The inspect module CLI now reports as much
    information as it has available for non-source modules when
  - -details is specified, and provides an error message
    rather than a traceback when --details is omitted. It also
    reports improved information when the given target location
    is not the target’s defining location and when the given
    target is a data value rather than a class or function
    definition.
  - gh-146609: Use argparse for colour help timeit CLI. Patch
    by Hugo van Kemenade.
  - gh-142389: Add backticks for colour to regrtest and pdb’s
    help description. Patch by Hugo van Kemenade.
  - gh-144384: Lazily import _colorize. Patch by Hugo van
    Kemenade.
  - gh-149321: Fix import cycles exposed by running standard
    library modules with -X lazy_imports=none.
  - gh-145378: Generate consistent colors for pdb commands in
    pdb REPL.
  - gh-149296: Add a dump subcommand to profiling.sampling that
    prints a single traceback-style snapshot of a running
    process’s Python stack, including per-thread status, source
    line highlighting, optional bytecode opcode names, and
    async-aware task reconstruction. Patch by Pablo Galindo.
  - gh-143231: A module attribute has been added to
    warnings.WarningMessage.
  - gh-148675: ctypes: Change the _type_ of c_float_complex,
    c_double_complex and c_longdouble_complex from F, D and
    G to Zf, Zd and Zg for compatibility with numpy. Patch by
    Victor Stinner.
  - gh-148675: The array.typecodes type changed from str to
    tuple to support type codes longer than 1 character (Zf and
    Zd). Patch by Victor Stinner.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-143231: unittest.TestCase.assertWarns() and
    unittest.TestCase.assertWarnsRegex() no longer swallow
    warnings that do not match the specified category or regex.
    Nested context managers are now supported.
  - gh-149214: Fix _remote_debugging misreading non-ASCII
    Unicode strings (Latin-1, BMP and non-BMP) from a remote
    process. Filenames and function names that contain
    non-ASCII characters are now reported correctly in stack
    traces, the sampling profiler, and asyncio task
    introspection.
  - gh-149189: pprint now uses modern defaults: indent=4 and
    width=88, and the default compact=False output is now
    formatted similar to pretty-printed json.dumps(), with
    opening parentheses and brackets followed by a newline and
    the contents indented by one level. The expand parameter,
    added in 3.15.0a8, has been removed; compact=False (the
    default) now produces the former expand=True layout. Patch
    by Hugo van Kemenade.
  - gh-149173: Fix inverted PYTHON_BASIC_REPL environment check
    in pdb._pyrepl_available.
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-149009: Validate that profiling.sampling binary profiles
    do not contain more unique (thread, interpreter) pairs than
    declared in the header. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-148292: ssl: Update ssl.SSLSocket and ssl.SSLObject for
    OpenSSL 4. The classes now remember if they get
    a ssl.SSLEOFError. In this case, following read(),
    sendfile(), write(), and do_handshake() calls raise
    ssl.SSLEOFError without calling the underlying OpenSSL
    function. Thanks to that, ssl.SSLSocket behaves the same on
    all OpenSSL versions on EOF. Patch by Victor Stinner.
  - gh-149085: Add a max_threads keyword argument to
    faulthandler.dump_traceback(),
    faulthandler.dump_traceback_later(), faulthandler.enable(),
    and faulthandler.register().
  - gh-148641: pkgutil.resolve_name() gets a new optional,
    keyword-only argument called strict. The default is False
    for backward compatibility.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-149083: dataclasses.MISSING and dataclasses.KW_ONLY are
    now instances of sentinel.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-149026: Add colour to pickletools CLI output. Patch by
    Hugo van Kemenade.
  - gh-148991: Add colour to tokenize CLI output. Patch by Hugo
    van Kemenade.
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148981: Add color parameter to ast.dump().
  - gh-148849: Deprecate http.cookies.Morsel.js_output() and
    http.cookies.BaseCookie.js_output(), which will be removed
    in Python 3.19. Use http.cookies.Morsel.output() or
    http.cookies.BaseCookie.output() instead.
  - gh-146311: Add a canonical keyword-only parameter to the
    base16, base32, base64, base85, ascii85, and Z85 decoders
    in base64 and binascii. When true, encodings with non-zero
    padding bits (base16/32/64) or non-canonical encodings
    (base85/ascii85) are rejected. Single-character final
    groups in binascii.a2b_ascii85() and binascii.a2b_base85()
    are now always rejected as encoding violations, regardless
    of canonical; previously they were silently ignored and
    produced no output bytes.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-124397: The threading module added tooling to support
    concurrent iterator access: threading.serialize_iterator,
    threading.synchronized_iterator(), and
    threading.concurrent_tee().
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148688: bz2, compression.zstd, lzma, zlib: Fix a double
    free on memory allocation failure. Patch by Victor Stinner.
  - gh-148675: array, struct: Add support for Zd and Zf formats
    for double complex and float complex. Patch by Victor
    Stinner.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-148641: PEP 829 (package startup configuration files)
    implements a new format <name>.start parallel to <name>.pth
    files, to replace import lines in the latter.
  - gh-148639: Implement PEP 800, adding the
    @typing.disjoint_base decorator. Patch by Jelle Zijlstra.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148599: Update the socket module’s WSA error messages to
    match official documentation.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-144881: asyncio debugging tools (python -m asyncio ps
    and pstree) now retry automatically on transient errors
    that can occur when attaching to a process under active
    thread delegation. The number of retries can be controlled
    with the --retries flag. Patch by Bartosz Sławecki.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-121190: importlib.resources.files() now emits a more
    meaningful error message when module spec is None (as found
    in some __main__ modules).
  - gh-127012: importlib.abc.Traversable.read_text now
    allows/solicits an errors parameter.
  - gh-137855: Improve import time of dataclasses module by
    lazy importing re and copy modules.
  - gh-148352: Add more color to calendar’s CLI output. Patch
    by Hugo van Kemenade.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-130472: Integrate fancycompleter with import
    completions.
  - gh-148241: json: Fix serialization: no longer call str(obj)
    on str subclasses. Patch by Victor Stinner.
  - gh-148225: The profiling.sampling replay command now
    rejects non-binary profile files with a clear error
    explaining that replay only accepts files created with
  - -binary.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-148207: typing.TypeVarTuple now accepts bound,
    covariant, contravariant, and infer_variance parameters,
    matching the interface of typing.TypeVar and
    typing.ParamSpec.
  - gh-148100: Soft deprecate re.match() and re.Pattern.match()
    in favour of re.prefixmatch() and re.Pattern.prefixmatch().
    Patch by Hugo van Kemenade.
  - gh-147991: Improve tomllib import time (up to 10x faster).
    Patch by Victor Stinner.
  - gh-147957: Guarantees that collections.UserDict.popitem()
    will pop in the same order as the wrapped dictionary rather
    than an arbitrary order.
  - gh-146256: The profiling.sampling module now supports JSONL
    output format via --jsonl. Each run emits
    a newline-delimited JSON file that is sequentially
    parseable by external tools, scripts, and programmatic
    consumers. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146609: Add colour to timeit CLI output. Patch by Hugo
    van Kemenade.
  - gh-146563: xml.parsers.expat: add an exception note when
    a custom Expat handler return value cannot be properly
    interpreted. Patch by Bénédikt Tran.
  - gh-137586: Add MacOS to webbrowser for macOS, which opens
    URLs via /usr/bin/open instead of piping AppleScript to
    osascript. Deprecate MacOSXOSAScript in favour of MacOS.
  - gh-146406: Cross-language method suggestions are now shown
    for AttributeError on builtin types and their subclasses.
    For example, [].push() suggests append, (1,2).append(3)
    suggests using a list, None.keys() suggests expecting
    a dict, and 1.0.__or__ suggests using an int.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-146292: Add colour to BaseHTTPRequestHandler logs, as
    used by the http.server CLI. Patch by Hugo van Kemenade.
  - gh-145917: Add MIME types for TTC and Haptics formats to
    mimetypes. (Contributed by Charlie Lin in gh-145918.)
  - gh-145846: Fix memory leak in _lsprof when clear() is
    called during active profiling with nested calls.
    clearEntries() now walks the entire currentProfilerContext
    linked list instead of only freeing the top context.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145378: Use PyREPL as the default input console for pdb
  - gh-145244: Fixed a use-after-free in json encoder when
    a default callback mutates the dictionary being serialized.
  - gh-117716: Fix wave writing of odd-sized data chunks by
    appending the required RIFF pad byte and correcting the
    RIFF chunk size field accordingly.
  - gh-145200: hashlib: fix a memory leak when allocating or
    initializing an OpenSSL HMAC context fails.
  - gh-145056: Add support for frozendict in
    dataclasses.asdict() and dataclasses.astuple().
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-137855: Reduce the import time of dataclasses module by
    ~20%.
  - gh-70647: strptime() now raises ValueError when the format
    string contains %d without a year directive. Using %e
    without a year now emits a DeprecationWarning.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-108411: typing.IO and typing.BinaryIO method arguments
    are now positional-only.
  - gh-130273: Fix traceback color output with Unicode
    characters.
  - gh-142307: imaplib: deprecate support for IMAP4.file. This
    attribute was never meant to be part of the public
    interface and altering its value may result in unclosed
    files or other synchronization issues with the underlying
    socket. Patch by Bénédikt Tran.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-139489: Add the xml.is_valid_name() function, which
    allows to check whether a string can be used as an element
    or attribute name in XML.
  - gh-75707: Add optional mtime argument to tarfile.open(),
    for setting the mtime header field in .tar.gz archives.
  - gh-125862: The contextlib.contextmanager() and
    contextlib.asynccontextmanager() decorators now work
    correctly with generators, coroutine functions, and async
    generators when the wrapped callables are used as
    decorators.
  - gh-135528: http.cookiejar: add “tv”, “or”, “nom”, “sch”,
    and “web” to the default list of supported country code
    second-level domains.
  - gh-135056: Add a -H or --header CLI option to python -m
    http.server. Contributed by Anton I. Sipos.
  - gh-134551: Add t-strings support to pprint functions
  - gh-133956: Fix bug where @dataclass wouldn’t detect
    ClassVar fields if ClassVar was re-exported from a module
    other than typing.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-108951: asyncio: Add TaskGroup.cancel which cancels
    unfinished tasks and exits the group without raising
    asyncio.CancelledError.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-122476: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its local-part. Under a policy with utf8 set False,
    attempting to serialize such a message will now raise an
    HeaderWriteError. There is no valid 7-bit encoding for an
    internationalized local-part. Use email.policy.SMTPUTF8 (or
    another policy with utf8=True) to correctly pass through
    the local-part as Unicode characters.
  - gh-83938: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its domain. Under a policy with utf8 set False, attempting
    to serialize such a message will now raise an
    HeaderWriteError. Either apply an appropriate IDNA encoding
    to convert the domain to ASCII before serialization, or use
    email.policy.SMTPUTF8 (or another policy with utf8=True) to
    correctly pass through the internationalized domain name as
    Unicode characters.
  - gh-81074: The email module no longer treats email addresses
    with non-ASCII characters as defects when parsing a Unicode
    string or in the addr_spec parameter to
    email.headerregistry.Address. RFC 5322 permits such
    addresses, and they were already supported when parsing
    bytes and in the Address username parameter.
  - The (undocumented) email.errors.NonASCIILocalPartDefect is
    no longer used and should be considered deprecated.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-113471: Allow http.server to set a default content-type
    when serving files with an unknown or missing extension.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - gh-96894: Do not turn echo off for subsequent commands in
    batch activators (activate.bat and deactivate.bat) of venv.
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Tests
  - gh-149425: Increase time delta in
    test.test_zipfile.test_core.OtherTests.test_write_without_source_date_epoch
  - gh-148600: Add OpenSSL 4.0.0 support to test
    configurations.
  - Build
  - gh-149353: Avoid unnecessary JIT-related rebuilds during
    make install after --enable-optimizations builds.
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-149252: Update to WASI SDK 33.
  - gh-148690: Windows free-threaded builds now output to
    a different default path with default filenames, for
    example, PCbuild/amd64t/python.exe rather than
    PCbuild/amd64/python3.15t.exe. The PC/layout script has
    been updated to ensure compatibility of generated layouts.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148644: Errors during the PGO training job on Windows
    are no longer ignored, and a non-zero return code will
    cause the build to fail.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-148483: Use Py_GCC_ATTRIBUTE(unused) for stop_tracing
    label.
  - gh-148474: Fixed compilation of Python/pystrhex.c with
    older clang versions.
  - gh-146445: The Android build tools have been moved to the
    Platforms folder.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - gh-138451: Allow for custom LLVM path using
    LLVM_TOOLS_INSTALL_DIR during JIT build.
  - gh-133312: Add a new ./configure option
  - -enable-static-libpython-for-interpreter which, when used
    with --enable-shared, continues to build the shared library
    but does not use it for the interpreter. Instead, libpython
    is statically linked into the interpreter, as if
  - -enable-shared had not been used. This allows you to do
    a single build and get a Python interpreter binary that
    does not use a shared library but also get a shared library
    for use by other programs.
  - Windows
  - gh-149254: Updated bundled version of OpenSSL to 3.5.6.
  - gh-148690: Non-freethreaded builds on Windows now support
    extensions linked to python3t.dll, and will include a copy
    of that library in normal installs that references the
    non-freethreaded runtime.
  - gh-146458: Fix incorrect REPL height and width tracking on
    console window resize on Windows. macOS
  - gh-142295: For Python macOS framework builds, update
    Info.plist files to be more compliant with current Apple
    guidelines. Original patch contributed by Martinus Verburg.
  - gh-149254: Update macOS installer to use OpenSSL 3.5.6.
  - IDLE
  - gh-94523: Detect file if modified at local disk and prompt
    to ask refresh. Patch by Shixian Li.
  - gh-139551: Support rendering BaseExceptionGroup in IDLE.
  - gh-89520: Make IDLE extension configuration look at user
    config files, allowing user-installed extensions to have
    settings and key bindings defined in ~/.idlerc.
  - C API
  - gh-149225: PyCriticalSection and related functions are
    added to the Stable ABI.
  - gh-149216: PyType_WatchCallback callbacks registered via
    PyType_AddWatcher() are now also invoked when a watched
    heap type is deallocated. Previously, type watchers were
    only notified of modifications, which could cause stale
    references when a type was freed and its address was
    reused.
  - gh-149101: Implement PEP 788.
  - gh-149044: Implement PEP 820: Unified slot system for the
    C API.
  - gh-148267: Using Py_LIMITED_API on a non-Windows
    free-threaded build no longer needs an extra
    Py_GIL_DISABLED.
  - gh-145559: Rename _Py_DumpTraceback and
    _Py_DumpTracebackThreads to PyUnstable_DumpTraceback() and
    PyUnstable_DumpTracebackThreads().
  - gh-146636: Implement PEP 803 – abi3t: Stable ABI for
    Free-Threaded Builds.
  - gh-146302: Py_IsInitialized() no longer returns true until
    initialization has fully completed, including import of the
    site module. The underlying runtime flags now use atomic
    operations.
  - gh-146063: Add PyObject_CallFinalizerFromDealloc() function
    to the limited C API. Patch by Victor Stinner.
  - gh-145921: Add functions that are guaranteed to be safe for
    use in tp_traverse handlers:
    PyObject_GetTypeData_DuringGC(),
    PyObject_GetItemData_DuringGC(),
    PyType_GetModuleState_DuringGC(),
    PyModule_GetState_DuringGC(), PyModule_GetToken_DuringGC(),
    PyType_GetBaseByToken_DuringGC(),
    PyType_GetModule_DuringGC(),
    PyType_GetModuleByToken_DuringGC().
  - Remove upstreamed patches:
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-6100-use-after-free-decompression.patch
  - For &ix86 we build `--without-frame-pointers`

++++ radare2:

  - switch to python311 for sle15 build

++++ snapper:

  - allow to disable all-time unique snapshot numbers (see
    bsc#1268225)

++++ libtcnative-1-0:

  - Update to 1.3.8
    * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys

++++ libtcnative-2-0:

  - Upgrade to version 2.0.15
    * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys

++++ tvm:

  - Add upstream patch to fix tests on aarch64:
    * tvm-pr19786.patch

++++ uriparser:

  - Update to version 1.0.2:
    * Fixed: [CVE-2026-44927, bsc#1264578] Stop truncating ptrdiff_t to int
    * Fixed: [CVE-2026-44928, bsc#1264579] Fix EqualsUri with regard to .absolutePath
    * Fixed: [CVE-2026-42371, bsc#1262999] Protect from integer overflow in text range comparison
    * Fixed: Fix OOM related memory leak in CopyUriMm
    * Improved: Simplify internal function CompareRange into RangeEquals
    * Improved: Make function RangeEquals use size_t internally
  - cmake_fixes.patch: fix compilation with newer GTest

++++ vapoursynth:

  - Update to R77:
    * Fixed deadlock introduced in R76
    * MaskedMerge and PreMultiply now take chroma location into
    account when resizing the mask/alpha channel (may raise
    errors in rare cases due to new chroma location checks)
    * RISC-V is now detected as a proper target, with compilation
    fixes
    * proptoclip now also takes an index for the property
    * Many minor issues (filter argument validation, overflows and
    other rare problems) fixed after an AI audit of the code
  - Drop vapoursynth-system-zimg.patch: linking against the shared
    system zimg was adopted upstream (the bundled-static dependency
    is gone)

++++ libvirt:

  - spec: Add 'BuildRequires: python3-base' to fix build in SLFO:Main

++++ wireshark:

  - Fix post-build-checks: 50-check-permission failure (bsc#1263098)

++++ log4j:

  - Upgrade to 2.26.0
    * Added
    + Add a new ConfigurationFactory::getConfiguration method
    accepting multiple URIs
    + Add and export org.apache.logging.log4j.core.pattern
    .NamedInstantPattern enabling users to programmatically access
    named date & time patterns supported by Pattern Layout
    + Add log4j.plugin.processor.minAllowedMessageKind annotation
    processor option to PluginProcessor to filter diagnostic
    messages by severity. This allows builds that treat compiler
    notes as errors (e.g. Maven with -Werror) to suppress
    informational notes emitted during normal plugin processing
    + Add missing setters to Rfc5424LayoutBuilder
    * Changed
    + Ensure scripts in the global Scripts element have explicit
    names by throwing a ConfigurationException for unnamed ones
    + Simplify file manager registry factory methods
    * Deprecated
    + Deprecated withers in builder classes in favor of setters.
    This change improves API consistency with Log4j Core 3 and
    helps users adapt to the upcoming changes
    * Fixed
    + Fix script resolution failure when the Scripts element is
    placed after a ScriptRef in the configuration
    + Fix ArrayIndexOutOfBoundsException thrown by
    ThrowableStackTraceRenderer when the stack trace is modified
    concurrently
    + Fix SLF4JLogger.atFatal() returning atLevel(Level.TRACE)
    instead of atLevel(Level.FATAL). This was causing FATAL-level
    log events to be silently discarded when using the fluent API
    through the log4j-to-slf4j bridge
    + Fix Javadoc references across module boundaries (i.e.,
    cross-references)
    + Fix header write in RollingRandomAccessFileManager that was
    being incorrectly skipped if append=true and the file didn't
    exist before
    + Fix a properties file configuration regression caused by not
    referenced loggers, appenders, and filters
    * Removed
    + Remove the jvmrunargs lookup.
    * Updated
    + Update org.junit:junit-bom to version 5.13.4
    + Update org.mongodb:bson to version 5.6.1
    + Update org.xerial.snappy:snappy-java to version 1.1.10.8
  - Upgrade to 2.25.4
    * Fixed
    + Don't issue warnings if extra argument in parameterized
    logging is null
    + Restore support for documented Rfc5424Layout parameter names
    + Take Throwable#toString() into account while rendering stack
    traces in Pattern Layout
    + Added debug level logs for successful resource loading in
    Loader class
    + Align SslConfiguration factory method usage with Log4j 2.12+
    API. The verifyHostname attribute is now correctly recognized
    (bsc#1262050, CVE-2026-34477)
    + Fix sanitization of structured data parameter names in RFC5424
    layout
    + Replace invalid characters in XmlLayout output with the
    Unicode replacement character (U+FFFD)
    (bsc#1262092, CVE-2026-34480)
    + Replace invalid characters in Log4j1XmlLayout output with the
    Unicode replacement character (U+FFFD)
    (bsc#1262091, log4j-CVE-2026-34479)
    + Replace invalid characters in MapMessage.asXml() output with
    the Unicode replacement character (U+FFFD)
    + Write non-finite floating-point numbers as strings in
    JsonWriter (bsc#1262093, CVE-2026-34481)
  - Removed patches:
    * 0002-Remove-usage-of-toolchains.patch
    * log4j-CVE-2026-34477.patch
    * log4j-CVE-2026-34479.patch
    * log4j-CVE-2026-34480.patch
    * log4j-CVE-2026-34481.patch
    * log4j-jackson-databind.patch
    * logging-log4j-Remove-unsupported-EventDataConverter.patch
    + not needed with this version
  - Upgrade to 2.25.3
    * Changed
    + Optimize DefaultThreadContextMap.getCopy() performance by
    avoiding megamorphic calls in HashMap constructor
    * Fixed
    + Fix GraalVM metadata for nested classes to use binary names
    instead of canonical names
    + Fix failures caused by null SslConfiguration
    + Fix incorrect handling of the host name verification in
    SSL/TLS configuration, which is used by Socket Appender when
    SSL/TLS is enabled (bsc#1255427, CVE-2025-68161)
    * Removed
    + Remove the com.github.spotbugs:spotbugs-annotations dependency
  - Removed patch:
    * log4j-CVE-2025-68161.patch
    + not needed with this version
  - Upgrade to 2.25.2
    * Fixed
    + Fix potential memory leak involving LogBuilder in Log4j API to
    Logback bridge
    + Prevent unnecessary warnings in
    AbstractDriverManagerConnectionSource
    + Fix missing newlines in default logging configuration for
    log4j-core
    + Fix missing default Target value in Console Appender
    + Discard the sub-second part while obtaining the initial time
    (i.e., creation time) of a file in RollingFileManager
    + Fix Pattern Layout exception stack trace converters to no
    longer prepend newlines based on context
    + Fix the com.google.errorprone:error_prone_annotations
    dependency whose version property gets erased due to
    flattening
    + Fix detection of Throwable converters inside nested Pattern
    Layout patterns when applying alwaysWriteExceptions
    + Fix parsing and merging of literals in
    InstantPatternDynamicFormatter
  - Upgrade to 2.25.1
    * Fixed
    + Fix detection of the Disruptor major version in environments
    with non-standard thread context classloader
    + Downgrade spotbugs-annotations to resolve Gradle build
    failures
    + Fix incorrect version resolution of jspecify and
    error_prone_annotations dependencies in published POM files
    + Restore compatibility with Spring Boot by allowing
    reconfiguration using the LoggerContext.start method
    + Allow omission of the -Alog4j.graalvm.groupId and
  - Alog4j.graalvm.artifactId arguments when building Log4j
    plugins
    + Broaden the OSGi manifest's Import-Package constraints to
    support Jakarta Servlet API up to version 6.
    + Enable the resource: protocol for configuration files by
    default when running on GraalVM.
    + Fix timestamp formatting concurrency issue, when
    log4j2.enabledThreadlocals is true
    + Fix GraalVM reachability metadata generation for methods with
    annotated array type parameters, such as @Nullable String[]
    + Resolve PropertiesConfiguration compatibility issues with
    GraalVM and address additional minor reflection-related
    problems
    + Fixes NullPointerException thrown by
    ThrowableStackTraceRenderer when suppressed exceptions are
    mutated concurrently
  - Upgrade to 2.25.0
    * Added
    + Add Google OSS-Fuzz integration
    + Add a GraalVmProcessor annotation processor to generate
    GraalVM reachability metadata.
    + Add MonitorResource configuration option to support the
    monitoring of external files in addition to the configuration
    file itself.
    + Fixed typo in "LoggerConfig.RootLogger
    .Builder#withtFilter(...​)" method. Created new corrected
    'withFilter()' method and deprecated old method.
    + Add collectionName and databaseName arguments to the MongoDB
    appender
    * Changed
    + Remove JAnsi library support. Windows 10 console has supported
    ANSI escapes since 2017
    + Consolidate exception rendering logic and improve circular
    reference support in Pattern Layout
    + Rewrite JAnsiTextRenderer to work without JAnsi library
    + Switch prefixing stack traces in Pattern Layout from
    whitespace to newline
    + Changes the layout used by the default configuration.
    + Switch to using Java's DateTimeFormatter for date & time
    formatting of log event instants
    + Switch the default exception converter from the extended
    exception converter to the plain exception converter
    + Don't close StringReaders because of batching.
    + Switch prefixing stack traces in Status Logger from whitespace
    to newline
    + The MongoDb Appender shouldn't log a deprecation warning,
    + Add improved validation to StringMatchFilter for null/empty
    text
    + Currently Java 8 users do not have access to timestamps with
    sub-millisecond precision. This change moves the SystemClock
    implementation from log4j-core-java9 to log4j-core, overriding
    the current one, so that java 8 users can benefit from it.
    + Don't overwrite configured configuration name if the
    configuration has no loggers / no root logger.
    + Update GcpLayout.json JSON Template Layout event template to
    support automatic timestamp recognition by the Google Cloud
    Logging. This also changes exception, thread, logger fields,
    and removes insertId field.
    + Have org.apache.logging.log4j.util.Base64Util invoke
    java.util.Base64 directly instead of reflectively.
    + Improve implementations of LogEvent.toImmutable() and
    ReusableMessage.memento() and remove usage of ThrowableProxy
    * Deprecated
    + Deprecate ThrowableProxy and all its usages
    + Deprecate AbstractLogger.checkMessageFactory(), since all
    created Loggers are already MessageFactory-namespaced
    + Deprecated FixedDateTime, FastDateTime, and supporting classes
    + Use hard references to Loggers in LoggerRegistry
    * Fixed
    + Switch MongoDB tests to use Docker.
    + Add a Jakarta-based JMS Appender module log4j-jakarta-jms and
    deprecate the Javax version
    + Fix RollingFileManager to reopen the log file when the
    rollover was unsuccessful
    + Fix certain exception rendering issues in Pattern Layout
    + Reload key & trust stores while reconfiguring network
    appenders containing a TLS (formerly known as SSL)
    configuration
    + Simplify the SSLContext instantiation for the TLS (formerly
    known as SSL) configuration
    + Adding a compilation warning for Plugin Builder Attributes
    that do not have a public setter.
    + Fix reloading of the configuration from an HTTP(S) source
    + Fix putAll() in the default thread context map implementation
    + Improves validation of HTTP Appender.
    + Fix getLogger() source incompatibility in Log4j 1 to Log4j 2
    API Bridge (i.e., log4j-1.2-api)
    + Fix property extraction from the root exception in Pattern
    Layout
    + Fix key removal issues in Thread Context
    + Fix Android-related issues in Log4j Core.
    + Fix the leak of non-Log4j dependencies in log4j-bom
    + Fix the conversion of o.a.l.Priority classes to Log4j 2 levels
    + Ensures synchronization between j.u.l.Logger.getLevel() and
    j.u.l.Logger.setLevel() methods.
    + Add improved validation to AsyncWaitStrategyFactoryConfig for
    null/empty factoryClassName.
    + Fix NullPointerException when using rootLogger = LEVEL
    shorthand in properties without appender.
    + Fix ArrayIndexOutOfBoundsException in JSON Template Layout
    truncated exception resolver
    + Properly handle null 'replacement' parameter in
    RegexReplacement#createRegexReplacement.
    + Fix detection of location requirements in AsyncAppender.
    + Fix detection of location requirements in FailoverAppender.
    + Corrected @return javadoc for AbstractFilterable#isFiltered()
    + TypeConverters convert for "Level" incorrectly documented
    behaviour for invalid value - updated javadoc.
    + Fix loading of the effective RecyclerFactoryConverter in JSON
    Template Layout
    + Minimize lock usage in InternalLoggerRegistry.
    + Improved expunging of stale entries in InternalLoggerRegistry
    to prevent potential memory leaks
    + Make annotation libraries visible transitively at compile time
    for Gradle users through Gradle Module Metadata and for JPMS
    users through requires static directives in module-info.java
    files
    + Fix shutdownDisable configuration does not take effect
    + Fix ArrayIndexOutOfBoundsException on
    StatusData#getFormattedStatus.
    + Deprecate or remove static hiding methods.
    + Verify the capability of SecurityManager so that platforms not
    (fully) supporting it will not poison the stack trace
    + Improve performance and avoid memory consumption if logging
    primitive arrays as parameters
    + Fix ArrayIndexOutOfBoundsException on invocation of Message
    .getFormattedMessage() when any thread has no stack trace,
    which occurs on some JVM implementations
    + StatusLogger now writes to standard error by default. This
    fixes a regression introduced in 2.23.0
    + The ReadOnlyStringMap implementations now support equality
    comparisons against each other
    + Fixes OSGi descriptor to accept Disruptor 4
    + Avoid surrogate character handling in JsonWriter
    * Removed
    + Remove support for the {ansi} option in Pattern Layout
    exception converters
    * Updated
    + Update actions/stale to version 9.1.0
    + Update ch.qos.logback:logback-core to version 1.3.15
    + Update com.fasterxml.jackson:jackson-bom to version 2.19.0
    + Update com.github.spotbugs:spotbugs-annotations to version
    4.9.3
    + Update io.fabric8:docker-maven-plugin to version 0.46.0
    + Update org.apache.cassandra:cassandra-all to version 3.11.19
    + Update org.apache.commons:commons-csv to version 1.14.0
    + Update org.apache.commons:commons-dbcp2 to version 2.13.0
    + Update org.apache.commons:commons-pool2 to version 2.12.1
    + Update org.apache.kafka:kafka-clients to version 3.9.1
    + Update org.apache.logging:logging-parent to version 12.1.1
    + Update org.apache.tomcat:tomcat-juli to version 10.1.30
    + Update org.eclipse.jetty:jetty-util to version
    9.4.57.v20241219
    + Update org.jmdns:jmdns to version 3.6.1
    + Update org.mongodb:bson to version 5.5.1
    + Update org.slf4j:slf4j-api to version 2.0.17
    + Update org.springframework.cloud:spring-cloud-context to
    version 4.3.0
  - Upgrade to 2.24.3
    * Fixed
    + Fix ConcurrentModificationException, if multiple threads
    modify loggers concurrently. This bug affects users that
    modify logger levels programmatically
    + Fix for RegexCreator NPE, the constructor expects a boolean
    primitive, but the createFilter static method was boxed.
    Fixed that to remove the NPE issues
    + Protects PropertiesUtil against property sources that call
    PropertiesUtil recursively. In some cases such a property
    source can even cause deadlocks
  - Upgrade to 2.24.2
    * Fixed
    + Fix key removal issues in Thread Context
    + Use hard references to Loggers in LoggerRegistry
    + Fix ArrayIndexOutOfBoundsException in JSON Template Layout
    truncated exception resolver
  - Upgrade to 2.24.1
    * Changed
    + Rework LoggerRegistry to make it MessageFactory-namespaced.
    This effectively allows loggers of same name, but different
    message factory
    + Enable Docker-based tests in CI for JSON Template Layout
    * Fixed
    + Switch MongoDB tests to use Docker.
    + Fix reloading of the configuration from an HTTP(S) source
    + Fix putAll() in the default thread context map implementation
    * Updated
    + Update org.apache.logging:logging-parent to version 11.3.0
  - Upgrade to 2.24.0
    * Added
    + Add a faster DefaultThreadContextMap implementation
    + Add Logback throwable-consuming semantics as an option in
    log4j-slf4j-impl and log4j-slf4j2-impl. Users can enable it by
    setting the property log4j2.messageFactory to org.apache
    .logging.slf4j.message.ThrowableConsumingMessageFactory
    + Add trace context fields to GcpLayout.json
    + Add "Plugin Reference" to the website. It is a
    Javadoc-on-steroids focusing on Log4j plugins
    + Automate website deployment using the new CI infrastructure
    shipped with org.apache.logging:logging-parent:11.0.0
    * Changed
    + Fix usage of log4j-api in GraalVM without additional
    reachability data
    + Ignore exceptions thrown by PropertySources
    + Add logging to PropertiesUtil and fix Duration parser
    + Disable level modification via JUL by default
    + Centralize initialization in the Provider class and deprecate
    the log4j2.loggerContextFactory property
    + Remove log4j-kubernetes lookup. User should migrate to
    io.fabric8:kubernetes-log4j
    + Disable JMX support by default. Requires log4j2.disableJmx to
    be set to false to enable JMX support
    + Replace some usages of DateTimeFormatter#toString() with
    DateTimeFormatter#formatTo(StringBuilder) to cut down on
    allocations
    + Disable programmatic configuration in Log4j 1 Bridge if
    log4j1.compatibility is false
    + Improve missing plugin descriptor warnings
    + Remove configuration properties caching and (undocumented)
    fuzzy property name matching
    + Fixes property source ordering to account for different
    sources with the same priority
    + Prioritize user-defined values of log4j2.enableThreadlocals,
    log4j2.garbagefreeThreadContextMap and
    log4j2.shutdownHookEnabled over the value of log4j2.isWebapp
    + Disallow duplicate keys in JSON Template Layout templates
    + Deprecate log4j2.defaultStatusLevel property in Log4j Core in
    favor of log4j2.statusLoggerLevel
    * Deprecated
    + Deprecate Message#getFormat() due to unclear semantics and
    inconsistent implementations
    + Deprecate org.apache.logging.log4j.EventLogger for removal
    + Deprecate org.apache.logging.log4j.core.appender.rolling
    .action.Duration class for removal
    + Deprecate the log4j-mongodb4 module in favor of log4j-mongodb
    * Fixed
    + Use FQDN in RFC5424 Layout
    + Fix custom thread-context data provider handling in lookups
    and filters
    + Fix handling of log4j2.messageFactory and
    log4j2.flowMessageFactory properties
    + Discard blank keys in PropertiesUtil
    + Fix handling of log4j2.debug
    + Fix location requirement for the %F and %file keys in Pattern
    Layout
    + Fix JsonLayout failure under JPMS
    + Fix empty string handling for TruncatingBufferedWriter
    + Fix that parameterized message formatting throws an exception
    when there are insufficient number of parameters. It
    previously simply didn't replace the '{}' sequence. The
    behavior changed in 2.21.0 and should be restored for backward
    compatibility
    + Fix ClassCastException in LMAX Disruptor 3 initialization
    + Fix requirement on the java.management module when JMX is
    disabled, which is the default
    + Website is migrated to Antora with several formatting and link
    fixes
    * Removed
    + Move Flume Appender to its own release lifecycle
    * Updated
    + Add module log4j-mongodb to track the current MongoDB driver
    (currently version 5)
    + Remove module log4j-mongodb3, use log4j-mongodb instead,
    log4j-mongodb4 is deprecated for removal
    + Update com.fasterxml.jackson:jackson-bom to version 2.17.2
    + Update com.github.luben:zstd-jni to version 1.5.6-5
    + Update commons-codec:commons-codec to version 1.17.1
    + Update commons-logging:commons-logging to version 1.3.4
    + Update github/codeql-action to version 3.25.1
    + Update io.fabric8:docker-maven-plugin to version 0.45.0
    + Update org.apache.cassandra:cassandra-all to version 3.11.17
    + Update org.apache.commons:commons-compress to version 1.27.1
    + Update org.apache.commons:commons-csv to version 1.11.0
    + Update org.apache.commons:commons-lang3 to version 3.17.0
    + Update org.apache.kafka:kafka-clients to version 3.8.0
    + Update org.apache.logging:logging-parent to version 11.2.0
    + Update org.eclipse.jetty:jetty-bom to version 9.4.56.v20240826
    + Update org.jctools:jctools-core to version 4.0.5
    + Update log4j-mongodb4 org.mongodb:* from 4.11.1 to 4.11.2
    + Update org.mongodb:bson to version 4.11.4
    + Update org.slf4j:slf4j-api to version 2.0.16
    + Update org.springframework:spring-framework-bom to version
    5.3.39
  - Upgrade to 2.23.1
    * Changed
    + Fix handling of LoggerContextAware lookups
    + Fix NPE in PatternProcessor for a UNIX_MILLIS pattern
    + Improve performance of CloseableThreadContext#closeMap()
    * Fixed
    + Fix that parameterized message formatting doesn't throw an
    exception when there are insufficient number of parameters
    + Fix StatusLogger log level filtering when debug mode is
    enabled
    + Add log4j2.statusLoggerDateFormatZone system property to set
    the time-zone StatusLogger uses to format java.time.Instant.
    Without this, formatting patterns accessing to
    time-zone-specific fields (e.g., year-of-era) cause failures.
    + Fix StatusLogger to correctly read
    log4j2.StatusLogger.properties resource
    + Fix stack overflow in StatusLogger
    * Updated
    + Update jakarta.activation:jakarta.activation-api to version
    2.1.3
    + Update jakarta.mail:jakarta.mail-api to version 2.1.3
    + Update org.apache.commons:commons-compress to version 1.26.0
    + Update org.apache.commons:commons-dbcp2 to version 2.12.0
    + Update org.apache.kafka:kafka-clients to version 3.7.0
    + Update org.eclipse.angus:angus-activation to version 2.0.2
    + Update org.eclipse.angus:jakarta.mail to version 2.0.3
  - Upgrade to 2.23.0
    * Added
    + Added support for LMAX Disruptor 4.x
    * Changed
    + Make StatusLogger self-contained and testable
    + Simplify BND configuration after upgrade from version 6.4.1 to
    7.0.0
    * Deprecated
    + Deprecate the configuration attribute verbose (i.e.,
    <Configuration verbose="...​") and StatusConsoleListener filters
    + Deprecated the RingBufferLogEventHandler class for removal
    from the public API in 3.x
    * Fixed
    + Fix regression in JdkMapAdapterStringMap performance
    + Fix the behavior of Logger#setLevel and Logger#getLevel in the
    Log4j 1.2 bridge
    + Fix the behavior of CoreLogger#getLevel and
    CoreLogger#setLevel in the log4j-jul module
    + Allow deserialization of all arrays of allowed classes
    + Allow the <Properties> node to appear in any position in the
    configuration element
    + Fix forgotten threadName field in RingBufferLogEvent#clear()
    + Fix StringBuilder cache corruption on recursive access
    + Fixed use of SecurityManager in LoaderUtil where
    AccessController::doPrivileged should only be invoked when a
    SecurityManager is installed. Some runtimes do not seem to
    have this method available
    + Fix log4j-spring-cloud-config-client dependencies to include
    only those required
    + Fix typo in Kubernetes clientKeyData configuration property
    * Updated
    + Update com.fasterxml.jackson:jackson-bom to version 2.16.1
    + Update commons-codec:commons-codec to version 1.16.1
    + Update io.netty:netty-bom to version 4.1.107.Final
    + Update org.apache.logging:logging-parent to version 10.6.0
    + Update org.eclipse.jetty:jetty-bom to version 9.4.54.v20240208
    + Update org.jctools:jctools-core to version 4.0.3
    + Update org.springframework:spring-framework-bom to version
    5.3.32
    + Update org.zeromq:jeromq to version 0.6.0
  - Upgrade to 2.22.1
    * Fixed
    + Mark JdkMapAdapterStringMap as frozen if map is immutable
    + Fix NPE in CloseableThreadContext
    + Use the module name of Conversant Media Disruptor from
    version 1.2.16+ of the library
    + Fix NPE in RollingFileManager
    + Fix log4j-to-slf4j JPMS and OSGi descriptors
    + Workaround a Coursier/Ivy dependency resolution bug affecting
    log4j-slf4j-impl and log4j-mongodb3
    * Updated
    + Bumped the minimum Java version required for the build to
    Java 17. Runtime requirements remain unchanged
    + Update com.github.luben:zstd-jni to version 1.5.5-11
    + Update com.google.guava:guava to version 33.0.0-jre
    + Update commons-codec:commons-codec to version 1.16.0
    + Update commons-io:commons-io to version 2.15.1
    + Update commons-logging:commons-logging to version 1.3.0
    + Update io.netty:netty-bom to version 4.1.104.Final
    + Update org.apache.commons:commons-compress to version 1.25.0
    + Update org.apache.commons:commons-dbcp2 to version 2.11.0
    + Update org.apache.commons:commons-lang3 to version 3.14.0
    + Update org.apache.commons:commons-pool2 to version 2.12.0
    + Update org.apache.kafka:kafka-clients to version 3.6.1
    + Update org.apache.logging:logging-parent to version 10.5.0
    + Update org.jctools:jctools-core to version 4.0.2
    + Update org.springframework.boot:spring-boot to version 2.7.18
    + Update org.springframework.cloud:spring-cloud-dependencies to
    version 2021.0.9
  - Upgrade to 2.22.0
    * Changed
    + Change the order of evaluation of FormattedMessage formatters.
    Messages are evaluated using java.util.Format only if they
    don't comply to the java.text.MessageFormat or
    ParameterizedMessage format
    + Change default encoding of HTTP Basic Authentication to UTF-8
    and add log4j2.configurationAuthorizationEncoding property to
    overwrite it
    * Fixed
    + Harden deserialization process by requiring the usage of
    FilteredObjectInputStream on Java 8 and ObjectInputFilter on
    Java 9+ to deserialize custom classes
    + Fix MDC pattern converter causing issues for %notEmpty
    + Export missing OSGi & JPMS modules in
    log4j-layout-template-json and log4j-1.2-api
    + Fix spring-test dependency scope change
    + Fix JPMS descriptors causing jlink issues
    + Add missing Implementation- and Specification- entries to
    MANIFEST.MF (implemented by logging-parent version 10.3.0
    update)
    + Fix NotSerializableException thrown when Logger is serialized
    with a ReusableMessageFactory
    * Removed
    + Removed unused FastDateParser which was causing unnecessary
    heap overhead
    * Updated
    + Update com.fasterxml.jackson:jackson-bom to version 2.16.0
    + Update com.github.luben:zstd-jni to version 1.5.5-10
    + Update com.google.guava:guava to version 32.1.3-jre
    + Update io.netty:netty-bom to version 4.1.101.Final
    + Update org.eclipse.persistence:org.eclipse.persistence.jpa to
    version 2.7.13
    + Update org.fusesource.jansi:jansi to version 2.4.1
    + Update org.mongodb:bson to version 4.11.1
    + Update org.springframework:spring-framework-bom to version
    5.3.30
    + Update org.springframework.boot:spring-boot to version 2.7.17
    + Update org.springframework:spring-framework-bom to version
    5.3.31
    + Update org.zeromq:jeromq to version 0.5.4
  - Upgrade to 2.21.1
    * Fixed
    + Fixes the Apache Commons Logging (JCL) bridge: log4j-jcl
  - Upgrade to 2.21.0
    * Added
    + Added marker parent support to JsonTemplateLayout
    + Added ZStandard compression support
    + Added a warning for incorrect syntax of highlighting styles
    * Changed
    + Open FileExtension methods to allow their usage in custom
    RolloverStrategys
    + Bumped the minimum Java version required for the build to
    JDK 11. Runtime requirements remain unchanged
    + Set the default minLevel and maxLevel of LevelRangeFilter to
    OFF and ALL, respectively
    + Removed additional isFiltered checks in AsyncLoggerConfig
    + Use Java version-specific warnings in StackLocator
    + Started logging a status error event instead of an NPE in
    OsgiServiceLocator.loadServices(Class, Lookup, boolean) when a
    bundle has no valid BundleContext for a service type
    + Implemented a CI-based release process
    * Fixed
    + Added validation to rolling file manager path conditions
    + Adapted the OSGi metadata of log4j-to-slf4j to work with
    SLF4J 1 and 2. To achieve that used a version range of [1.7,3)
    for the imported SLF4J packages
    + Fixed Javadoc failures
    + Removed locale-dependent toLowerCase/toUpperCase calls
    + Redirected old /<module>/apidocs URLs
    + Added environment variable arbiter
    + Fixed logging of java.sql.Date objects by appending it before
    Log4J tries to call java.util.Date.toInstant() on it
    + Adapted the OSGi metadata of log4j-api, log4j-core,
    log4j-slf4j-impl and log4j-slf4j2-impl to activate the bundle
    when it is accessed. To achieve that set the
    Bundle-ActivationPolicy to lazy for the log4j bundles
    + Avoided using released objects in StackTraceStringResolver of
    JsonTemplateLayout
    + Added missing setter for connectionStringSource in
    MongoDb4Provider builder
    + Fixed NPE in PluginElementVisitor
    + Added columnType as alias for the column mapping type attribute
    + Restored Log4jMarker visibility in SLF4J adapters
    + Fixed buffer size in Log4jFixedFormatter date time formatter
    + Fixed the propagation of synchronous action failures in
    RollingFileManager and FileRenameAction
    + Fixed RollingFileManager to propagate failed synchronous
    actions correctly
    + Replaced the usage of System.out in StackLocator for warnings
    with System.err
    + Fixed concurrent date-time formatting issue in PatternLayout
    + Fixed runtime dependencies documentation
    + Allowed to override FQCN in Log4jEventBuilder by implementing
    CallerBoundaryAware
    + Migrated MongoDB tests to JUnit 5 and Flapdoodle Embedded
    MongoDB 4
    + Rewrote message parameter formatter with improved escape
    handling
    + Improved formatting and serialization of StackTraceElement on
    JDK 9+
    + Fixed MemoryMappedFileAppender buffer unmapping on JRE 9+
    + Fixed rollover strategy in the Log4j 1.x compatibility layer
    + Removed incorrect mention of base64 lookup and improve the
    rest of the lookup manual
    + Implemented LocationAware for JsonTemplateLayout, since this
    was causing location not being passed to underlying appenders
    + Added support for long values in MongoDb 4 appender to
    configure collectionSize
    + Only shutdown Log4j after last Log4jServletContextListener is
    executed
    + Allowed using Spring Arbiter without a Spring environment
    + Fixed context data loss if <AsyncLogger> components are used
    with an all async logger context
    + Fixed JsonTemplateLayout NPE thrown on custom log levels
    + Improved Log4j-config.xsd schema
    + Fixed NPE in ContextSelector
    + Avoided allocating ThreadLocals in AbstractLogger when they
    are disabled, since this was causing memory leaks due to
    retained reference to class loaders in web applications
    + Fixed %notEmpty directive of PatternLayout for empty MDC/NDC
    inputs
    + Fixed file descriptor leak on Tomcat
    + Ensured FileOutputStream is closed in CommonsCompressAction
    .execute()
    * Removed
    + Moved log4j-jmx-gui to its own repository along with its own
    release cycle
    * Updated
    + Update Eclipse Angus Activation to version 2.0.1
    + Update Eclipse Angus Mail to version 2.0.2
    + Update com.datastax.cassandra:cassandra-driver-core to version
    3.11.5
    + Update Apache Cassandra to version 3.11.16
    + Update Apache Commons Compress to version 1.24.0
    + Update Apache Commons CSV to version 1.10.0
    + Update Jackson to version 2.15.2
    + Update Jakarta Activation API to version 2.1.2
    + Update Jakarta Mail API to version 2.1.2
    + Update JCTools to version 4.0.1
    + Update Apache Kafka to version 3.4.0
    + Update Kubernetes client to version 5.12.4
    + Update org.mongodb:mongodb-driver-core to version 4.10.2
    + Update io.netty:netty-bom to version 4.1.97
    + Update Spring Boot to version 2.7.15
    + Update Spring Framework to version 5.3.29
    + Update Tomcat JULI to version 10.0.27
    + Update Woodstox to version 6.5.1

++++ maildir-utils:

  - Update to 1.14.2:
    * silence some MIME part errors
    * some emacs 28.1+ modernization
    * list org links with M-x mu4e-org-agenda-links
    * when replying to a message with some part selected, cite only that part
    * fix parsing of the Keywords: headers. If you use those, you're recommend to
    re-index your message

++++ matrix-synapse:

  - Update to 1.155.0
  - Bugfixes
  - Limit the to-device EDU size to a reasonable value to
    mitigate long queues of to-device messages preventing
    outgoing federation because of the size of the transaction.
    (#19617)
  - Work around bug that sometimes breaks joining restricted
    rooms that require a remote join. Contributed by @tulir @
    Beeper. (#19730)
  - Update Sliding Sync to return a new response immediately if a
    room subscription has changed and produced a new response.
    (#19734, #19792)
  - Fix the /capabilities endpoint returning a 500 error on
    non-media workers when MSC4452: Preview URL capabilities API
    is enabled. (#19839)
  - Improved Documentation
  - Document how to see Rust build failure output when using
    poetry install. (#19818)
  - Document that the SQLite version included in Ubuntu LTS,
    aside from ESM-only versions, is included in our support
    policy. (#19823)
  - Internal Changes
  - Port the Python Event classes to Rust. (#19701, #19816,
    [#19817], #19819)
  - Added tests to ensure that email notification links are
    sanitized. Contributed by Noah Markert. (#19741)
  - Add GcpJsonFormatter logging formatter for use with Google
    Cloud Logging and GKE deployments. (#19775)
  - Add more logging to the to-device message replication stream.
    (#19801, #19821)
  - Port Requester class to Rust. (#19828)

++++ mcp-server-systemd:

  - reworded the test package description that it is only for internal
    tests
  - added README-TESTING.md

++++ mistral-vibe:

  - Update to 2.16.1:
  - Added
  - ACP workspace trust gated behind the workspace-trust client
    capability
  - Changed
  - /resume now opens much faster
  - Startup update-failure message is now gentler and no longer
    alarms when an update can't be applied

++++ nekobox:

    Update to 5.11.22
  - Fix subscription updates

++++ nvidia-open-driver-G06-signed-cuda:

  - linux-7.1.patch
    * improved patch in order to avoid Use-After-Free (found by AI
    review; proposal fix by Michal Suchanek)
  - linux-7.1.patch:
    * fixes build against kernel 7.1 (currently blocking our
    kernel 7.1 release for TW); stolen from changes for 580.159.04
    release (boo#1268331)

++++ nvidia-open-driver-G06-signed:

  - linux-7.1.patch
    * improved patch in order to avoid Use-After-Free (found by AI
    review; proposal fix by Michal Suchanek)
  - linux-7.1.patch:
    * fixes build against kernel 7.1 (currently blocking our
    kernel 7.1 release for TW); stolen from changes for 580.159.04
    release (boo#1268331)

++++ nvme-cli:

  - fabrics: add helper to update tls and concat (bsc#1259672)
  - nvmf-autoconnect: add NetworkManager dispatcher script (jsc#PED-14314)
  - updated spec:
    * add 0001-nvmf-autoconnect-add-NetworkManager-dispatcher-scrip.patch
    * add 0002-fabrics-add-helper-to-update-tls-and-concat.patch
    * install 80-nvmf-connect-nbft.sh

++++ openQA:

  - Update to version 5.1781621316.6d025b35:
    * refactor: set clean monikers for Mojo services
    * feat: use encrypted session cookies
    * chore(deps): Dependency cron 2026-06-13
    * docs: Mention how to enable UEFI and recently added variables
    * docs: fix broken badge syntax in README.md
    * feat(apparmor): add current worker profile as generated by aa-logprof
    * feat(apparmor): add current worker requirements in /proc and /sys
    * chore(deps): Dependency cron 2026-06-12
    * git subrepo pull (merge) external/os-autoinst-common
    * docs: Fix wrapping in "Job Priority Throttling" section
    * fix(apparmor): Allow worker profile to use virt-fw-vars
    * fix(livelog): Prevent timeouts due to nginx buffering
    * fix: avoid initial delay when replying from livestream
    * chore(deps): Dependency cron 2026-06-10
    * chore(deps): Dependency cron 2026-06-09
    * test: Skip earlier in tests_dependencies.t
    * fix: Use reload-or-restart for openQA auto restart worker slots
    * fix: Update codecov orb to latest version 6.0.0 fixing PGP error
    * chore(deps): Dependency cron 2026-06-06
    * fix: Support invent.kde.org and 'work_items' in bug URL handling
    * ci(mergify): prevent annoying conflict messages
    * docs: Rewrite medium version globbing in more user-facing style
    * docs: Mention globbing in "Spawning multiple jobs …" and "Medium types"
    * feat(scheduling): Allow globbing in version specifications
    * fix: Set correct settings for scheduling example test
    * refactor: Fix comment regarding `test_preset` INI section

++++ os-autoinst:

  - Update to version 5.1781620242.0160257:
    * fix: Fix comment about OVMF firmware locations
    * fix(test): fix Test::More precedence in autotest
    * git subrepo pull (merge) --force external/os-autoinst-common
    * feat: Avoid silent fallback to MS certs with `UEFI_PFLASH_CERTS`
    * fix: Fix enrolling cert in UEFI firmware vars for SecureBoot

++++ pam:

  - Fix password comparison timing leak from pam_userdb
    [CVE-2026-54411], [bsc#1268290]
    * pam_userdb-fix-password-comparison-timing-leak.patch

++++ pam-full-src:

  - Fix password comparison timing leak from pam_userdb
    [CVE-2026-54411], [bsc#1268290]
    * pam_userdb-fix-password-comparison-timing-leak.patch

++++ par2cmdline:

  - Update to 1.2.0:
    * Security fix GHSA-j5pc-g362-c5xp (no CVE assigned upstream):
    repair could follow dangling symlinks and write outside the
    repair base path
    * Security fix GHSA-3c2j-rccw-j2vj (no CVE assigned upstream):
    heap out-of-bounds write from an unchecked source block
    count wrap
    * Take input files from stdin (standard input)
    * Fix failure with input file count over 2000 with defaults,
    plus a related edge case
    * Fix a missing include and RAM detection
    * Improve and sync the man pages with the command-line help

++++ perl-Log-Report:

  - updated to 1.460.0 (1.46)
    see /usr/share/doc/packages/perl-Log-Report/ChangeLog
    version 1.46: Tue 16 Jun 10:14:47 CEST 2026
    Fixes:
  - select specific dispatcher try.
    [Andy Berverley] github issue #21
    Improvements:
  - add Log::Report::default_dispatcher_mode()

++++ perl-Test-MockModule:

  - updated to 0.185.3 (v0.185.3)
    see /usr/share/doc/packages/perl-Test-MockModule/Changes
    [#]# 0.185.3 — 2026-06-15
    [#]# What's Changed
    * Fix/93 moo meta no moose by @geofffranks in https://github.com/geofffranks/test-mockmodule/pull/94
    * *Full Changelog**: https://github.com/geofffranks/test-mockmodule/compare/0.185.2...0.185.3

++++ perl-Test-Simple:

  - updated to 1.302222
    see /usr/share/doc/packages/perl-Test-Simple/Changes
    1.302222  2026-06-15 10:18:50-07:00 America/Los_Angeles
  - Add missing Changes entry
  - Fix test that fails on some windows versions due to path seperators

++++ poezio:

  - Update to 0.18:
    Features:
    * Implementation of Message Retraction (XEP-0424) as the sending side.
    * Various improvements to the react plugin, notably a way to convert :emoji: aliases to real emojis.
    * Overhaul of the hide_exit_join option (more in the next section).
    * Updates to hide_exit_join
    Fixes:
    * The API used internally for message retraction or moderation is no longer limited to the last 100 messagess.
    * Fixed the config file handling on Guix or related distributions where the
    config file could actually be a symlink (in which case it produced
    undesired behavior).
    * Custom plugin and theme load should keep working on python 3.15, which
    removes a number of deprecated APIs in python’s importlib.
    * The /xhtml command had been broken for a while.
    * Some coroutines in the admin or irc plugin were not awaited, which broke
    functionality and produced unwanted errors in the output.
    * Fixed a traceback when receiving reactions from an unopened conversation.
    * Fixed a display bug in semi-anonymous rooms showing the room jid
    (room@server/nick) for users when joining/leaving, which is useless.
    * Fixed a case where self-ping would be disabled when the room disconnects us, instead of trying to rejoin later.
  - Update to 0.17:
    * Message Reactions
  - Update to 0.16.1:
    Features:
    * Handle redacted/moderated messages in /display_corrections as well
    Fixes:
    * A bug in occupant comparison introduced in 0.16, leading to inconsistent MUC state in some cases.
    * Several fixes to MAM syncing and history gaps in MUC, which should be more reliable (but not perfect yet).
    * Issues around MUC self-ping (XEP-0410) where you could not ever leave a room if it was enabled.
    * A bug in the new tcp-reconnect plugin which would traceback when disconnected.
    * Loading issues with plugins defined in entrypoints, of which the most common is poezio-omemo.
    Internal:
    * Introduction of a harsher linting pipeline.
    * Plenty of typing and linting fixes.
    * Added poezio-omemo to the plugins list in pyproject, for easier installation.
  - Update to 0.16:
    Features:
    * Receiving side of moderation (XEP-0425) and retraction (XEP-0424) events
    * New /report plugin to report spam (XEP-0377)
    * New /tcp-reconnect to kill TCP connections on faulty networks (#3406).
    * Due to the CA store usage default on 0.15, the historical TOFU way of
    managing certs in poezio was broken. There is now a tls_verify_cert option
    that can be set to false if the user wishes so.
    Fixes:
    * Several fixes around carbons (XEP-0280) (#3626, #3627)
    * The roster is now kept until the XMPP session ends (which means on a
    disconnect with smacks (XEP-0198) enabled, the roster is kept until the
    session timeouts) (#3614)
    * Traceback in /affiliations due to slixmpp’s rust JID rewrite
    * Traceback in the /bookmarks tab
    * Infinite syncing of MAM history due to bad paging
    * Saving remote MUC bookmarks no longer force the JID as bookmark name
    * pkg_resources is no longer used.
    * Plenty of deprecationwarnings have been removed.
    * /set option=value would handle the = wrong and display the wrong thing.
    Internal:
    * Plenty of typing updates and fixes
    Removals:
    * Removal of uv as a first-party target for launch/update.sh (no vcware).
    * Removal of remaining origin-id usage.
  - Update to 0.15:
    Features:
    * A new moderate plugin (for XEP-0425 moderation).
    * Better self-ping (through the use of the slixmpp now builtin XEP-0410 plugin).
    * Use the system CA store by default.
    * Add a Ctrl-↑ shortcut to run /correct on the last message.
    * Poezio benefits from the recent slixmpp improvements, which means it can
    now transparently use Direct TLS as well as StartTLS.
    Fixes:
    * Duplicated first message in conversation/private tab.
    * The many "clone" users in a room roster when on a spotty connection.
    * Python 3.13 and 3.14 compatibility (plenty of deprecations and removals).
    * Plenty of type checking mistakes and minor bugs spotted by mypy and pylint.
    Removals:
    * Only python 3.11 and up is supported (was: 3.7).
    * The OTR plugin has been removed.
    * The launch/update.sh have been heavily simplified to use the uv tool
    instead of custom logic. It will be updated in the future to be able to run
    on pipx too, as uv is not available on some platforms.

++++ polkit-default-privs:

  - Update to version 1550+20260616.1f348eb:
    * profiles: added new systemd actions (bsc#1267504)

++++ python-Twisted:

  - add pycryptography-use-csr.patch

++++ python-WebOb:

  - Update to 1.8.10 (fices CVE-2026-44889, bsc#1268324)
    * The fix for CVE-2024-42353 was incomplete: a Location value containing
    ASCII tab, carriage return, or line feed characters between consecutive
    slashes could still be interpreted as a protocol-relative URL by
    ``urllib.parse.urljoin`` on Python 3.10+, allowing an open redirect.
    See https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95

++++ python-aiohttp:

  - Update to 3.14.1 (fixes CVE-2026-50269 (bsc#1268398),
    CVE-2026-54273 (bsc#1268543), CVE-2026-54274 (bsc#1268544),
    CVE-2026-54275 (bsc#1268549), CVE-2026-54276 (bsc#1268552),
    CVE-2026-54277 (bsc#1268556), CVE-2026-54278 (bsc#1268559),
    CVE-2026-54279 (bsc#1268560), CVE-2026-54280 (bsc#1268561))
    * fixed a race condition in :py:class:~aiohttp.TCPConnector where closing the
    connector while a DNS resolution was in-flight could raise
    :py:exc:AttributeError instead of :py:exc:~aiohttp.ClientConnectionError
    * Fixed CancelledError not closing a connection
    * Tightened up some websocket parser checks
    * fixed :class:~aiohttp.CookieJar dropping the host-only flag of cookies
    when persisted with :meth:~aiohttp.CookieJar.save and reloaded with
    :meth:~aiohttp.CookieJar.load, so a cookie set without a Domain attribute
    is again scoped to the exact host that set it after a reload; the absolute
    expiration deadline is now persisted as well, so a reloaded cookie keeps
    its original lifetime instead of being rescheduled from the load time.
    :meth:~aiohttp.CookieJar.load now replaces the jar contents rather than
    merging onto prior state, and loaded cookies pass through the same
    acceptance rules as :meth:~aiohttp.CookieJar.update_cookies, so a cookie
    for an IP-address host is dropped when loaded into a jar created without
    unsafe=True
    * Scoped :class:~aiohttp.DigestAuthMiddleware credentials to the origin of
    the first request it handles, so a redirect to a different origin no longer
    triggers a digest response computed from the configured credentials; a
    challenge from another origin is only answered when that origin falls
    within a protection space advertised by the anchor origin through the RFC
    7616 domain directive
    * Fixed the C HTTP parser not enforcing max_line_size on a request target or
    response reason phrase that is split across multiple reads; each fragment
    was checked on its own, so an accumulated line could exceed the limit
    without raising LineTooLong. The accumulated length is now checked,
    matching the pure-Python parser
    * Changed :class:~aiohttp.TCPConnector to reject legacy non-canonical numeric
    IPv4 host forms such as 2130706433, 017700000001 and 127.1 with
    :exc:~aiohttp.InvalidUrlClientError; only canonical dotted-quad IPv4
    literals are now treated as IP address literals, while every other host is
    sent through the configured resolver
    * Fixed :meth:~aiohttp.StreamReader.readany and
    :meth:~aiohttp.StreamReader.read_nowait joining data fed back into the
    buffer during the call (when draining below the low water mark resumes
    reading) into a single unbounded :class:bytes; a call now returns only the
    chunks that were buffered when it started, keeping the drain of an unread
    auto-decompressed request body bounded by the read buffer
    * Bounded the number of parsed-but-unhandled pipelined HTTP/1 requests
    buffered per connection on the server; once the queue reaches an internal
    limit the parser stops emitting and the transport is paused, resuming as
    the request handler drains the queue, so a client keeping one handler busy
    can no longer accumulate an unbounded backlog of pipelined requests
    * Fixed :meth:aiohttp.web.Response.write_eof skipping Payload.close() when
    the body write was interrupted by an error or cancellation, for example
    when a client disconnects mid-response; the payload close hook now runs in
    a finally so a :class:~aiohttp.payload.Payload body always releases its
    resources
    * Fixed the pure-Python HTTP parser not enforcing max_line_size on a chunk-
    size line when the whole line arrived in a single read; the limit was
    only applied to chunk-size metadata split across reads. The complete-line
    case is now checked too, matching the split-line behavior
    * Included the per-request server_hostname override in the
    :class:~aiohttp.TCPConnector connection pool key, so a pooled TLS
    connection is no longer reused for a request that sets server_hostname to
    a different value

++++ python-asyncssh:

  - Update to 2.23.1
    * Fixed an SCP path traversal issue.
    * Expanded previous fix to block unsafe user substitutions in server config.
    * Fixed default value for reuse_address and reuse_port, matching the
    behavior of asyncio.create_server().
  - Update to 2.23.0 (fixes CVE-2026-45309, bsc#1268333)
    * Added support for "Match localnetwork".
    * Enabled support for RSA with SHA-2 signatures in ssh-agent and Pageant.
    * Changed MAC algorithm negotation to be skipped when using AEAD ciphers.
    * Improved graceful termination when using ProxyCommand, waiting for the
    ProxyCommand tunnel to close when cleaning up a connection.
    * Blocked unsafe user substitutions from being used in server config.
    * Fixed an issue with config evaluation when "Match final" was combined
    with Hostname directives.
    * Fixed a resource leak in xauth support.
    * Fixed issue with multi-hop ProxyJump directives in a config file not
    working correctly.
    * Fixed string encoding in SFTPName objects returned by realpath().

++++ python-certifi:

  - Modify python-certifi-shipped-requests-cabundle.patch so that
    certifi.where() returns file path of CA Bundle only when it
    actually exists, otherwise return None, which should make
    ctx = ssl.create_default_context(cafile=certifi.where())
    work with the system defaults.

++++ python-fastapi:

  - Update to 0.137.1:
    [#]# Breaking Changes
    * Refactor internals to preserve APIRouter and APIRoute instances.
    [#]# Fixes
    * Fix typing checks for APIRoute.
    * Fix bug, allow empty path in path operation in prefixless router.

++++ python-google-adk:

  - Update from 1.29.0 to 2.2.0
  - ADK 2.0 General Availability: Production-grade foundations for
    multi-agent workflows and advanced dynamic agent collaboration
  - BREAKING CHANGES:
    * LlmAgent default model changed from gemini-2.5-flash to
    gemini-3-flash-preview (set model="gemini-2.5-flash" explicitly
    to retain prior behavior)
    * GenAI SDK v2.0.0 renames turn-based helpers in interactions_utils.py
    (e.g., convert_contents_to_turns → convert_contents_to_steps)
    * ADK 2.0 sessions generated are readable by ADK 1.28+ but
    incompatible with older 1.x versions
  - New Features in v2.x:
    * Multi-Agent Workflow Engine with flexible execution graphs
    * Native Inter-Agent Routing and dynamic agent collaboration
    * AutoTracingPlugin for OpenTelemetry auto-instrumentation
    * RubricBasedMultiTurnTrajectoryEvaluator
    * BigQuery Agent Analytics reliability fixes
    * Native OTel gen_ai.client metrics
    * Support for Anthropic's thinking blocks
    * Vertex AI Agent Engine Sandbox integration for computer use
    * Live avatar functionality and Gemini Live API support
  - New Features in v1.30-1.35:
    * Support for Gemma 4 models
    * BigQuery tools promoted to Stable status
    * Parameter Manager and Artifact Service integration
    * Firestore support
    * New Live UI with redesigned real-time chat interface
    * Session display names for better organization
    * New Graph View for visualizing agent architectures
    * Computer Use View for screenshots and logs
  - Security Fixes:
    * Fixed credential leakage vulnerability in Agent Registry
    * Validated user_id and session_id against path traversal
    * Fixed SSRF and local-file access in load_web_page
    * Block RCE vulnerability via nested YAML configurations
    * Block path traversal in Agent Builder file tools
    * Fix path traversal in GCS skill extraction (Zip Slip)
    * Bumped starlette and fastapi to address CVE-2026-48710
  - Bug Fixes:
    * Resolved 1007 error and support Gemini 3.1 Flash Live protocol
    * Prevent grounding metadata loss in Gemini 3.1
    * Fix bug where grounding metadata in Gemini 3.1 live was silently discarded
    * Prevent initialization hangs and task group leaks (MCP)
    * Preserve function call IDs for Anthropic models
    * Support generalized history config injection for Gemini 3.1 Live
    * Fixed input and output transcription finished events for Gemini v3.1

++++ python-httpcore2:

  - Update to 2.4.0:
    * Move HTTP/2 stream events cleanup inside _state_lock.
    * Release the HTTP/2 semaphore permit on NoAvailableStreamIDError.
    * Use RLock instead of Lock to prevent a thread deadlock.
    * Use truststore instead of certifi for default SSL verification, loading
    the operating system's trust store.
    * Rewrite _assign_requests_to_connections as a single-pass loop.
    * Use anyio's fast_acquire for Lock and Semaphore.
    * Use memoryview in write() to avoid copies.

++++ python-httpx2:

  - Update to 2.4.0:
    [#]# Added
    * Add HTTPXDeprecationWarning, a UserWarning subclass shown by default so
    deprecations are visible without enabling warnings.
    [#]# Changed
    * Limit the number of chained Content-Encoding decoders to 5.
    * Allow version 15 of rich in the cli extra.
    * Use truststore instead of certifi for default SSL verification, loading
    the operating system's trust store.
    [#]# Fixed
    * Parse an empty Digest auth realm without crashing.
    * Decode IDNA labels in non-leading host positions.
    * Raise when verify is a string path and a client-side cert is also
    provided to create_ssl_context.
    * Allow a default_encoding callable to return None.
    * Make the zstd import optional on Python 3.14.
    * Store elapsed time on the stream wrapper to avoid reference cycles.
  - Drop patches, merged upstream:
    * version-fallback.patch
    * fix-encoding-tests.patch

++++ python-jsonschema-path:

  - update to 0.5.0
    * Resolved cache enabled and SchemaPath per-instance cache removed #259
    * Resolved cache evolution rebind #260
    * Per-accessor identity #262
    * Resolved cache is enabled by default #259
    * SchemaPath per-accessor __eq__/__hash__ #262

++++ python-litellm:

  - Update to version 1.89.1:
    * Major feature additions, security hardening, and performance improvements since version 1.80.5:
    * Claude Fable 5 Support: Day-0 integration across Anthropic, Bedrock, Azure AI, and Vertex AI with 1M context, adaptive thinking, and computer use.
    * New Agent Providers: Added watsonx Orchestrate and LangFlow with session bridging, and OAuth M2M support for Databricks Apps agents.
    * MCP Gateway: Added per-server environment variables, RPM rate limiting with OAuth passthrough, and issuer-scoped JWT authentication.
    * Router-level Failover: New weighted-routing failover flag to retry the same model group across different deployments.
    * OTel Observability: Server spans now include standard attributes (http.response.status_code, http.route, url.path).
    * Native Web-Search Citations: Emits web_search_tool_result blocks for Anthropic clients.
    * Componentized Deployments: Added Helm charts to split proxy into independent gateway, backend, and UI services.
    * Secure CI/CD: Transitioned to a new CI/CD v2 pipeline with isolated build environments following supply chain hardening.
    * Standardized Versioning: Transitioned to standard SemVer 2.0 / PEP 440 compliant versioning scheme.
    * Budget and Cache Hardening: Added Redis IAM token caching and multi-pod spend tracking accuracy.
    * New LLM Providers: Added support for Nebius AI, FLUX Kontext, Cerebras, Bedrock Writer models, Voyage rerank, DeepSeek-V3, and Gemini 1.5 Flash.

++++ python-opentelemetry-api:

  - update to 1.42.1:
    * Preserve the random trace ID flag when creating child spans
    instead of always setting the random trace id bit depending on
    the available trace id generator. (#5241)
  - update to 1.42.0:
    * opentelemetry-api, opentelemetry-sdk: add support
    for 'random-trace-id' flags in W3C traceparent
    header trace flags. Implementations of IdGenerator
    that do randomly generate the 56 least significant
    bits, should also implement a is_trace_id_random
    methods that returns True. (#4854)
    * logs: add exception support to Logger emit and
    LogRecord attributes (#4908)
    * opentelemetry-exporter-otlp-proto-grpc: make
    retryable gRPC error codes configurable for gRPC
    exporters (#4917)
    * opentelemetry-sdk: Add create_logger_provider/
    configure_logger_provider to declarative file
    configuration, enabling LoggerProvider instantiation
    from config files without reading env vars (#4990)
    * opentelemetry-exporter-otlp-json-common: add
    'opentelemetry-exporter-otlp-json-common' package
    for OTLP JSON exporters (#4996)
    * opentelemetry-sdk: Add service resource detector
    support to declarative file configuration via
    detection_development.detectors[].service (#5003)
    * opentelemetry-docker-tests: add docker-tests
    coverage of opentelemetry-exporter-otlp-proto-grpc
    and opentelemetry-exporter-otlp-proto-http metrics
    export (#5030)
    * Add registry keyword argument to PrometheusMetricReader
    to allow passing a custom Prometheus registry (#5055)
    * Add WeaverLiveCheck test util (#5088)
    * opentelemetry-sdk: add load_entry_point shared
    utility to declarative file configuration for loading
    plugins via entry points; refactor propagator loading
    to use it (#5093)
    * opentelemetry-sdk: add sampler plugin loading to
    declarative file configuration via the
    opentelemetry_sampler entry point group, matching
    the spec's PluginComponentProvider mechanism (#5095)
    * opentelemetry-sdk: add propagator plugin loading to
    declarative file configuration via the
    opentelemetry_propagator entry point group, matching
    the spec's PluginComponentProvider mechanism (#5098)
    * opentelemetry-sdk: add exporter plugin loading to
    declarative file configuration for all three signals
    (traces, metrics, logs) via the opentelemetry_*_exporter
    entry point groups, matching the spec's
    PluginComponentProvider mechanism (#5128)
    * opentelemetry-sdk: add generic resource detector
    plugin loading to declarative file configuration via
    the opentelemetry_resource_detector entry point
    group, matching the spec's PluginComponentProvider
    mechanism (#5129)
    * opentelemetry-sdk: add additional_properties support
    to generated config models via custom datamodel-codegen
    template, enabling plugin/custom component names to
    flow through typed dataclasses (#5131)
    * Add ability to selectively enable exporting of SDK
    internal metrics with the
    OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED environment
    variable. (#5151)
    * opentelemetry-semantic-conventions: use X | Y union
    annotation (#5096)
    * opentelemetry-api: update EnvironmentGetter and
    EnvironmentSetter to use normalized environment
    variable names (#5119)
    * Apply fixes for UP ruff rule (#5133)
    * opentelemetry-sdk: only load entrypoints for resource
    detectors if they are configured via
    OTEL_EXPERIMENTAL_RESOURCE_DETECTORS (#5145)
    * ci: wait for tracecontext server readiness instead
    of a fixed sleep in
    scripts/tracecontext-integration-test.sh (#5149)
    * Switch to SPDX license headers and add CI
    enforcement (#5177)
    * opentelemetry-semantic-conventions: Bump semantic
    conventions to 1.41.1, this changes the metrics
    name of K8S_CONTAINER_CPU_LIMIT_UTILIZATION and
    K8S_CONTAINER_CPU_REQUEST_UTILIZATION. (#5200)
    * opentelemetry-api: remove third-party
    importlib-metadata in favor of standard library
    since Python >= 3.10 is now required (#3234)
    Drop Python 3.9 support (#5076)
    * opentelemetry-sdk: Allow declarative OTLP HTTP
    exporters to map compression: deflate instead of
    rejecting it as unsupported. (#5075)
    * Fix incorrect code example in create_tracer()
    docstring (#5077)
    * opentelemetry-sdk: Fix ProcessResourceDetector to
    use sys.orig_argv so that process.command,
    process.command_line, and process.command_args reflect
    the original invocation for python -m <module> runs
    (where sys.argv[0] is rewritten to the module path)
    (#508)

++++ python-slixmpp:

  - Update to 1.16.0:
    Breaking changes:
    * The get_certs method on XEP_0257 is now an async function, which breaks compatibility with previous usages.
    New plugins:
    * Stickers (XEP-0449).
    * MUC Affiliation Versioning (XEP-0463).
    Other improvements:
    * MUC (XEP-0045) and PubSub (XEP-0060): items can now be retreived as a
    collection on the parent element using the items interface.
    Fixes:
    * Crash when receiving presences with invalid JIDs (as a component).
    * Wrong plugin description for Mentions (XEP-0513).
    * Added a missing variable in the RPC (XEP-0009) plugin, which caused a specific error handling path to always be false.
    Internal / process:
    * Fill the __all__ sections for XEP plugins, for nicer library use and less linter warnings.
    * Plenty of automated fixes (extra empty lines, ; characters, unused imports…, newlines at file ends…).
    * More type hints.
    * Enabled use of prek, and toggled harsher linting in CI.
    * Explicit section in CONTRIBUTING about LLM use.
    * The XEP-0257 plugin now has more tests and docs.
    * XEP-0045 are now typed as floats and not ints.
  - Update to 1.15.0:
    Features:
    * New plugin: XEP-0513 (Explicit Mentions)
    * In XEP-0424, the message sent for the retraction is now returned after being sent.
    Fixes:
    * The XEP-0045 plugin will now raise exceptions if the wrong parameters are
    provided (e.g. specifying a "pfrom" when not running as a component).
    * Passing the iterator parameter to get_items() in XEP-0030 was broken.
    Build:
    * The rust build is now optional

++++ python-starlette:

  - Update to 1.3.1 (fixes CVE-2026-54282, bsc#1268520, CVE-2026-54283, bsc#1268517):
    * Use StarletteDeprecationWarning instead of DeprecationWarning
    * Enforce max_fields and max_part_size in FormParser
    * Enforce FormParser limits in parser callbacks
    * Clamp oversized suffix ranges in FileResponse
    * Catch OSError alongside MultiPartException when closing temp files
    * Add httpx2 to the full extra
    * Adjust testclient typing and warnings
    * Fix IndexError in URL.replace() on a URL with no authority
    * Annotate URLPath protocol parameter with Literal
    * avoid collapsing exception groups from user code
    * Use removeprefix to strip weak ETag indicator in is_not_modified
    * Build request.url from structured components

++++ python-urllib3:

  - skip some tests with pycryptography >= 49

++++ python-urllib3_1:

  - skip more testcases with warnings for cryptography >= 49

++++ python314:

  - Update to 3.14.6:
  - Security
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error. (bsc#1267974, CVE-2026-9669)
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report (bsc#1265268, CVE-2026-8328).
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter (bsc#1267821, CVE-2026-7774).
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in:
  - code compilation - _winapi.CreateProcess()
  - Now these places raise proper MemoryError errors.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of elements “xmp”, “iframe”, “noembed”, “noframes”,
    and “plaintext” is no longer escaped. The “plaintext”
    element no longer have the closing tag.
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-90949: Add
    SetBillionLaughsAttackProtectionActivationThreshold() and
    SetBillionLaughsAttackProtectionMaximumAmplification() to
    xmlparser objects to tune protections against billion
    laughs attacks. Patch by Bénédikt Tran.
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - Documentation
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Refreshed patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch
  - CVE-2024-6923-follow-up-EOL-email-headers.patch
  - CVE-2025-12781-b64decode-alt-chars.patch
  - CVE-2025-15366-imap-ctrl-chars.patch
  - gh139257-Support-docutils-0.22.patch
  - test_UDPLITE_support.patch

++++ python314-documentation:

  - Update to 3.14.6:
  - Security
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error. (bsc#1267974, CVE-2026-9669)
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report (bsc#1265268, CVE-2026-8328).
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter (bsc#1267821, CVE-2026-7774).
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in:
  - code compilation - _winapi.CreateProcess()
  - Now these places raise proper MemoryError errors.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of elements “xmp”, “iframe”, “noembed”, “noframes”,
    and “plaintext” is no longer escaped. The “plaintext”
    element no longer have the closing tag.
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-90949: Add
    SetBillionLaughsAttackProtectionActivationThreshold() and
    SetBillionLaughsAttackProtectionMaximumAmplification() to
    xmlparser objects to tune protections against billion
    laughs attacks. Patch by Bénédikt Tran.
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - Documentation
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Refreshed patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch
  - CVE-2024-6923-follow-up-EOL-email-headers.patch
  - CVE-2025-12781-b64decode-alt-chars.patch
  - CVE-2025-15366-imap-ctrl-chars.patch
  - gh139257-Support-docutils-0.22.patch
  - test_UDPLITE_support.patch

++++ python314-nogil:

  - Update to 3.14.6:
  - Security
  - gh-151159: Update Android and iOS installers to use OpenSSL
    3.5.7.
  - gh-150599: Fix a possible stack buffer overflow in bz2 when
    a bz2.BZ2Decompressor is reused after a decompression
    error. The decompressor now becomes unusable after libbz2
    reports an error. (bsc#1267974, CVE-2026-9669)
  - gh-149835: shutil.move() now resolves symlinks via
    os.path.realpath() when checking whether the destination is
    inside the source directory, preventing a symlink-based
    bypass of that guard.
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report (bsc#1265268, CVE-2026-8328).
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter (bsc#1267821, CVE-2026-7774).
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-151112: Fix a crash in the compiler that could occur
    when running out of memory.
  - gh-151126: Fix a crash, when there’s no memory left on
    a device, which happened in:
  - code compilation - _winapi.CreateProcess()
  - Now these places raise proper MemoryError errors.
  - gh-150700: Fix a SystemError when compiling a class-scope
    comprehension containing a lambda that references
    __class__, __classdict__, or __conditional_annotations__.
    Patch by Bartosz Sławecki.
  - gh-150633: Fix the frozen importer accepting module names
    with embedded null bytes, which caused it to bypass the
    sys.modules cache and create duplicate module objects.
  - gh-148613: Fix a data race in the free-threaded build
    between gc.set_threshold() and garbage collection
    scheduling during object allocation.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150207: Fix a crash when a memory allocation fails
    during tokenizer initialization. A proper MemoryError is
    now raised instead.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149805: Fix a SystemError when compiling a compiling
    __classdict__ class annotation. Found by OSS-Fuzz in
    [#512907042].
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-151039: Fix a crash when static datetime types outlive
    the _datetime module.
  - gh-150913: Fix sqlite3.Blob slice assignment to raise
    TypeError and IndexError for type and size mismatches
    respectively, even when the target slice is empty.
  - gh-143008: Fix race conditions when re-initializing
    a io.TextIOWrapper object.
  - gh-150750: Fix a race condition in
    collections.deque.index() with free-threading.
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149816: Fix race condition in
    ssl.SSLContext.sni_callback
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of elements “xmp”, “iframe”, “noembed”, “noframes”,
    and “plaintext” is no longer escaped. The “plaintext”
    element no longer have the closing tag.
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148954: Fix XML injection vulnerability in
    xmlrpc.client.dumps() where the methodname was not being
    escaped before interpolation into the XML body.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-90949: Add
    SetBillionLaughsAttackProtectionActivationThreshold() and
    SetBillionLaughsAttackProtectionMaximumAmplification() to
    xmlparser objects to tune protections against billion
    laughs attacks. Patch by Bénédikt Tran.
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-91099: imaplib.IMAP4.login() now raises exceptions with
    str instead of bytes. Patch by Florian Best.
  - Documentation
  - gh-150319: Generic builtin and standard library types now
    document the meaning of their type parameters.
  - gh-109503: Fix documentation for shutil.move() on usage of
    os.rename() since nonatomic move might be used even if the
    files are on the same filesystem. Patch by Fang Li
  - Tests
  - gh-151130: Add more tests for PyWeakref_* C API.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - IDLE
  - bpo-6699: Warn the user if a file will be overwritten when
    saving.
  - C API
  - gh-150907: Fix dynamic_annotations.h header file when built
    with C++ and Valgrind: add extern "C++" scope for the C++
    template. Patch by Victor Stinner.
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Refreshed patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch
  - CVE-2024-6923-follow-up-EOL-email-headers.patch
  - CVE-2025-12781-b64decode-alt-chars.patch
  - CVE-2025-15366-imap-ctrl-chars.patch
  - gh139257-Support-docutils-0.22.patch
  - test_UDPLITE_support.patch

++++ python315:

  - Update to 3.15.0~b2
  - Security
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report. (bsc#1265268, CVE-2026-8328)
  - gh-149474: Fix the binary writer in profiling.sampling not
    firing the audit (PEP 578) when creating the output file.
    The writer and the reader now accept any path-like object.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter. (bsc#1267821, CVE-2026-7774)
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs. (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-150374: Fix double release of the import lock on lazy
    import reification errors.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-148587: sys.lazy_modules is now a set instead of a dict
    as initially spelled out in PEP 810.
  - gh-150042: Fix refleak in queue.SimpleQueue.put if memory
    allocation fails.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149807: Fix hash(frozendict): compute the hash of each
    (key, value) pair correctly. Patch by Victor Stinner.
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-149676: Fix frozendict | frozendict hash.
  - gh-148829: sentinel objects now support a repr= argument
    and their __module__ attribute is writable.
  - gh-149642: Allow imports inside exec() calls within
    functions under PYTHON_LAZY_IMPORTS=all.
  - gh-144957: Fix lazy from imports of module attributes
    provided by module-level __getattr__.
  - gh-149459: Fix a crash in the JIT optimizer when
    a specialized LOAD_SPECIAL guard deoptimized after
    inserting the synthetic NULL stack entry.
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150228: The new site.StartupState class lets callers
    batch-process PEP 829 startup configuration files across
    multiple site directories before any startup code runs,
    with public addsitedir(), addusersitepackages(),
    addsitepackages(), and process() methods. The signature of
    site.addsitedir() is unchanged from Python 3.14. The
    defer_processing_start_files argument and the
    process_startup_files() function added earlier in the 3.15
    cycle have been removed; use site.StartupState instead.
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149189: Revert the changes to pprint defaults. Patch by
    Hugo van Kemenade.
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-142349: Add lazy to the list of support topic by help().
  - gh-149819: Fix regression in site.addsitedir() where .pth
    files were no longer processed in Python subprocesses. This
    happened because site.main() seeded known_paths with
    entries inherited from the parent process, causing
    addsitedir to skip .pth processing.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149718: Coalesce consecutive identical stack frames in
    Tachyon, so aggregating collectors (pstats, collapsed,
    flamegraph, gecko) receive one collect. Improves sample
    rate 3x, error rate and missed rate drop by 70%. Patch by
    Maurycy Pawłowski-Wieroński.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-149504: Fix site.addsitedir() to allow re-entrant calls
    from within startup files. Previously, a .pth file
    containing an import line that called site.addsitedir() (or
    a .start entry point doing the same) could crash with
    RuntimeError: dictionary changed size during iteration
    during site initialization, breaking tools such as uv run
  - -with.
  - gh-149584: Fix excessive overhead in the Tachyon profiler
    when inspecting a remote process by avoiding repeated
    remote page-cache scans, batching predicted remote reads,
    and reusing cached profiler result objects. Patch by Pablo
    Galindo and Maurycy Pawłowski-Wieroński.
  - gh-139489: Add xml.is_valid_text() to xml.__all__.
  - gh-149614: Fix a regression that broke the ability to
    deepcopy argparse.ArgumentParser instances.
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149534: Fix merging of collections.defaultdict and
    frozendict.
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of comments, processing instructions and elements
    “xmp”, “iframe”, “noembed”, “noframes”, and “plaintext” is
    no longer escaped. The “plaintext” element no longer have
    the closing tag. Add support of empty attributes (with
    value None).
  - gh-149056: Fix json.load() not forwarding the array_hook
    argument to json.loads(). Patch by Thomas Kowalski.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-86533: The os.makedirs() function and
    pathlib.Path.mkdir() method now have a parent_mode
    parameter to specify the mode for intermediate directories
    when creating parent directories. This allows one to match
    the behavior from Python 3.6 and earlier for os.makedirs().
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-133998: Fix struct.error exception when creating a file
    with gzip.GzipFile or compressing data with gzip.compress()
    if the system time is outside the range 00:00:00 UTC,
    January 1, 1970 through 06:28:15 UTC, February 7, 2106, or
    explicitly passed mtime argument is outside the range 0 to
    2**32-1.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-121109: Fix tarfile performance issue when reading
    archives in streaming mode (e.g. r|*).
  - bpo-45509: Gzip headers are now checked for corrupted NAME,
    COMMENT and HCRC fields.
  - Tests
  - gh-150387: Fix hang in
    test.test_profiling.test_sampling_profiler.test_live_collector_ui.TestLiveModeErrors.test_run_failed_script_live
    on slow buildbots. The test now always queues a final
    q keystroke so the live TUI loop exits even when the
    profiler collects enough samples to enter the post-finished
    input loop.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - gh-148260: On Linux when Python is linked to the musl
    C library, use a thread stack size of at least 1 MiB
    instead of musl default which is 128 kiB. Patch by Victor
    Stinner.
  - Tools/Demos
  - gh-150258: Update the tooltip on the Tachyon flame graph to
    show both absolute and relative percentages.
  - C API
  - gh-149725: Add PySentinel_CheckExact() for exact sentinel
    type tests to accompany the existing PySentinel_Check().
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Update to 3.15.0~b1:
  - Security
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.5.6.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-148252: Fixed string table and sample record bounds
    checks in _remote_debugging when decoding certain .pyb
    inputs on 32-bit builds. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping. (bsc#1262654,
    CVE-2026-6019)
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098,
    CVE-2026-6100).
  - gh-148252: Fixed stack depth calculation in
    _remote_debugging when decoding certain .pyb inputs on
    32-bit builds. Issue originally identified and diagnosed by
    Tristan Madani (@TristanInSec on GitHub).
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts.
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-137586: Fix a PATH-injection vulnerability in webbrowser
    on macOS where osascript was invoked without an absolute
    path. The new MacOS class uses /usr/bin/open directly,
    eliminating the dependency on osascript entirely.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method.
    (bsc#1261969, CVE-2026-1502)
  - Core and Builtins
  - gh-148940: Revert the process size based deferral of
    garbage collection (gh-133464). The performance issue this
    change resolves is also fixed by gh-142562. This approach
    has the problem that process size as seen by the OS (e.g.
    the resident size or RSS) does not immediately decrease
    after cyclic garbage is freed since mimalloc defers
    returning memory of the OS. This change applies to the
    free-threaded GC only.
  - gh-149243: Check for recursion limits in
    CALL_ALLOC_AND_ENTER_INIT opcode.
  - gh-126910: Add support for unwinding JIT frames using GNU
    backtrace. Patch by Diego Russo and Pablo Galindo
  - gh-149171: Allow assignment to the __module__ attribute of
    typing.TypeAliasType instances.
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-149049: Fix stack underflow for BINARY_OP in tier 2.
  - gh-83065: Fix a deadlock that could occur when one thread
    is importing a submodule (for example import pkg.sub.mod)
    while another thread is importing one of its parent
    packages (for example import pkg.sub) and that parent’s
    __init__.py itself imports the submodule. The import system
    now acquires module locks in hierarchical
    (parent-before-child) order so the two threads serialise
    instead of raising _DeadlockError.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148850: Fix the memory sanitizer false positive in
    os.getrandom().
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148829: Add sentinel, implementing PEP 661. PEP by Tal
    Einat; patch by Jelle Zijlstra.
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-148766: The interpreter help (such as python --help) is
    now in color. Patch by Hugo van Kemenade.
  - gh-148571: Fix a crash in the JIT optimizer when
    specialized opcode families inherited incompatible recorded
    operand layouts.
  - gh-148653: Forbid marshalling recursive code objects, slice
    and frozendict objects which cannot be correctly
    unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.15 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-146462: Added PyTypeObject.tp_basicsize,
    PyTypeObject.tp_dictoffset, and
    PyHeapTypeObject.ht_cached_keys offsets to _Py_DebugOffsets
    to support version-independent read-only dict introspection
    tools.
  - gh-145239: Unary plus is now accepted in match literal
    patterns, mirroring the existing support for unary minus.
    Patch by Bartosz Sławecki.
  - gh-148515: Fix a bug in the JIT optimizer reading operands
    for uops with multiple caches.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148398: Fix a bug in the JIT optimizer where class
    attribute loads were not invalidated after type mutation.
  - gh-146527: Add a GCMonitor class with a get_gc_stats method
    to the _remote_debugging module to allow reading GC
    statistics from an external Python process without
    requiring the full RemoteUnwinder functionality. Patch by
    Sergey Miryanov and Pablo Galindo.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-115802: Improve JIT code generation on Linux AArch64 by
    reducing the indirect call to external symbols. Patch by
    Diego Russo.
  - gh-148189: Repaired undercount of bytes in type-specific
    free lists reported by sys._debugmallocstats(). For types
    that participate in cyclic garbage collection, it was
    missing two pointers used by GC.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-95004: The specializing interpreter now specializes for
    enum.Enum improving performance and scaling in
    free-threading. Patch by Kumar Aditya.
  - gh-149202: Enable frame pointers by default for
    GCC-compatible CPython builds, including
  - mno-omit-leaf-frame-pointer, -marm on 32-bit ARM, and/or
  - mbackchain on s390x platforms when the compiler supports
    them, so profilers and debuggers can unwind native
    interpreter frames more reliably. Users can pass
  - -without-frame-pointers to ./configure to opt out.
  - gh-148014: Accept a function name in -X presite command
    line option and PYTHON_PRESITE environment variable. Patch
    by Victor Stinner.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - gh-146306: Specialize float true division in the tier
    2 optimizer with inplace mutation for uniquely-referenced
    operands.
  - gh-142186: Global sys.monitoring events can now be turned
    on and disabled on a per code object basis. Returning
    DISABLE from a callback disables the event for the entire
    code object (for the current tool).
  - gh-126910: Add support for unwinding JIT frames using GDB.
    Patch by Diego Russo and Pablo Galindo.
  - gh-146031: The unstable API
    _PyInterpreterState_SetEvalFrameFunc has a companion
    function
    _PyInterpreterState_SetEvalFrameAllowSpecialization to
    specify if specialization should be allowed. When this
    option is set to 1 the specializer will turn Python ->
    Python calls into specialized opcodes which the replacement
    interpreter loop can choose to respect and perform inlined
    dispatch.
  - gh-145278: The encodings is now partially frozen, including
    the aliases and utf_8 submodules.
  - The linecache is now frozen.
  - gh-134584: Optimize and eliminate redundant ref-counting
    for MAKE_FUNCTION in the JIT.
  - gh-143886: Reorder function annotations so positional-only
    arguments are returned before other arguments. This fixes
    how functools.singledispatch() registers functions with
    positional-only arguments.
  - gh-98894: Restore function__entry and function__return
    DTrace/SystemTap probes that were broken since Python 3.11.
  - gh-116021: Support for creating instances of abstract AST
    nodes from the ast module is deprecated and scheduled for
    removal in Python 3.20. Patch by Brian Schubert.
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-137600: ast: The constructors of AST nodes now raise
    a TypeError when a required argument is omitted or when
    a keyword argument that does not map to a field on the AST
    node is passed. These cases had previously raised
    a DeprecationWarning since Python 3.13. Patch by Brian
    Schubert.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-135357: Add support for socket.SO_PASSRIGHTS on Linux.
  - gh-134690: Removed deprecated in PEP 626 since Python 3.12
    codeobject.co_lnotab from types.CodeType.
  - gh-100239: Specialize BINARY_OP for concatenation of lists
    and tuples, and propagate the result type through
    _BINARY_OP_EXTEND in the tier 2 optimizer so that follow-up
    type guards can be eliminated.
  - Library
  - gh-148823: Defer the import of _colorize in argparse until
    needed for coloring output.
  - gh-141560: Add an annotation_format parameter to
    inspect.getfullargspec().
  - gh-139489: Add the xml.is_valid_text() function, which
    allows to check whether a string can be used in the XML
    document.
  - gh-142389: Add backticks to stdlib argparse help to display
    in colour. Patch by Hugo van Kemenade.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-142389: Add backtick markup support in argparse option
    help text to highlight inline code when color output is
    enabled. Patch by Hugo van Kemenade.
  - gh-148675: Remove F and D formats from array and
    memoryview. Patch by Victor Stinner.
  - gh-149342: Fix _remote_debugging binary writing so that
    sampling a thread whose Python frame stack is empty (for
    example while it is in a C call or mid-syscall) no longer
    raises RuntimeError("Invalid stack encoding type"), and so
    that BinaryWriter.total_samples after finalize() or
    context-manager exit includes samples flushed from the RLE
    buffer. Patch by Maurycy Pawłowski-Wieroński.
  - gh-149010: The inspect module CLI now reports as much
    information as it has available for non-source modules when
  - -details is specified, and provides an error message
    rather than a traceback when --details is omitted. It also
    reports improved information when the given target location
    is not the target’s defining location and when the given
    target is a data value rather than a class or function
    definition.
  - gh-146609: Use argparse for colour help timeit CLI. Patch
    by Hugo van Kemenade.
  - gh-142389: Add backticks for colour to regrtest and pdb’s
    help description. Patch by Hugo van Kemenade.
  - gh-144384: Lazily import _colorize. Patch by Hugo van
    Kemenade.
  - gh-149321: Fix import cycles exposed by running standard
    library modules with -X lazy_imports=none.
  - gh-145378: Generate consistent colors for pdb commands in
    pdb REPL.
  - gh-149296: Add a dump subcommand to profiling.sampling that
    prints a single traceback-style snapshot of a running
    process’s Python stack, including per-thread status, source
    line highlighting, optional bytecode opcode names, and
    async-aware task reconstruction. Patch by Pablo Galindo.
  - gh-143231: A module attribute has been added to
    warnings.WarningMessage.
  - gh-148675: ctypes: Change the _type_ of c_float_complex,
    c_double_complex and c_longdouble_complex from F, D and
    G to Zf, Zd and Zg for compatibility with numpy. Patch by
    Victor Stinner.
  - gh-148675: The array.typecodes type changed from str to
    tuple to support type codes longer than 1 character (Zf and
    Zd). Patch by Victor Stinner.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-143231: unittest.TestCase.assertWarns() and
    unittest.TestCase.assertWarnsRegex() no longer swallow
    warnings that do not match the specified category or regex.
    Nested context managers are now supported.
  - gh-149214: Fix _remote_debugging misreading non-ASCII
    Unicode strings (Latin-1, BMP and non-BMP) from a remote
    process. Filenames and function names that contain
    non-ASCII characters are now reported correctly in stack
    traces, the sampling profiler, and asyncio task
    introspection.
  - gh-149189: pprint now uses modern defaults: indent=4 and
    width=88, and the default compact=False output is now
    formatted similar to pretty-printed json.dumps(), with
    opening parentheses and brackets followed by a newline and
    the contents indented by one level. The expand parameter,
    added in 3.15.0a8, has been removed; compact=False (the
    default) now produces the former expand=True layout. Patch
    by Hugo van Kemenade.
  - gh-149173: Fix inverted PYTHON_BASIC_REPL environment check
    in pdb._pyrepl_available.
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-149009: Validate that profiling.sampling binary profiles
    do not contain more unique (thread, interpreter) pairs than
    declared in the header. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-148292: ssl: Update ssl.SSLSocket and ssl.SSLObject for
    OpenSSL 4. The classes now remember if they get
    a ssl.SSLEOFError. In this case, following read(),
    sendfile(), write(), and do_handshake() calls raise
    ssl.SSLEOFError without calling the underlying OpenSSL
    function. Thanks to that, ssl.SSLSocket behaves the same on
    all OpenSSL versions on EOF. Patch by Victor Stinner.
  - gh-149085: Add a max_threads keyword argument to
    faulthandler.dump_traceback(),
    faulthandler.dump_traceback_later(), faulthandler.enable(),
    and faulthandler.register().
  - gh-148641: pkgutil.resolve_name() gets a new optional,
    keyword-only argument called strict. The default is False
    for backward compatibility.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-149083: dataclasses.MISSING and dataclasses.KW_ONLY are
    now instances of sentinel.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-149026: Add colour to pickletools CLI output. Patch by
    Hugo van Kemenade.
  - gh-148991: Add colour to tokenize CLI output. Patch by Hugo
    van Kemenade.
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148981: Add color parameter to ast.dump().
  - gh-148849: Deprecate http.cookies.Morsel.js_output() and
    http.cookies.BaseCookie.js_output(), which will be removed
    in Python 3.19. Use http.cookies.Morsel.output() or
    http.cookies.BaseCookie.output() instead.
  - gh-146311: Add a canonical keyword-only parameter to the
    base16, base32, base64, base85, ascii85, and Z85 decoders
    in base64 and binascii. When true, encodings with non-zero
    padding bits (base16/32/64) or non-canonical encodings
    (base85/ascii85) are rejected. Single-character final
    groups in binascii.a2b_ascii85() and binascii.a2b_base85()
    are now always rejected as encoding violations, regardless
    of canonical; previously they were silently ignored and
    produced no output bytes.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-124397: The threading module added tooling to support
    concurrent iterator access: threading.serialize_iterator,
    threading.synchronized_iterator(), and
    threading.concurrent_tee().
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148688: bz2, compression.zstd, lzma, zlib: Fix a double
    free on memory allocation failure. Patch by Victor Stinner.
  - gh-148675: array, struct: Add support for Zd and Zf formats
    for double complex and float complex. Patch by Victor
    Stinner.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-148641: PEP 829 (package startup configuration files)
    implements a new format <name>.start parallel to <name>.pth
    files, to replace import lines in the latter.
  - gh-148639: Implement PEP 800, adding the
    @typing.disjoint_base decorator. Patch by Jelle Zijlstra.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148599: Update the socket module’s WSA error messages to
    match official documentation.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-144881: asyncio debugging tools (python -m asyncio ps
    and pstree) now retry automatically on transient errors
    that can occur when attaching to a process under active
    thread delegation. The number of retries can be controlled
    with the --retries flag. Patch by Bartosz Sławecki.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-121190: importlib.resources.files() now emits a more
    meaningful error message when module spec is None (as found
    in some __main__ modules).
  - gh-127012: importlib.abc.Traversable.read_text now
    allows/solicits an errors parameter.
  - gh-137855: Improve import time of dataclasses module by
    lazy importing re and copy modules.
  - gh-148352: Add more color to calendar’s CLI output. Patch
    by Hugo van Kemenade.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-130472: Integrate fancycompleter with import
    completions.
  - gh-148241: json: Fix serialization: no longer call str(obj)
    on str subclasses. Patch by Victor Stinner.
  - gh-148225: The profiling.sampling replay command now
    rejects non-binary profile files with a clear error
    explaining that replay only accepts files created with
  - -binary.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-148207: typing.TypeVarTuple now accepts bound,
    covariant, contravariant, and infer_variance parameters,
    matching the interface of typing.TypeVar and
    typing.ParamSpec.
  - gh-148100: Soft deprecate re.match() and re.Pattern.match()
    in favour of re.prefixmatch() and re.Pattern.prefixmatch().
    Patch by Hugo van Kemenade.
  - gh-147991: Improve tomllib import time (up to 10x faster).
    Patch by Victor Stinner.
  - gh-147957: Guarantees that collections.UserDict.popitem()
    will pop in the same order as the wrapped dictionary rather
    than an arbitrary order.
  - gh-146256: The profiling.sampling module now supports JSONL
    output format via --jsonl. Each run emits
    a newline-delimited JSON file that is sequentially
    parseable by external tools, scripts, and programmatic
    consumers. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146609: Add colour to timeit CLI output. Patch by Hugo
    van Kemenade.
  - gh-146563: xml.parsers.expat: add an exception note when
    a custom Expat handler return value cannot be properly
    interpreted. Patch by Bénédikt Tran.
  - gh-137586: Add MacOS to webbrowser for macOS, which opens
    URLs via /usr/bin/open instead of piping AppleScript to
    osascript. Deprecate MacOSXOSAScript in favour of MacOS.
  - gh-146406: Cross-language method suggestions are now shown
    for AttributeError on builtin types and their subclasses.
    For example, [].push() suggests append, (1,2).append(3)
    suggests using a list, None.keys() suggests expecting
    a dict, and 1.0.__or__ suggests using an int.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-146292: Add colour to BaseHTTPRequestHandler logs, as
    used by the http.server CLI. Patch by Hugo van Kemenade.
  - gh-145917: Add MIME types for TTC and Haptics formats to
    mimetypes. (Contributed by Charlie Lin in gh-145918.)
  - gh-145846: Fix memory leak in _lsprof when clear() is
    called during active profiling with nested calls.
    clearEntries() now walks the entire currentProfilerContext
    linked list instead of only freeing the top context.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145378: Use PyREPL as the default input console for pdb
  - gh-145244: Fixed a use-after-free in json encoder when
    a default callback mutates the dictionary being serialized.
  - gh-117716: Fix wave writing of odd-sized data chunks by
    appending the required RIFF pad byte and correcting the
    RIFF chunk size field accordingly.
  - gh-145200: hashlib: fix a memory leak when allocating or
    initializing an OpenSSL HMAC context fails.
  - gh-145056: Add support for frozendict in
    dataclasses.asdict() and dataclasses.astuple().
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-137855: Reduce the import time of dataclasses module by
    ~20%.
  - gh-70647: strptime() now raises ValueError when the format
    string contains %d without a year directive. Using %e
    without a year now emits a DeprecationWarning.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-108411: typing.IO and typing.BinaryIO method arguments
    are now positional-only.
  - gh-130273: Fix traceback color output with Unicode
    characters.
  - gh-142307: imaplib: deprecate support for IMAP4.file. This
    attribute was never meant to be part of the public
    interface and altering its value may result in unclosed
    files or other synchronization issues with the underlying
    socket. Patch by Bénédikt Tran.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-139489: Add the xml.is_valid_name() function, which
    allows to check whether a string can be used as an element
    or attribute name in XML.
  - gh-75707: Add optional mtime argument to tarfile.open(),
    for setting the mtime header field in .tar.gz archives.
  - gh-125862: The contextlib.contextmanager() and
    contextlib.asynccontextmanager() decorators now work
    correctly with generators, coroutine functions, and async
    generators when the wrapped callables are used as
    decorators.
  - gh-135528: http.cookiejar: add “tv”, “or”, “nom”, “sch”,
    and “web” to the default list of supported country code
    second-level domains.
  - gh-135056: Add a -H or --header CLI option to python -m
    http.server. Contributed by Anton I. Sipos.
  - gh-134551: Add t-strings support to pprint functions
  - gh-133956: Fix bug where @dataclass wouldn’t detect
    ClassVar fields if ClassVar was re-exported from a module
    other than typing.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-108951: asyncio: Add TaskGroup.cancel which cancels
    unfinished tasks and exits the group without raising
    asyncio.CancelledError.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-122476: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its local-part. Under a policy with utf8 set False,
    attempting to serialize such a message will now raise an
    HeaderWriteError. There is no valid 7-bit encoding for an
    internationalized local-part. Use email.policy.SMTPUTF8 (or
    another policy with utf8=True) to correctly pass through
    the local-part as Unicode characters.
  - gh-83938: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its domain. Under a policy with utf8 set False, attempting
    to serialize such a message will now raise an
    HeaderWriteError. Either apply an appropriate IDNA encoding
    to convert the domain to ASCII before serialization, or use
    email.policy.SMTPUTF8 (or another policy with utf8=True) to
    correctly pass through the internationalized domain name as
    Unicode characters.
  - gh-81074: The email module no longer treats email addresses
    with non-ASCII characters as defects when parsing a Unicode
    string or in the addr_spec parameter to
    email.headerregistry.Address. RFC 5322 permits such
    addresses, and they were already supported when parsing
    bytes and in the Address username parameter.
  - The (undocumented) email.errors.NonASCIILocalPartDefect is
    no longer used and should be considered deprecated.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-113471: Allow http.server to set a default content-type
    when serving files with an unknown or missing extension.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - gh-96894: Do not turn echo off for subsequent commands in
    batch activators (activate.bat and deactivate.bat) of venv.
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Tests
  - gh-149425: Increase time delta in
    test.test_zipfile.test_core.OtherTests.test_write_without_source_date_epoch
  - gh-148600: Add OpenSSL 4.0.0 support to test
    configurations.
  - Build
  - gh-149353: Avoid unnecessary JIT-related rebuilds during
    make install after --enable-optimizations builds.
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-149252: Update to WASI SDK 33.
  - gh-148690: Windows free-threaded builds now output to
    a different default path with default filenames, for
    example, PCbuild/amd64t/python.exe rather than
    PCbuild/amd64/python3.15t.exe. The PC/layout script has
    been updated to ensure compatibility of generated layouts.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148644: Errors during the PGO training job on Windows
    are no longer ignored, and a non-zero return code will
    cause the build to fail.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-148483: Use Py_GCC_ATTRIBUTE(unused) for stop_tracing
    label.
  - gh-148474: Fixed compilation of Python/pystrhex.c with
    older clang versions.
  - gh-146445: The Android build tools have been moved to the
    Platforms folder.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - gh-138451: Allow for custom LLVM path using
    LLVM_TOOLS_INSTALL_DIR during JIT build.
  - gh-133312: Add a new ./configure option
  - -enable-static-libpython-for-interpreter which, when used
    with --enable-shared, continues to build the shared library
    but does not use it for the interpreter. Instead, libpython
    is statically linked into the interpreter, as if
  - -enable-shared had not been used. This allows you to do
    a single build and get a Python interpreter binary that
    does not use a shared library but also get a shared library
    for use by other programs.
  - Windows
  - gh-149254: Updated bundled version of OpenSSL to 3.5.6.
  - gh-148690: Non-freethreaded builds on Windows now support
    extensions linked to python3t.dll, and will include a copy
    of that library in normal installs that references the
    non-freethreaded runtime.
  - gh-146458: Fix incorrect REPL height and width tracking on
    console window resize on Windows. macOS
  - gh-142295: For Python macOS framework builds, update
    Info.plist files to be more compliant with current Apple
    guidelines. Original patch contributed by Martinus Verburg.
  - gh-149254: Update macOS installer to use OpenSSL 3.5.6.
  - IDLE
  - gh-94523: Detect file if modified at local disk and prompt
    to ask refresh. Patch by Shixian Li.
  - gh-139551: Support rendering BaseExceptionGroup in IDLE.
  - gh-89520: Make IDLE extension configuration look at user
    config files, allowing user-installed extensions to have
    settings and key bindings defined in ~/.idlerc.
  - C API
  - gh-149225: PyCriticalSection and related functions are
    added to the Stable ABI.
  - gh-149216: PyType_WatchCallback callbacks registered via
    PyType_AddWatcher() are now also invoked when a watched
    heap type is deallocated. Previously, type watchers were
    only notified of modifications, which could cause stale
    references when a type was freed and its address was
    reused.
  - gh-149101: Implement PEP 788.
  - gh-149044: Implement PEP 820: Unified slot system for the
    C API.
  - gh-148267: Using Py_LIMITED_API on a non-Windows
    free-threaded build no longer needs an extra
    Py_GIL_DISABLED.
  - gh-145559: Rename _Py_DumpTraceback and
    _Py_DumpTracebackThreads to PyUnstable_DumpTraceback() and
    PyUnstable_DumpTracebackThreads().
  - gh-146636: Implement PEP 803 – abi3t: Stable ABI for
    Free-Threaded Builds.
  - gh-146302: Py_IsInitialized() no longer returns true until
    initialization has fully completed, including import of the
    site module. The underlying runtime flags now use atomic
    operations.
  - gh-146063: Add PyObject_CallFinalizerFromDealloc() function
    to the limited C API. Patch by Victor Stinner.
  - gh-145921: Add functions that are guaranteed to be safe for
    use in tp_traverse handlers:
    PyObject_GetTypeData_DuringGC(),
    PyObject_GetItemData_DuringGC(),
    PyType_GetModuleState_DuringGC(),
    PyModule_GetState_DuringGC(), PyModule_GetToken_DuringGC(),
    PyType_GetBaseByToken_DuringGC(),
    PyType_GetModule_DuringGC(),
    PyType_GetModuleByToken_DuringGC().
  - Remove upstreamed patches:
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-6100-use-after-free-decompression.patch
  - For &ix86 we build `--without-frame-pointers`

++++ python315-documentation:

  - Update to 3.15.0~b2
  - Security
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report. (bsc#1265268, CVE-2026-8328)
  - gh-149474: Fix the binary writer in profiling.sampling not
    firing the audit (PEP 578) when creating the output file.
    The writer and the reader now accept any path-like object.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter. (bsc#1267821, CVE-2026-7774)
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs. (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-150374: Fix double release of the import lock on lazy
    import reification errors.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-148587: sys.lazy_modules is now a set instead of a dict
    as initially spelled out in PEP 810.
  - gh-150042: Fix refleak in queue.SimpleQueue.put if memory
    allocation fails.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149807: Fix hash(frozendict): compute the hash of each
    (key, value) pair correctly. Patch by Victor Stinner.
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-149676: Fix frozendict | frozendict hash.
  - gh-148829: sentinel objects now support a repr= argument
    and their __module__ attribute is writable.
  - gh-149642: Allow imports inside exec() calls within
    functions under PYTHON_LAZY_IMPORTS=all.
  - gh-144957: Fix lazy from imports of module attributes
    provided by module-level __getattr__.
  - gh-149459: Fix a crash in the JIT optimizer when
    a specialized LOAD_SPECIAL guard deoptimized after
    inserting the synthetic NULL stack entry.
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150228: The new site.StartupState class lets callers
    batch-process PEP 829 startup configuration files across
    multiple site directories before any startup code runs,
    with public addsitedir(), addusersitepackages(),
    addsitepackages(), and process() methods. The signature of
    site.addsitedir() is unchanged from Python 3.14. The
    defer_processing_start_files argument and the
    process_startup_files() function added earlier in the 3.15
    cycle have been removed; use site.StartupState instead.
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149189: Revert the changes to pprint defaults. Patch by
    Hugo van Kemenade.
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-142349: Add lazy to the list of support topic by help().
  - gh-149819: Fix regression in site.addsitedir() where .pth
    files were no longer processed in Python subprocesses. This
    happened because site.main() seeded known_paths with
    entries inherited from the parent process, causing
    addsitedir to skip .pth processing.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149718: Coalesce consecutive identical stack frames in
    Tachyon, so aggregating collectors (pstats, collapsed,
    flamegraph, gecko) receive one collect. Improves sample
    rate 3x, error rate and missed rate drop by 70%. Patch by
    Maurycy Pawłowski-Wieroński.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-149504: Fix site.addsitedir() to allow re-entrant calls
    from within startup files. Previously, a .pth file
    containing an import line that called site.addsitedir() (or
    a .start entry point doing the same) could crash with
    RuntimeError: dictionary changed size during iteration
    during site initialization, breaking tools such as uv run
  - -with.
  - gh-149584: Fix excessive overhead in the Tachyon profiler
    when inspecting a remote process by avoiding repeated
    remote page-cache scans, batching predicted remote reads,
    and reusing cached profiler result objects. Patch by Pablo
    Galindo and Maurycy Pawłowski-Wieroński.
  - gh-139489: Add xml.is_valid_text() to xml.__all__.
  - gh-149614: Fix a regression that broke the ability to
    deepcopy argparse.ArgumentParser instances.
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149534: Fix merging of collections.defaultdict and
    frozendict.
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of comments, processing instructions and elements
    “xmp”, “iframe”, “noembed”, “noframes”, and “plaintext” is
    no longer escaped. The “plaintext” element no longer have
    the closing tag. Add support of empty attributes (with
    value None).
  - gh-149056: Fix json.load() not forwarding the array_hook
    argument to json.loads(). Patch by Thomas Kowalski.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-86533: The os.makedirs() function and
    pathlib.Path.mkdir() method now have a parent_mode
    parameter to specify the mode for intermediate directories
    when creating parent directories. This allows one to match
    the behavior from Python 3.6 and earlier for os.makedirs().
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-133998: Fix struct.error exception when creating a file
    with gzip.GzipFile or compressing data with gzip.compress()
    if the system time is outside the range 00:00:00 UTC,
    January 1, 1970 through 06:28:15 UTC, February 7, 2106, or
    explicitly passed mtime argument is outside the range 0 to
    2**32-1.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-121109: Fix tarfile performance issue when reading
    archives in streaming mode (e.g. r|*).
  - bpo-45509: Gzip headers are now checked for corrupted NAME,
    COMMENT and HCRC fields.
  - Tests
  - gh-150387: Fix hang in
    test.test_profiling.test_sampling_profiler.test_live_collector_ui.TestLiveModeErrors.test_run_failed_script_live
    on slow buildbots. The test now always queues a final
    q keystroke so the live TUI loop exits even when the
    profiler collects enough samples to enter the post-finished
    input loop.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - gh-148260: On Linux when Python is linked to the musl
    C library, use a thread stack size of at least 1 MiB
    instead of musl default which is 128 kiB. Patch by Victor
    Stinner.
  - Tools/Demos
  - gh-150258: Update the tooltip on the Tachyon flame graph to
    show both absolute and relative percentages.
  - C API
  - gh-149725: Add PySentinel_CheckExact() for exact sentinel
    type tests to accompany the existing PySentinel_Check().
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Update to 3.15.0~b1:
  - Security
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.5.6.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-148252: Fixed string table and sample record bounds
    checks in _remote_debugging when decoding certain .pyb
    inputs on 32-bit builds. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping. (bsc#1262654,
    CVE-2026-6019)
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098,
    CVE-2026-6100).
  - gh-148252: Fixed stack depth calculation in
    _remote_debugging when decoding certain .pyb inputs on
    32-bit builds. Issue originally identified and diagnosed by
    Tristan Madani (@TristanInSec on GitHub).
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts.
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-137586: Fix a PATH-injection vulnerability in webbrowser
    on macOS where osascript was invoked without an absolute
    path. The new MacOS class uses /usr/bin/open directly,
    eliminating the dependency on osascript entirely.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method.
    (bsc#1261969, CVE-2026-1502)
  - Core and Builtins
  - gh-148940: Revert the process size based deferral of
    garbage collection (gh-133464). The performance issue this
    change resolves is also fixed by gh-142562. This approach
    has the problem that process size as seen by the OS (e.g.
    the resident size or RSS) does not immediately decrease
    after cyclic garbage is freed since mimalloc defers
    returning memory of the OS. This change applies to the
    free-threaded GC only.
  - gh-149243: Check for recursion limits in
    CALL_ALLOC_AND_ENTER_INIT opcode.
  - gh-126910: Add support for unwinding JIT frames using GNU
    backtrace. Patch by Diego Russo and Pablo Galindo
  - gh-149171: Allow assignment to the __module__ attribute of
    typing.TypeAliasType instances.
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-149049: Fix stack underflow for BINARY_OP in tier 2.
  - gh-83065: Fix a deadlock that could occur when one thread
    is importing a submodule (for example import pkg.sub.mod)
    while another thread is importing one of its parent
    packages (for example import pkg.sub) and that parent’s
    __init__.py itself imports the submodule. The import system
    now acquires module locks in hierarchical
    (parent-before-child) order so the two threads serialise
    instead of raising _DeadlockError.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148850: Fix the memory sanitizer false positive in
    os.getrandom().
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148829: Add sentinel, implementing PEP 661. PEP by Tal
    Einat; patch by Jelle Zijlstra.
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-148766: The interpreter help (such as python --help) is
    now in color. Patch by Hugo van Kemenade.
  - gh-148571: Fix a crash in the JIT optimizer when
    specialized opcode families inherited incompatible recorded
    operand layouts.
  - gh-148653: Forbid marshalling recursive code objects, slice
    and frozendict objects which cannot be correctly
    unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.15 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-146462: Added PyTypeObject.tp_basicsize,
    PyTypeObject.tp_dictoffset, and
    PyHeapTypeObject.ht_cached_keys offsets to _Py_DebugOffsets
    to support version-independent read-only dict introspection
    tools.
  - gh-145239: Unary plus is now accepted in match literal
    patterns, mirroring the existing support for unary minus.
    Patch by Bartosz Sławecki.
  - gh-148515: Fix a bug in the JIT optimizer reading operands
    for uops with multiple caches.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148398: Fix a bug in the JIT optimizer where class
    attribute loads were not invalidated after type mutation.
  - gh-146527: Add a GCMonitor class with a get_gc_stats method
    to the _remote_debugging module to allow reading GC
    statistics from an external Python process without
    requiring the full RemoteUnwinder functionality. Patch by
    Sergey Miryanov and Pablo Galindo.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-115802: Improve JIT code generation on Linux AArch64 by
    reducing the indirect call to external symbols. Patch by
    Diego Russo.
  - gh-148189: Repaired undercount of bytes in type-specific
    free lists reported by sys._debugmallocstats(). For types
    that participate in cyclic garbage collection, it was
    missing two pointers used by GC.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-95004: The specializing interpreter now specializes for
    enum.Enum improving performance and scaling in
    free-threading. Patch by Kumar Aditya.
  - gh-149202: Enable frame pointers by default for
    GCC-compatible CPython builds, including
  - mno-omit-leaf-frame-pointer, -marm on 32-bit ARM, and/or
  - mbackchain on s390x platforms when the compiler supports
    them, so profilers and debuggers can unwind native
    interpreter frames more reliably. Users can pass
  - -without-frame-pointers to ./configure to opt out.
  - gh-148014: Accept a function name in -X presite command
    line option and PYTHON_PRESITE environment variable. Patch
    by Victor Stinner.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - gh-146306: Specialize float true division in the tier
    2 optimizer with inplace mutation for uniquely-referenced
    operands.
  - gh-142186: Global sys.monitoring events can now be turned
    on and disabled on a per code object basis. Returning
    DISABLE from a callback disables the event for the entire
    code object (for the current tool).
  - gh-126910: Add support for unwinding JIT frames using GDB.
    Patch by Diego Russo and Pablo Galindo.
  - gh-146031: The unstable API
    _PyInterpreterState_SetEvalFrameFunc has a companion
    function
    _PyInterpreterState_SetEvalFrameAllowSpecialization to
    specify if specialization should be allowed. When this
    option is set to 1 the specializer will turn Python ->
    Python calls into specialized opcodes which the replacement
    interpreter loop can choose to respect and perform inlined
    dispatch.
  - gh-145278: The encodings is now partially frozen, including
    the aliases and utf_8 submodules.
  - The linecache is now frozen.
  - gh-134584: Optimize and eliminate redundant ref-counting
    for MAKE_FUNCTION in the JIT.
  - gh-143886: Reorder function annotations so positional-only
    arguments are returned before other arguments. This fixes
    how functools.singledispatch() registers functions with
    positional-only arguments.
  - gh-98894: Restore function__entry and function__return
    DTrace/SystemTap probes that were broken since Python 3.11.
  - gh-116021: Support for creating instances of abstract AST
    nodes from the ast module is deprecated and scheduled for
    removal in Python 3.20. Patch by Brian Schubert.
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-137600: ast: The constructors of AST nodes now raise
    a TypeError when a required argument is omitted or when
    a keyword argument that does not map to a field on the AST
    node is passed. These cases had previously raised
    a DeprecationWarning since Python 3.13. Patch by Brian
    Schubert.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-135357: Add support for socket.SO_PASSRIGHTS on Linux.
  - gh-134690: Removed deprecated in PEP 626 since Python 3.12
    codeobject.co_lnotab from types.CodeType.
  - gh-100239: Specialize BINARY_OP for concatenation of lists
    and tuples, and propagate the result type through
    _BINARY_OP_EXTEND in the tier 2 optimizer so that follow-up
    type guards can be eliminated.
  - Library
  - gh-148823: Defer the import of _colorize in argparse until
    needed for coloring output.
  - gh-141560: Add an annotation_format parameter to
    inspect.getfullargspec().
  - gh-139489: Add the xml.is_valid_text() function, which
    allows to check whether a string can be used in the XML
    document.
  - gh-142389: Add backticks to stdlib argparse help to display
    in colour. Patch by Hugo van Kemenade.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-142389: Add backtick markup support in argparse option
    help text to highlight inline code when color output is
    enabled. Patch by Hugo van Kemenade.
  - gh-148675: Remove F and D formats from array and
    memoryview. Patch by Victor Stinner.
  - gh-149342: Fix _remote_debugging binary writing so that
    sampling a thread whose Python frame stack is empty (for
    example while it is in a C call or mid-syscall) no longer
    raises RuntimeError("Invalid stack encoding type"), and so
    that BinaryWriter.total_samples after finalize() or
    context-manager exit includes samples flushed from the RLE
    buffer. Patch by Maurycy Pawłowski-Wieroński.
  - gh-149010: The inspect module CLI now reports as much
    information as it has available for non-source modules when
  - -details is specified, and provides an error message
    rather than a traceback when --details is omitted. It also
    reports improved information when the given target location
    is not the target’s defining location and when the given
    target is a data value rather than a class or function
    definition.
  - gh-146609: Use argparse for colour help timeit CLI. Patch
    by Hugo van Kemenade.
  - gh-142389: Add backticks for colour to regrtest and pdb’s
    help description. Patch by Hugo van Kemenade.
  - gh-144384: Lazily import _colorize. Patch by Hugo van
    Kemenade.
  - gh-149321: Fix import cycles exposed by running standard
    library modules with -X lazy_imports=none.
  - gh-145378: Generate consistent colors for pdb commands in
    pdb REPL.
  - gh-149296: Add a dump subcommand to profiling.sampling that
    prints a single traceback-style snapshot of a running
    process’s Python stack, including per-thread status, source
    line highlighting, optional bytecode opcode names, and
    async-aware task reconstruction. Patch by Pablo Galindo.
  - gh-143231: A module attribute has been added to
    warnings.WarningMessage.
  - gh-148675: ctypes: Change the _type_ of c_float_complex,
    c_double_complex and c_longdouble_complex from F, D and
    G to Zf, Zd and Zg for compatibility with numpy. Patch by
    Victor Stinner.
  - gh-148675: The array.typecodes type changed from str to
    tuple to support type codes longer than 1 character (Zf and
    Zd). Patch by Victor Stinner.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-143231: unittest.TestCase.assertWarns() and
    unittest.TestCase.assertWarnsRegex() no longer swallow
    warnings that do not match the specified category or regex.
    Nested context managers are now supported.
  - gh-149214: Fix _remote_debugging misreading non-ASCII
    Unicode strings (Latin-1, BMP and non-BMP) from a remote
    process. Filenames and function names that contain
    non-ASCII characters are now reported correctly in stack
    traces, the sampling profiler, and asyncio task
    introspection.
  - gh-149189: pprint now uses modern defaults: indent=4 and
    width=88, and the default compact=False output is now
    formatted similar to pretty-printed json.dumps(), with
    opening parentheses and brackets followed by a newline and
    the contents indented by one level. The expand parameter,
    added in 3.15.0a8, has been removed; compact=False (the
    default) now produces the former expand=True layout. Patch
    by Hugo van Kemenade.
  - gh-149173: Fix inverted PYTHON_BASIC_REPL environment check
    in pdb._pyrepl_available.
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-149009: Validate that profiling.sampling binary profiles
    do not contain more unique (thread, interpreter) pairs than
    declared in the header. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-148292: ssl: Update ssl.SSLSocket and ssl.SSLObject for
    OpenSSL 4. The classes now remember if they get
    a ssl.SSLEOFError. In this case, following read(),
    sendfile(), write(), and do_handshake() calls raise
    ssl.SSLEOFError without calling the underlying OpenSSL
    function. Thanks to that, ssl.SSLSocket behaves the same on
    all OpenSSL versions on EOF. Patch by Victor Stinner.
  - gh-149085: Add a max_threads keyword argument to
    faulthandler.dump_traceback(),
    faulthandler.dump_traceback_later(), faulthandler.enable(),
    and faulthandler.register().
  - gh-148641: pkgutil.resolve_name() gets a new optional,
    keyword-only argument called strict. The default is False
    for backward compatibility.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-149083: dataclasses.MISSING and dataclasses.KW_ONLY are
    now instances of sentinel.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-149026: Add colour to pickletools CLI output. Patch by
    Hugo van Kemenade.
  - gh-148991: Add colour to tokenize CLI output. Patch by Hugo
    van Kemenade.
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148981: Add color parameter to ast.dump().
  - gh-148849: Deprecate http.cookies.Morsel.js_output() and
    http.cookies.BaseCookie.js_output(), which will be removed
    in Python 3.19. Use http.cookies.Morsel.output() or
    http.cookies.BaseCookie.output() instead.
  - gh-146311: Add a canonical keyword-only parameter to the
    base16, base32, base64, base85, ascii85, and Z85 decoders
    in base64 and binascii. When true, encodings with non-zero
    padding bits (base16/32/64) or non-canonical encodings
    (base85/ascii85) are rejected. Single-character final
    groups in binascii.a2b_ascii85() and binascii.a2b_base85()
    are now always rejected as encoding violations, regardless
    of canonical; previously they were silently ignored and
    produced no output bytes.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-124397: The threading module added tooling to support
    concurrent iterator access: threading.serialize_iterator,
    threading.synchronized_iterator(), and
    threading.concurrent_tee().
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148688: bz2, compression.zstd, lzma, zlib: Fix a double
    free on memory allocation failure. Patch by Victor Stinner.
  - gh-148675: array, struct: Add support for Zd and Zf formats
    for double complex and float complex. Patch by Victor
    Stinner.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-148641: PEP 829 (package startup configuration files)
    implements a new format <name>.start parallel to <name>.pth
    files, to replace import lines in the latter.
  - gh-148639: Implement PEP 800, adding the
    @typing.disjoint_base decorator. Patch by Jelle Zijlstra.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148599: Update the socket module’s WSA error messages to
    match official documentation.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-144881: asyncio debugging tools (python -m asyncio ps
    and pstree) now retry automatically on transient errors
    that can occur when attaching to a process under active
    thread delegation. The number of retries can be controlled
    with the --retries flag. Patch by Bartosz Sławecki.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-121190: importlib.resources.files() now emits a more
    meaningful error message when module spec is None (as found
    in some __main__ modules).
  - gh-127012: importlib.abc.Traversable.read_text now
    allows/solicits an errors parameter.
  - gh-137855: Improve import time of dataclasses module by
    lazy importing re and copy modules.
  - gh-148352: Add more color to calendar’s CLI output. Patch
    by Hugo van Kemenade.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-130472: Integrate fancycompleter with import
    completions.
  - gh-148241: json: Fix serialization: no longer call str(obj)
    on str subclasses. Patch by Victor Stinner.
  - gh-148225: The profiling.sampling replay command now
    rejects non-binary profile files with a clear error
    explaining that replay only accepts files created with
  - -binary.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-148207: typing.TypeVarTuple now accepts bound,
    covariant, contravariant, and infer_variance parameters,
    matching the interface of typing.TypeVar and
    typing.ParamSpec.
  - gh-148100: Soft deprecate re.match() and re.Pattern.match()
    in favour of re.prefixmatch() and re.Pattern.prefixmatch().
    Patch by Hugo van Kemenade.
  - gh-147991: Improve tomllib import time (up to 10x faster).
    Patch by Victor Stinner.
  - gh-147957: Guarantees that collections.UserDict.popitem()
    will pop in the same order as the wrapped dictionary rather
    than an arbitrary order.
  - gh-146256: The profiling.sampling module now supports JSONL
    output format via --jsonl. Each run emits
    a newline-delimited JSON file that is sequentially
    parseable by external tools, scripts, and programmatic
    consumers. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146609: Add colour to timeit CLI output. Patch by Hugo
    van Kemenade.
  - gh-146563: xml.parsers.expat: add an exception note when
    a custom Expat handler return value cannot be properly
    interpreted. Patch by Bénédikt Tran.
  - gh-137586: Add MacOS to webbrowser for macOS, which opens
    URLs via /usr/bin/open instead of piping AppleScript to
    osascript. Deprecate MacOSXOSAScript in favour of MacOS.
  - gh-146406: Cross-language method suggestions are now shown
    for AttributeError on builtin types and their subclasses.
    For example, [].push() suggests append, (1,2).append(3)
    suggests using a list, None.keys() suggests expecting
    a dict, and 1.0.__or__ suggests using an int.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-146292: Add colour to BaseHTTPRequestHandler logs, as
    used by the http.server CLI. Patch by Hugo van Kemenade.
  - gh-145917: Add MIME types for TTC and Haptics formats to
    mimetypes. (Contributed by Charlie Lin in gh-145918.)
  - gh-145846: Fix memory leak in _lsprof when clear() is
    called during active profiling with nested calls.
    clearEntries() now walks the entire currentProfilerContext
    linked list instead of only freeing the top context.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145378: Use PyREPL as the default input console for pdb
  - gh-145244: Fixed a use-after-free in json encoder when
    a default callback mutates the dictionary being serialized.
  - gh-117716: Fix wave writing of odd-sized data chunks by
    appending the required RIFF pad byte and correcting the
    RIFF chunk size field accordingly.
  - gh-145200: hashlib: fix a memory leak when allocating or
    initializing an OpenSSL HMAC context fails.
  - gh-145056: Add support for frozendict in
    dataclasses.asdict() and dataclasses.astuple().
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-137855: Reduce the import time of dataclasses module by
    ~20%.
  - gh-70647: strptime() now raises ValueError when the format
    string contains %d without a year directive. Using %e
    without a year now emits a DeprecationWarning.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-108411: typing.IO and typing.BinaryIO method arguments
    are now positional-only.
  - gh-130273: Fix traceback color output with Unicode
    characters.
  - gh-142307: imaplib: deprecate support for IMAP4.file. This
    attribute was never meant to be part of the public
    interface and altering its value may result in unclosed
    files or other synchronization issues with the underlying
    socket. Patch by Bénédikt Tran.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-139489: Add the xml.is_valid_name() function, which
    allows to check whether a string can be used as an element
    or attribute name in XML.
  - gh-75707: Add optional mtime argument to tarfile.open(),
    for setting the mtime header field in .tar.gz archives.
  - gh-125862: The contextlib.contextmanager() and
    contextlib.asynccontextmanager() decorators now work
    correctly with generators, coroutine functions, and async
    generators when the wrapped callables are used as
    decorators.
  - gh-135528: http.cookiejar: add “tv”, “or”, “nom”, “sch”,
    and “web” to the default list of supported country code
    second-level domains.
  - gh-135056: Add a -H or --header CLI option to python -m
    http.server. Contributed by Anton I. Sipos.
  - gh-134551: Add t-strings support to pprint functions
  - gh-133956: Fix bug where @dataclass wouldn’t detect
    ClassVar fields if ClassVar was re-exported from a module
    other than typing.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-108951: asyncio: Add TaskGroup.cancel which cancels
    unfinished tasks and exits the group without raising
    asyncio.CancelledError.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-122476: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its local-part. Under a policy with utf8 set False,
    attempting to serialize such a message will now raise an
    HeaderWriteError. There is no valid 7-bit encoding for an
    internationalized local-part. Use email.policy.SMTPUTF8 (or
    another policy with utf8=True) to correctly pass through
    the local-part as Unicode characters.
  - gh-83938: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its domain. Under a policy with utf8 set False, attempting
    to serialize such a message will now raise an
    HeaderWriteError. Either apply an appropriate IDNA encoding
    to convert the domain to ASCII before serialization, or use
    email.policy.SMTPUTF8 (or another policy with utf8=True) to
    correctly pass through the internationalized domain name as
    Unicode characters.
  - gh-81074: The email module no longer treats email addresses
    with non-ASCII characters as defects when parsing a Unicode
    string or in the addr_spec parameter to
    email.headerregistry.Address. RFC 5322 permits such
    addresses, and they were already supported when parsing
    bytes and in the Address username parameter.
  - The (undocumented) email.errors.NonASCIILocalPartDefect is
    no longer used and should be considered deprecated.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-113471: Allow http.server to set a default content-type
    when serving files with an unknown or missing extension.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - gh-96894: Do not turn echo off for subsequent commands in
    batch activators (activate.bat and deactivate.bat) of venv.
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Tests
  - gh-149425: Increase time delta in
    test.test_zipfile.test_core.OtherTests.test_write_without_source_date_epoch
  - gh-148600: Add OpenSSL 4.0.0 support to test
    configurations.
  - Build
  - gh-149353: Avoid unnecessary JIT-related rebuilds during
    make install after --enable-optimizations builds.
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-149252: Update to WASI SDK 33.
  - gh-148690: Windows free-threaded builds now output to
    a different default path with default filenames, for
    example, PCbuild/amd64t/python.exe rather than
    PCbuild/amd64/python3.15t.exe. The PC/layout script has
    been updated to ensure compatibility of generated layouts.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148644: Errors during the PGO training job on Windows
    are no longer ignored, and a non-zero return code will
    cause the build to fail.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-148483: Use Py_GCC_ATTRIBUTE(unused) for stop_tracing
    label.
  - gh-148474: Fixed compilation of Python/pystrhex.c with
    older clang versions.
  - gh-146445: The Android build tools have been moved to the
    Platforms folder.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - gh-138451: Allow for custom LLVM path using
    LLVM_TOOLS_INSTALL_DIR during JIT build.
  - gh-133312: Add a new ./configure option
  - -enable-static-libpython-for-interpreter which, when used
    with --enable-shared, continues to build the shared library
    but does not use it for the interpreter. Instead, libpython
    is statically linked into the interpreter, as if
  - -enable-shared had not been used. This allows you to do
    a single build and get a Python interpreter binary that
    does not use a shared library but also get a shared library
    for use by other programs.
  - Windows
  - gh-149254: Updated bundled version of OpenSSL to 3.5.6.
  - gh-148690: Non-freethreaded builds on Windows now support
    extensions linked to python3t.dll, and will include a copy
    of that library in normal installs that references the
    non-freethreaded runtime.
  - gh-146458: Fix incorrect REPL height and width tracking on
    console window resize on Windows. macOS
  - gh-142295: For Python macOS framework builds, update
    Info.plist files to be more compliant with current Apple
    guidelines. Original patch contributed by Martinus Verburg.
  - gh-149254: Update macOS installer to use OpenSSL 3.5.6.
  - IDLE
  - gh-94523: Detect file if modified at local disk and prompt
    to ask refresh. Patch by Shixian Li.
  - gh-139551: Support rendering BaseExceptionGroup in IDLE.
  - gh-89520: Make IDLE extension configuration look at user
    config files, allowing user-installed extensions to have
    settings and key bindings defined in ~/.idlerc.
  - C API
  - gh-149225: PyCriticalSection and related functions are
    added to the Stable ABI.
  - gh-149216: PyType_WatchCallback callbacks registered via
    PyType_AddWatcher() are now also invoked when a watched
    heap type is deallocated. Previously, type watchers were
    only notified of modifications, which could cause stale
    references when a type was freed and its address was
    reused.
  - gh-149101: Implement PEP 788.
  - gh-149044: Implement PEP 820: Unified slot system for the
    C API.
  - gh-148267: Using Py_LIMITED_API on a non-Windows
    free-threaded build no longer needs an extra
    Py_GIL_DISABLED.
  - gh-145559: Rename _Py_DumpTraceback and
    _Py_DumpTracebackThreads to PyUnstable_DumpTraceback() and
    PyUnstable_DumpTracebackThreads().
  - gh-146636: Implement PEP 803 – abi3t: Stable ABI for
    Free-Threaded Builds.
  - gh-146302: Py_IsInitialized() no longer returns true until
    initialization has fully completed, including import of the
    site module. The underlying runtime flags now use atomic
    operations.
  - gh-146063: Add PyObject_CallFinalizerFromDealloc() function
    to the limited C API. Patch by Victor Stinner.
  - gh-145921: Add functions that are guaranteed to be safe for
    use in tp_traverse handlers:
    PyObject_GetTypeData_DuringGC(),
    PyObject_GetItemData_DuringGC(),
    PyType_GetModuleState_DuringGC(),
    PyModule_GetState_DuringGC(), PyModule_GetToken_DuringGC(),
    PyType_GetBaseByToken_DuringGC(),
    PyType_GetModule_DuringGC(),
    PyType_GetModuleByToken_DuringGC().
  - Remove upstreamed patches:
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-6100-use-after-free-decompression.patch
  - For &ix86 we build `--without-frame-pointers`

++++ python315-nogil:

  - Update to 3.15.0~b2
  - Security
  - gh-149698: Update bundled libexpat to version 2.8.1 for the
    fix for CVE 2026-45186.
  - gh-87451: The ftplib module’s undocumented ftpcp function
    no longer trusts the IPv4 address value returned from the
    source server in response to the PASV command by default,
    completing the fix for CVE-2021-4189. As with ftplib.FTP,
    the former behavior can be re-enabled by setting the
    trust_server_pasv_ipv4_address attribute on the source
    ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
    AI for the report. (bsc#1265268, CVE-2026-8328)
  - gh-149474: Fix the binary writer in profiling.sampling not
    firing the audit (PEP 578) when creating the output file.
    The writer and the reader now accept any path-like object.
    Patch by Maurycy Pawłowski-Wieroński.
  - gh-149486: tarfile.data_filter() now validates link targets
    using the same normalised value that is written to disk,
    strips trailing separators from the member name when
    resolving a symlink’s directory, and rejects link members
    that would replace the destination directory itself. This
    closes several path-traversal bypasses of the data
    extraction filter. (bsc#1267821, CVE-2026-7774)
  - gh-149079: Fix a potential denial of service in
    unicodedata.normalize(). The canonical ordering step of
    Unicode normalization used a quadratic-time insertion sort
    for reordering combining characters, which could be
    exploited with crafted input containing many combining
    characters in non-canonical order. Replaced with
    a linear-time counting sort for long runs. (bsc#1267581,
    CVE-2026-3276).
  - gh-149018: Improved protection against XML hash-flooding
    attacks in xml.parsers.expat and xml.etree.ElementTree when
    Python is compiled with libExpat 2.8.0 or later
    (bsc#1264962, CVE-2026-7210).
  - Core and Builtins
  - gh-150374: Fix double release of the import lock on lazy
    import reification errors.
  - gh-149156: Fix an intermittent crash after os.fork() when
    perf trampoline profiling is enabled and the child returns
    through trampoline frames inherited from the parent
    process.
  - gh-149449: Fix a use-after-free crash when the unicodedata
    module was removed from sys.modules and garbage-collected
    between calls that decode \N{...} escapes or use the
    namereplace codec error handler.
  - gh-150107: asyncio: sendfile() and sock_sendfile() event
    loop methods now call file.seek(offset) if file has
    a seek() method, even if offset is 0 (default value).
  - gh-150146: Fix a crash on a complex type variable
    substitution.
  - from typing import TypeVar;
    memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
    fail due to missing NULL check on _unpack_args C function
    call.
  - gh-148587: sys.lazy_modules is now a set instead of a dict
    as initially spelled out in PEP 810.
  - gh-150042: Fix refleak in queue.SimpleQueue.put if memory
    allocation fails.
  - gh-149590: Fix crash when faulthandler is imported more
    than once.
  - gh-149816: Fix a race condition in _PyBytes_FromList in
    free-threading mode.
  - gh-149816: Fix a race condition in memoryview with
    free-threading.
  - gh-149807: Fix hash(frozendict): compute the hash of each
    (key, value) pair correctly. Patch by Victor Stinner.
  - gh-149738: sqlite3: Disallow removing row_factory and
    text_factory attributes of a connection to prevent a crash
    on a query.
  - gh-139808: Add branch protections for AArch64 (BTI/PAC) in
    assembly code used by -X perf_jit (Linux perf profiler
    integration).
  - gh-149676: Fix frozendict | frozendict hash.
  - gh-148829: sentinel objects now support a repr= argument
    and their __module__ attribute is writable.
  - gh-149642: Allow imports inside exec() calls within
    functions under PYTHON_LAZY_IMPORTS=all.
  - gh-144957: Fix lazy from imports of module attributes
    provided by module-level __getattr__.
  - gh-149459: Fix a crash in the JIT optimizer when
    a specialized LOAD_SPECIAL guard deoptimized after
    inserting the synthetic NULL stack entry.
  - gh-148450: Fix abc.register() so it invalidates type
    version tags for registered classes.
  - Library
  - gh-150685: Update bundled pip to 26.1.2
  - gh-150228: The new site.StartupState class lets callers
    batch-process PEP 829 startup configuration files across
    multiple site directories before any startup code runs,
    with public addsitedir(), addusersitepackages(),
    addsitepackages(), and process() methods. The signature of
    site.addsitedir() is unchanged from Python 3.14. The
    defer_processing_start_files argument and the
    process_startup_files() function added earlier in the 3.15
    cycle have been removed; use site.StartupState instead.
  - gh-150406: Fix a possible crash occurring during socket
    module initialization when the system is out of memory on
    platforms without a reentrant gethostbyname.
  - gh-150372: readline: Fix a potential crash during tab
    completion caused by an out-of-memory error during module
    initialization.
  - gh-150157: Fix a crash in free-threaded builds that occurs
    when pickling by name objects without a __module__
    attribute while sys.modules is concurrently being modified.
  - gh-150175: Fix race condition in
    unittest.mock.ThreadingMock where concurrent calls could
    lose increments to call_count and other attributes due to
    a missing lock in _increment_mock_call.
  - gh-84353: Preserve non-UTF-8 encoded filenames when
    appending to a zipfile.ZipFile. Previously, non-ASCII names
    stored in a legacy encoding (without the UTF-8 flag bit
    set) could be corrupted when the central directory was
    rewritten: they were decoded as cp437 and then re-stored as
    UTF-8.
  - gh-149189: Revert the changes to pprint defaults. Patch by
    Hugo van Kemenade.
  - gh-149995: Update various docstrings in typing.
  - gh-88726: The email package now uses standard MIME charset
    names “gb2312” and “big5” instead of non-standard names
    “eucgb2312_cn” and “big5_tw”.
  - gh-149571: Fix the C implementation of
    xml.etree.ElementTree.Element.itertext(): it no longer
    emits text for comments and processing instructions.
  - gh-149921: Fix reference leaks in error paths of the
    _interpchannels and _interpqueues extension modules.
  - gh-142349: Add lazy to the list of support topic by help().
  - gh-149819: Fix regression in site.addsitedir() where .pth
    files were no longer processed in Python subprocesses. This
    happened because site.main() seeded known_paths with
    entries inherited from the parent process, causing
    addsitedir to skip .pth processing.
  - gh-149816: Fix a race condition in _random.Random.__init__
    method in free-threading mode.
  - gh-149801: Add IANA registered names and aliases with
    leading zeros before number (like IBM00858, CP00858,
    IBM01140, CP01140) for corresponding codecs.
  - gh-149718: Coalesce consecutive identical stack frames in
    Tachyon, so aggregating collectors (pstats, collapsed,
    flamegraph, gecko) receive one collect. Improves sample
    rate 3x, error rate and missed rate drop by 70%. Patch by
    Maurycy Pawłowski-Wieroński.
  - gh-149701: Fix bad return code from Lib/venv/bin/activate
    if hashing is disabled
  - gh-149504: Fix site.addsitedir() to allow re-entrant calls
    from within startup files. Previously, a .pth file
    containing an import line that called site.addsitedir() (or
    a .start entry point doing the same) could crash with
    RuntimeError: dictionary changed size during iteration
    during site initialization, breaking tools such as uv run
  - -with.
  - gh-149584: Fix excessive overhead in the Tachyon profiler
    when inspecting a remote process by avoiding repeated
    remote page-cache scans, batching predicted remote reads,
    and reusing cached profiler result objects. Patch by Pablo
    Galindo and Maurycy Pawłowski-Wieroński.
  - gh-139489: Add xml.is_valid_text() to xml.__all__.
  - gh-149614: Fix a regression that broke the ability to
    deepcopy argparse.ArgumentParser instances.
  - gh-112821: In the REPL, autocompletion might run arbitrary
    code in the getter of a descriptor. If that getter raised
    an exception, autocompletion would fail to present any
    options for the entire object. Autocompletion now works as
    expected for these objects.
  - gh-149534: Fix merging of collections.defaultdict and
    frozendict.
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149489: Fix ElementTree serialization to HTML. The
    content of comments, processing instructions and elements
    “xmp”, “iframe”, “noembed”, “noframes”, and “plaintext” is
    no longer escaped. The “plaintext” element no longer have
    the closing tag. Add support of empty attributes (with
    value None).
  - gh-149056: Fix json.load() not forwarding the array_hook
    argument to json.loads(). Patch by Thomas Kowalski.
  - gh-149046: io: Fix io.StringIO serialization: no longer
    call str(obj) on str subclasses. Patch by Thomas Kowalski.
  - gh-148441: xml.parsers.expat: prevent a crash in
    CharacterDataHandler() when the character data size exceeds
    the parser’s buffer size.
  - gh-146452: Fix segfault in pickle when pickling
    a dictionary concurrently mutated by another thread in the
    free-threaded build.
  - gh-86533: The os.makedirs() function and
    pathlib.Path.mkdir() method now have a parent_mode
    parameter to specify the mode for intermediate directories
    when creating parent directories. This allows one to match
    the behavior from Python 3.6 and earlier for os.makedirs().
  - gh-134261: zip: On reproducible builds, ZipFile uses UTC
    instead of the local time when writing file datetimes to
    avoid underflows.
  - gh-133998: Fix struct.error exception when creating a file
    with gzip.GzipFile or compressing data with gzip.compress()
    if the system time is outside the range 00:00:00 UTC,
    January 1, 1970 through 06:28:15 UTC, February 7, 2106, or
    explicitly passed mtime argument is outside the range 0 to
    2**32-1.
  - gh-128110: Fix bug in the parsing of email address headers
    that could result in extraneous spaces in the decoded text
    when using a modern email policy. Space between pairs of
    adjacent RFC 2047 encoded-words is now ignored, per section
    6.2 (and consistent with existing parsing of unstructured
    headers like Subject).
  - gh-107398: Fix tarfile stream mode exception when process
    the file with the gzip extra field.
  - gh-121109: Fix tarfile performance issue when reading
    archives in streaming mode (e.g. r|*).
  - bpo-45509: Gzip headers are now checked for corrupted NAME,
    COMMENT and HCRC fields.
  - Tests
  - gh-150387: Fix hang in
    test.test_profiling.test_sampling_profiler.test_live_collector_ui.TestLiveModeErrors.test_run_failed_script_live
    on slow buildbots. The test now always queues a final
    q keystroke so the live TUI loop exits even when the
    profiler collects enough samples to enter the post-finished
    input loop.
  - gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
    skip UDP Lite tests if it’s not supported. Patch by Victor
    Stinner.
  - Build
  - gh-148294: Corrected the use of AC_PATH_TOOL in
    configure.ac to allow a C++ compiler to be found on PATH.
  - gh-148260: On Linux when Python is linked to the musl
    C library, use a thread stack size of at least 1 MiB
    instead of musl default which is 128 kiB. Patch by Victor
    Stinner.
  - Tools/Demos
  - gh-150258: Update the tooltip on the Tachyon flame graph to
    show both absolute and relative percentages.
  - C API
  - gh-149725: Add PySentinel_CheckExact() for exact sentinel
    type tests to accompany the existing PySentinel_Check().
  - gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
    PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
    free threaded build.
  - Update to 3.15.0~b1:
  - Security
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.5.6.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-148252: Fixed string table and sample record bounds
    checks in _remote_debugging when decoding certain .pyb
    inputs on 32-bit builds. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping. (bsc#1262654,
    CVE-2026-6019)
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098,
    CVE-2026-6100).
  - gh-148252: Fixed stack depth calculation in
    _remote_debugging when decoding certain .pyb inputs on
    32-bit builds. Issue originally identified and diagnosed by
    Tristan Madani (@TristanInSec on GitHub).
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts.
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-137586: Fix a PATH-injection vulnerability in webbrowser
    on macOS where osascript was invoked without an absolute
    path. The new MacOS class uses /usr/bin/open directly,
    eliminating the dependency on osascript entirely.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method.
    (bsc#1261969, CVE-2026-1502)
  - Core and Builtins
  - gh-148940: Revert the process size based deferral of
    garbage collection (gh-133464). The performance issue this
    change resolves is also fixed by gh-142562. This approach
    has the problem that process size as seen by the OS (e.g.
    the resident size or RSS) does not immediately decrease
    after cyclic garbage is freed since mimalloc defers
    returning memory of the OS. This change applies to the
    free-threaded GC only.
  - gh-149243: Check for recursion limits in
    CALL_ALLOC_AND_ENTER_INIT opcode.
  - gh-126910: Add support for unwinding JIT frames using GNU
    backtrace. Patch by Diego Russo and Pablo Galindo
  - gh-149171: Allow assignment to the __module__ attribute of
    typing.TypeAliasType instances.
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-149049: Fix stack underflow for BINARY_OP in tier 2.
  - gh-83065: Fix a deadlock that could occur when one thread
    is importing a submodule (for example import pkg.sub.mod)
    while another thread is importing one of its parent
    packages (for example import pkg.sub) and that parent’s
    __init__.py itself imports the submodule. The import system
    now acquires module locks in hierarchical
    (parent-before-child) order so the two threads serialise
    instead of raising _DeadlockError.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148850: Fix the memory sanitizer false positive in
    os.getrandom().
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148829: Add sentinel, implementing PEP 661. PEP by Tal
    Einat; patch by Jelle Zijlstra.
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-148766: The interpreter help (such as python --help) is
    now in color. Patch by Hugo van Kemenade.
  - gh-148571: Fix a crash in the JIT optimizer when
    specialized opcode families inherited incompatible recorded
    operand layouts.
  - gh-148653: Forbid marshalling recursive code objects, slice
    and frozendict objects which cannot be correctly
    unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.15 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-146462: Added PyTypeObject.tp_basicsize,
    PyTypeObject.tp_dictoffset, and
    PyHeapTypeObject.ht_cached_keys offsets to _Py_DebugOffsets
    to support version-independent read-only dict introspection
    tools.
  - gh-145239: Unary plus is now accepted in match literal
    patterns, mirroring the existing support for unary minus.
    Patch by Bartosz Sławecki.
  - gh-148515: Fix a bug in the JIT optimizer reading operands
    for uops with multiple caches.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148398: Fix a bug in the JIT optimizer where class
    attribute loads were not invalidated after type mutation.
  - gh-146527: Add a GCMonitor class with a get_gc_stats method
    to the _remote_debugging module to allow reading GC
    statistics from an external Python process without
    requiring the full RemoteUnwinder functionality. Patch by
    Sergey Miryanov and Pablo Galindo.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-115802: Improve JIT code generation on Linux AArch64 by
    reducing the indirect call to external symbols. Patch by
    Diego Russo.
  - gh-148189: Repaired undercount of bytes in type-specific
    free lists reported by sys._debugmallocstats(). For types
    that participate in cyclic garbage collection, it was
    missing two pointers used by GC.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-95004: The specializing interpreter now specializes for
    enum.Enum improving performance and scaling in
    free-threading. Patch by Kumar Aditya.
  - gh-149202: Enable frame pointers by default for
    GCC-compatible CPython builds, including
  - mno-omit-leaf-frame-pointer, -marm on 32-bit ARM, and/or
  - mbackchain on s390x platforms when the compiler supports
    them, so profilers and debuggers can unwind native
    interpreter frames more reliably. Users can pass
  - -without-frame-pointers to ./configure to opt out.
  - gh-148014: Accept a function name in -X presite command
    line option and PYTHON_PRESITE environment variable. Patch
    by Victor Stinner.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - gh-146306: Specialize float true division in the tier
    2 optimizer with inplace mutation for uniquely-referenced
    operands.
  - gh-142186: Global sys.monitoring events can now be turned
    on and disabled on a per code object basis. Returning
    DISABLE from a callback disables the event for the entire
    code object (for the current tool).
  - gh-126910: Add support for unwinding JIT frames using GDB.
    Patch by Diego Russo and Pablo Galindo.
  - gh-146031: The unstable API
    _PyInterpreterState_SetEvalFrameFunc has a companion
    function
    _PyInterpreterState_SetEvalFrameAllowSpecialization to
    specify if specialization should be allowed. When this
    option is set to 1 the specializer will turn Python ->
    Python calls into specialized opcodes which the replacement
    interpreter loop can choose to respect and perform inlined
    dispatch.
  - gh-145278: The encodings is now partially frozen, including
    the aliases and utf_8 submodules.
  - The linecache is now frozen.
  - gh-134584: Optimize and eliminate redundant ref-counting
    for MAKE_FUNCTION in the JIT.
  - gh-143886: Reorder function annotations so positional-only
    arguments are returned before other arguments. This fixes
    how functools.singledispatch() registers functions with
    positional-only arguments.
  - gh-98894: Restore function__entry and function__return
    DTrace/SystemTap probes that were broken since Python 3.11.
  - gh-116021: Support for creating instances of abstract AST
    nodes from the ast module is deprecated and scheduled for
    removal in Python 3.20. Patch by Brian Schubert.
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-137600: ast: The constructors of AST nodes now raise
    a TypeError when a required argument is omitted or when
    a keyword argument that does not map to a field on the AST
    node is passed. These cases had previously raised
    a DeprecationWarning since Python 3.13. Patch by Brian
    Schubert.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-135357: Add support for socket.SO_PASSRIGHTS on Linux.
  - gh-134690: Removed deprecated in PEP 626 since Python 3.12
    codeobject.co_lnotab from types.CodeType.
  - gh-100239: Specialize BINARY_OP for concatenation of lists
    and tuples, and propagate the result type through
    _BINARY_OP_EXTEND in the tier 2 optimizer so that follow-up
    type guards can be eliminated.
  - Library
  - gh-148823: Defer the import of _colorize in argparse until
    needed for coloring output.
  - gh-141560: Add an annotation_format parameter to
    inspect.getfullargspec().
  - gh-139489: Add the xml.is_valid_text() function, which
    allows to check whether a string can be used in the XML
    document.
  - gh-142389: Add backticks to stdlib argparse help to display
    in colour. Patch by Hugo van Kemenade.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-142389: Add backtick markup support in argparse option
    help text to highlight inline code when color output is
    enabled. Patch by Hugo van Kemenade.
  - gh-148675: Remove F and D formats from array and
    memoryview. Patch by Victor Stinner.
  - gh-149342: Fix _remote_debugging binary writing so that
    sampling a thread whose Python frame stack is empty (for
    example while it is in a C call or mid-syscall) no longer
    raises RuntimeError("Invalid stack encoding type"), and so
    that BinaryWriter.total_samples after finalize() or
    context-manager exit includes samples flushed from the RLE
    buffer. Patch by Maurycy Pawłowski-Wieroński.
  - gh-149010: The inspect module CLI now reports as much
    information as it has available for non-source modules when
  - -details is specified, and provides an error message
    rather than a traceback when --details is omitted. It also
    reports improved information when the given target location
    is not the target’s defining location and when the given
    target is a data value rather than a class or function
    definition.
  - gh-146609: Use argparse for colour help timeit CLI. Patch
    by Hugo van Kemenade.
  - gh-142389: Add backticks for colour to regrtest and pdb’s
    help description. Patch by Hugo van Kemenade.
  - gh-144384: Lazily import _colorize. Patch by Hugo van
    Kemenade.
  - gh-149321: Fix import cycles exposed by running standard
    library modules with -X lazy_imports=none.
  - gh-145378: Generate consistent colors for pdb commands in
    pdb REPL.
  - gh-149296: Add a dump subcommand to profiling.sampling that
    prints a single traceback-style snapshot of a running
    process’s Python stack, including per-thread status, source
    line highlighting, optional bytecode opcode names, and
    async-aware task reconstruction. Patch by Pablo Galindo.
  - gh-143231: A module attribute has been added to
    warnings.WarningMessage.
  - gh-148675: ctypes: Change the _type_ of c_float_complex,
    c_double_complex and c_longdouble_complex from F, D and
    G to Zf, Zd and Zg for compatibility with numpy. Patch by
    Victor Stinner.
  - gh-148675: The array.typecodes type changed from str to
    tuple to support type codes longer than 1 character (Zf and
    Zd). Patch by Victor Stinner.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149231: In tomllib, the number of parts in TOML keys is
    now limited.
  - gh-143231: unittest.TestCase.assertWarns() and
    unittest.TestCase.assertWarnsRegex() no longer swallow
    warnings that do not match the specified category or regex.
    Nested context managers are now supported.
  - gh-149214: Fix _remote_debugging misreading non-ASCII
    Unicode strings (Latin-1, BMP and non-BMP) from a remote
    process. Filenames and function names that contain
    non-ASCII characters are now reported correctly in stack
    traces, the sampling profiler, and asyncio task
    introspection.
  - gh-149189: pprint now uses modern defaults: indent=4 and
    width=88, and the default compact=False output is now
    formatted similar to pretty-printed json.dumps(), with
    opening parentheses and brackets followed by a newline and
    the contents indented by one level. The expand parameter,
    added in 3.15.0a8, has been removed; compact=False (the
    default) now produces the former expand=True layout. Patch
    by Hugo van Kemenade.
  - gh-149173: Fix inverted PYTHON_BASIC_REPL environment check
    in pdb._pyrepl_available.
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-149009: Validate that profiling.sampling binary profiles
    do not contain more unique (thread, interpreter) pairs than
    declared in the header. Patch by Maurycy
    Pawłowski-Wieroński.
  - gh-148292: ssl: Update ssl.SSLSocket and ssl.SSLObject for
    OpenSSL 4. The classes now remember if they get
    a ssl.SSLEOFError. In this case, following read(),
    sendfile(), write(), and do_handshake() calls raise
    ssl.SSLEOFError without calling the underlying OpenSSL
    function. Thanks to that, ssl.SSLSocket behaves the same on
    all OpenSSL versions on EOF. Patch by Victor Stinner.
  - gh-149085: Add a max_threads keyword argument to
    faulthandler.dump_traceback(),
    faulthandler.dump_traceback_later(), faulthandler.enable(),
    and faulthandler.register().
  - gh-148641: pkgutil.resolve_name() gets a new optional,
    keyword-only argument called strict. The default is False
    for backward compatibility.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-149083: dataclasses.MISSING and dataclasses.KW_ONLY are
    now instances of sentinel.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-149026: Add colour to pickletools CLI output. Patch by
    Hugo van Kemenade.
  - gh-148991: Add colour to tokenize CLI output. Patch by Hugo
    van Kemenade.
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148981: Add color parameter to ast.dump().
  - gh-148849: Deprecate http.cookies.Morsel.js_output() and
    http.cookies.BaseCookie.js_output(), which will be removed
    in Python 3.19. Use http.cookies.Morsel.output() or
    http.cookies.BaseCookie.output() instead.
  - gh-146311: Add a canonical keyword-only parameter to the
    base16, base32, base64, base85, ascii85, and Z85 decoders
    in base64 and binascii. When true, encodings with non-zero
    padding bits (base16/32/64) or non-canonical encodings
    (base85/ascii85) are rejected. Single-character final
    groups in binascii.a2b_ascii85() and binascii.a2b_base85()
    are now always rejected as encoding violations, regardless
    of canonical; previously they were silently ignored and
    produced no output bytes.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-124397: The threading module added tooling to support
    concurrent iterator access: threading.serialize_iterator,
    threading.synchronized_iterator(), and
    threading.concurrent_tee().
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148688: bz2, compression.zstd, lzma, zlib: Fix a double
    free on memory allocation failure. Patch by Victor Stinner.
  - gh-148675: array, struct: Add support for Zd and Zf formats
    for double complex and float complex. Patch by Victor
    Stinner.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-148641: PEP 829 (package startup configuration files)
    implements a new format <name>.start parallel to <name>.pth
    files, to replace import lines in the latter.
  - gh-148639: Implement PEP 800, adding the
    @typing.disjoint_base decorator. Patch by Jelle Zijlstra.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148599: Update the socket module’s WSA error messages to
    match official documentation.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-144881: asyncio debugging tools (python -m asyncio ps
    and pstree) now retry automatically on transient errors
    that can occur when attaching to a process under active
    thread delegation. The number of retries can be controlled
    with the --retries flag. Patch by Bartosz Sławecki.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-121190: importlib.resources.files() now emits a more
    meaningful error message when module spec is None (as found
    in some __main__ modules).
  - gh-127012: importlib.abc.Traversable.read_text now
    allows/solicits an errors parameter.
  - gh-137855: Improve import time of dataclasses module by
    lazy importing re and copy modules.
  - gh-148352: Add more color to calendar’s CLI output. Patch
    by Hugo van Kemenade.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-130472: Integrate fancycompleter with import
    completions.
  - gh-148241: json: Fix serialization: no longer call str(obj)
    on str subclasses. Patch by Victor Stinner.
  - gh-148225: The profiling.sampling replay command now
    rejects non-binary profile files with a clear error
    explaining that replay only accepts files created with
  - -binary.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-148207: typing.TypeVarTuple now accepts bound,
    covariant, contravariant, and infer_variance parameters,
    matching the interface of typing.TypeVar and
    typing.ParamSpec.
  - gh-148100: Soft deprecate re.match() and re.Pattern.match()
    in favour of re.prefixmatch() and re.Pattern.prefixmatch().
    Patch by Hugo van Kemenade.
  - gh-147991: Improve tomllib import time (up to 10x faster).
    Patch by Victor Stinner.
  - gh-147957: Guarantees that collections.UserDict.popitem()
    will pop in the same order as the wrapped dictionary rather
    than an arbitrary order.
  - gh-146256: The profiling.sampling module now supports JSONL
    output format via --jsonl. Each run emits
    a newline-delimited JSON file that is sequentially
    parseable by external tools, scripts, and programmatic
    consumers. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146609: Add colour to timeit CLI output. Patch by Hugo
    van Kemenade.
  - gh-146563: xml.parsers.expat: add an exception note when
    a custom Expat handler return value cannot be properly
    interpreted. Patch by Bénédikt Tran.
  - gh-137586: Add MacOS to webbrowser for macOS, which opens
    URLs via /usr/bin/open instead of piping AppleScript to
    osascript. Deprecate MacOSXOSAScript in favour of MacOS.
  - gh-146406: Cross-language method suggestions are now shown
    for AttributeError on builtin types and their subclasses.
    For example, [].push() suggests append, (1,2).append(3)
    suggests using a list, None.keys() suggests expecting
    a dict, and 1.0.__or__ suggests using an int.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-146292: Add colour to BaseHTTPRequestHandler logs, as
    used by the http.server CLI. Patch by Hugo van Kemenade.
  - gh-145917: Add MIME types for TTC and Haptics formats to
    mimetypes. (Contributed by Charlie Lin in gh-145918.)
  - gh-145846: Fix memory leak in _lsprof when clear() is
    called during active profiling with nested calls.
    clearEntries() now walks the entire currentProfilerContext
    linked list instead of only freeing the top context.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145378: Use PyREPL as the default input console for pdb
  - gh-145244: Fixed a use-after-free in json encoder when
    a default callback mutates the dictionary being serialized.
  - gh-117716: Fix wave writing of odd-sized data chunks by
    appending the required RIFF pad byte and correcting the
    RIFF chunk size field accordingly.
  - gh-145200: hashlib: fix a memory leak when allocating or
    initializing an OpenSSL HMAC context fails.
  - gh-145056: Add support for frozendict in
    dataclasses.asdict() and dataclasses.astuple().
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-137855: Reduce the import time of dataclasses module by
    ~20%.
  - gh-70647: strptime() now raises ValueError when the format
    string contains %d without a year directive. Using %e
    without a year now emits a DeprecationWarning.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-142831: Fix a crash in the json module where
    a use-after-free could occur if the object being encoded is
    modified during serialization.
  - gh-108411: typing.IO and typing.BinaryIO method arguments
    are now positional-only.
  - gh-130273: Fix traceback color output with Unicode
    characters.
  - gh-142307: imaplib: deprecate support for IMAP4.file. This
    attribute was never meant to be part of the public
    interface and altering its value may result in unclosed
    files or other synchronization issues with the underlying
    socket. Patch by Bénédikt Tran.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-139489: Add the xml.is_valid_name() function, which
    allows to check whether a string can be used as an element
    or attribute name in XML.
  - gh-75707: Add optional mtime argument to tarfile.open(),
    for setting the mtime header field in .tar.gz archives.
  - gh-125862: The contextlib.contextmanager() and
    contextlib.asynccontextmanager() decorators now work
    correctly with generators, coroutine functions, and async
    generators when the wrapped callables are used as
    decorators.
  - gh-135528: http.cookiejar: add “tv”, “or”, “nom”, “sch”,
    and “web” to the default list of supported country code
    second-level domains.
  - gh-135056: Add a -H or --header CLI option to python -m
    http.server. Contributed by Anton I. Sipos.
  - gh-134551: Add t-strings support to pprint functions
  - gh-133956: Fix bug where @dataclass wouldn’t detect
    ClassVar fields if ClassVar was re-exported from a module
    other than typing.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-108951: asyncio: Add TaskGroup.cancel which cancels
    unfinished tasks and exits the group without raising
    asyncio.CancelledError.
  - gh-123853: Update the table of Windows language code
    identifiers (LCIDs) used by locale.getdefaultlocale() on
    Windows to protocol version 16.0 (2024-04-23).
  - gh-122476: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its local-part. Under a policy with utf8 set False,
    attempting to serialize such a message will now raise an
    HeaderWriteError. There is no valid 7-bit encoding for an
    internationalized local-part. Use email.policy.SMTPUTF8 (or
    another policy with utf8=True) to correctly pass through
    the local-part as Unicode characters.
  - gh-83938: The email module no longer incorrectly uses RFC
    2047 encoding for a mailbox with non-ASCII characters in
    its domain. Under a policy with utf8 set False, attempting
    to serialize such a message will now raise an
    HeaderWriteError. Either apply an appropriate IDNA encoding
    to convert the domain to ASCII before serialization, or use
    email.policy.SMTPUTF8 (or another policy with utf8=True) to
    correctly pass through the internationalized domain name as
    Unicode characters.
  - gh-81074: The email module no longer treats email addresses
    with non-ASCII characters as defects when parsing a Unicode
    string or in the addr_spec parameter to
    email.headerregistry.Address. RFC 5322 permits such
    addresses, and they were already supported when parsing
    bytes and in the Address username parameter.
  - The (undocumented) email.errors.NonASCIILocalPartDefect is
    no longer used and should be considered deprecated.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-113471: Allow http.server to set a default content-type
    when serving files with an unknown or missing extension.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - gh-96894: Do not turn echo off for subsequent commands in
    batch activators (activate.bat and deactivate.bat) of venv.
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Tests
  - gh-149425: Increase time delta in
    test.test_zipfile.test_core.OtherTests.test_write_without_source_date_epoch
  - gh-148600: Add OpenSSL 4.0.0 support to test
    configurations.
  - Build
  - gh-149353: Avoid unnecessary JIT-related rebuilds during
    make install after --enable-optimizations builds.
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-149252: Update to WASI SDK 33.
  - gh-148690: Windows free-threaded builds now output to
    a different default path with default filenames, for
    example, PCbuild/amd64t/python.exe rather than
    PCbuild/amd64/python3.15t.exe. The PC/layout script has
    been updated to ensure compatibility of generated layouts.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148644: Errors during the PGO training job on Windows
    are no longer ignored, and a non-zero return code will
    cause the build to fail.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-148483: Use Py_GCC_ATTRIBUTE(unused) for stop_tracing
    label.
  - gh-148474: Fixed compilation of Python/pystrhex.c with
    older clang versions.
  - gh-146445: The Android build tools have been moved to the
    Platforms folder.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - gh-138451: Allow for custom LLVM path using
    LLVM_TOOLS_INSTALL_DIR during JIT build.
  - gh-133312: Add a new ./configure option
  - -enable-static-libpython-for-interpreter which, when used
    with --enable-shared, continues to build the shared library
    but does not use it for the interpreter. Instead, libpython
    is statically linked into the interpreter, as if
  - -enable-shared had not been used. This allows you to do
    a single build and get a Python interpreter binary that
    does not use a shared library but also get a shared library
    for use by other programs.
  - Windows
  - gh-149254: Updated bundled version of OpenSSL to 3.5.6.
  - gh-148690: Non-freethreaded builds on Windows now support
    extensions linked to python3t.dll, and will include a copy
    of that library in normal installs that references the
    non-freethreaded runtime.
  - gh-146458: Fix incorrect REPL height and width tracking on
    console window resize on Windows. macOS
  - gh-142295: For Python macOS framework builds, update
    Info.plist files to be more compliant with current Apple
    guidelines. Original patch contributed by Martinus Verburg.
  - gh-149254: Update macOS installer to use OpenSSL 3.5.6.
  - IDLE
  - gh-94523: Detect file if modified at local disk and prompt
    to ask refresh. Patch by Shixian Li.
  - gh-139551: Support rendering BaseExceptionGroup in IDLE.
  - gh-89520: Make IDLE extension configuration look at user
    config files, allowing user-installed extensions to have
    settings and key bindings defined in ~/.idlerc.
  - C API
  - gh-149225: PyCriticalSection and related functions are
    added to the Stable ABI.
  - gh-149216: PyType_WatchCallback callbacks registered via
    PyType_AddWatcher() are now also invoked when a watched
    heap type is deallocated. Previously, type watchers were
    only notified of modifications, which could cause stale
    references when a type was freed and its address was
    reused.
  - gh-149101: Implement PEP 788.
  - gh-149044: Implement PEP 820: Unified slot system for the
    C API.
  - gh-148267: Using Py_LIMITED_API on a non-Windows
    free-threaded build no longer needs an extra
    Py_GIL_DISABLED.
  - gh-145559: Rename _Py_DumpTraceback and
    _Py_DumpTracebackThreads to PyUnstable_DumpTraceback() and
    PyUnstable_DumpTracebackThreads().
  - gh-146636: Implement PEP 803 – abi3t: Stable ABI for
    Free-Threaded Builds.
  - gh-146302: Py_IsInitialized() no longer returns true until
    initialization has fully completed, including import of the
    site module. The underlying runtime flags now use atomic
    operations.
  - gh-146063: Add PyObject_CallFinalizerFromDealloc() function
    to the limited C API. Patch by Victor Stinner.
  - gh-145921: Add functions that are guaranteed to be safe for
    use in tp_traverse handlers:
    PyObject_GetTypeData_DuringGC(),
    PyObject_GetItemData_DuringGC(),
    PyType_GetModuleState_DuringGC(),
    PyModule_GetState_DuringGC(), PyModule_GetToken_DuringGC(),
    PyType_GetBaseByToken_DuringGC(),
    PyType_GetModule_DuringGC(),
    PyType_GetModuleByToken_DuringGC().
  - Remove upstreamed patches:
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-6100-use-after-free-decompression.patch
  - For &ix86 we build `--without-frame-pointers`

++++ qbittorrent:

  - Update tp version 5.2.2
    Added features:
    * Use D-Bus to show file in file managers
    Bug fixes:
    * Fix friendlyUnitCompact precision calculation
    * Remove all top-level folders
    * Use proper API for checking exit status
    * Delete stale lockfile when hostname mismatch
    * Fix wrong removal procedure of watched folder paths
    * Don't reannounce before interface changes are applied
    * Use Latin script for Bosnian locale name
    Web UI:
    * Fix performance of global checkbox toggling
    * Fix Safari transfer list header misalignment
    * Fix error when submitting magnet before metadata loads
    * Use correct row id when updating Rss Downloader feed selection
    * Use SameSite=Lax for session cookie to fix cross-site login
    * Bring back properties panel expand/collapse button
    Web API:
    * Only use X-Forwarded-Host header when reverse proxy support is
    enabled
    RSS:
    * Fix "RSS Smart Episode Filter" RegEx
    * Fix previously matched episode format

++++ ruby-build:

  - Update to version 20260616.
    Changelog: https://github.com/rbenv/ruby-build/releases/tag/v20260616
    * Mark Ruby 3.2 as EOL by @CamJN in #2623
    * Add JRuby 9.4.15.0 by @headius in #2627
    * Add JRuby 10.0.6.0 by @headius in #2628

++++ sequoia-sqv:

  - update nettle-sys in vendored dependencies to fix compilation
    with LLVM / clang 22, see upstream MR#34

++++ sshpass:

  - add
    0001-Fix-Segmentation-fault-in-e-mode-when-environment-va.patch
    (bsc#1268297)

++++ tar:

  - Fix tar changing dir permissions temporarily even when using --no-overwrite-dir
    * no-overwrite-dir-fix.patch
  - Fix CVE-2026-5704, crafted archives can be used to to hide file injection
    (bsc#1261900)
    * CVE-2026-5704.patch
  - Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450)
    * fix-dereference.patch
  - Fix extraction failure for paths like "a/./b" caused by the gnulib openat2
    implementation (bsc#1267189)
    * openat2-fix-dotlike-failure.patch

++++ vexctl:

  - Update to version 0.4.4:
    * fix signature duplication
    * fix lints
    * housekeeping - deps update and ci cleanup
    * build(deps): Bump chainguard-dev/actions in the all group
    * build(deps): Bump chainguard-dev/actions in the all group
    * build(deps): Bump the all group with 2 updates
    * build(deps): Bump github.com/sigstore/sigstore in the all group
    * build(deps): Bump github.com/sigstore/rekor in the all group
    * build(deps): Bump golangci/golangci-lint-action in the all group

++++ virt-v2v:

  - bsc#1268361 - virt-v2v prevents vmdp from running on first boot
    for Windows VMs
    dont-chmod-windows-paths.patch
    revert01-convert-Use-quoted-string-literals-in-many-places.patch
    revert02-remove-timeout-before-installing-virtio-win-drivers.patch
    revert03-Ignore-ERROR_NO_MORE_ITEMS-status-from-PnPUtil.patch
    revert04-Modify-configure_pnputil_install-script.patch
    revert05-firstboot.bat-must-not-reboot-VM-on-error-code-250.patch

++++ wicked2nm:

  - Require minimum cargo version 1.78 for lockfile version 4 parsing

++++ xpra:

  - Update to version 6.5:
    * https://github.com/Xpra-org/xpra/releases/tag/v6.5
  - 🔧 Platforms, build and packaging:
    * use wasapi2 on MS Windows
    * support for Linux Mint in install scripts
    * fix cursor scaling on MS Windows
    * macOS notarization preparation
    * PoC native MS Windows client backend
    * add printing build option on MS Windows
    * ArchLinux setup support
    * remove libspng codecs
  - 🖧 Network:
    * re-enable ssl-protocol=TLS_CLIENT by default
    * per authentication module options
    * re-connect fails for seamless remote ssh start
    * http error pages overrides
    * expose http headers to authentication modules
    * client support for WebTransport connections
    * handle X11 buffered reads without timers
  - ⚡ OpenGL:
    * Catmull-Rom bicubic scaling shader
    * sigmoid upscaling and anti-ringing upscale shader
    * MS Windows can use OpenGL for opaque-region-covered alpha windows
    * fix NV12 shader
    * support YUV420P16 natively
    * faster client startup with opengl=nocheck
  - 🌈 Encodings:
    * MediaFoundation hardware video decoder for MS Windows
    * pre-process screen updates with filters (ie: pytorch)
    * prefer AV1
    * NVENC supports lossless mode with hevc
  - 🕮  Documentation:
    * network diagnostics
    * subsystems
  - ✨ Features:
    * wayland backend
    * memory savings and optimizations
    * wireshark dissector
    * multiple content-types per window
    * faster content-type detection
    * content aware cairo upscaling filter
    * session recording client and replay tool
    * asynchronous initialization
    * more specific content types
    * notification forwarding fixes and improvements
    * fido2 authentication module
    * support image/png with Gtk clipboard backend (Wayland)
    * monitor geometry syncing tools
    * snap window resize to increment grid
    * support free-threaded builds
    * better unit test coverage
    * xpra top GUI
  - 📷 Webcam:
    * window mode
    * libcamera backend
  - 💄 Cosmetic:
    * honour MS Windows dark / light theme
    * session info graph labels for HiDPI displays
    * window encoders details in session info

++++ zim:

  - Update to 0.77.0:
    * Merge markdown support as source format for notebooks
    (experimental)
    * Allow multiple source formats in one notebook
    * Refactor page search to be extendable improve speed
    * Support options for 'case sensitive' and 'word boundaries' in
    page search
    * Let find match glob patterns like search
    * Add search query support for tasklist filtering
    * Add default page template to notebook properties
    * Add input for alternate text in Insert Image Dialog
    * Remove overruling window positioning
    * Fix latex templates for working with pdflatex, xelatex and
    lualatex
    * Fix bug with _object_widgets.remove()
  - Drop upstreamed 0001-Fix-bug-with-_object_widgets-weakset.patch

------------------------------------------------------------------
------------------  2026-6-15  -  Jun 15 2026  -------------------
------------------------------------------------------------------

++++ OpenImageIO:

  - Update to 3.1.14.1
  - build: Fix build break when auto-build pystring is needed,
    after it updated to v1.2.0. #5235
  - admin: Clarify security policy to explain what qualifies as a
    vulnerability. #5232
  - admin: Misc administrative docs fixups. #5233

++++ agama:

  - Version 22
  - Unify text with the UI (gh#agama-project/agama#3637).
  - Fixed copying URL credentials to the target system (bsc#1267881)
  - Improve the "agama monitor" and "agama status" texts
    (gh#agama-project/agama#3621).
  - Mark properly autoinst retry question as the one that should
    return value for new url (gh#agama-project/agama#3623)

++++ agama-products:

  - Version 22

++++ agama-web-ui:

  - Version 22
  - Fix the configuration dialog: keep the JSON preview read-only
    and avoid the duplicated ".json" extension in the downloaded
    file name (gh#agama-project/agama#3631).
  - Unify some texts with the command-line tools
    (gh#agama-project/agama#3634).
  - Minor text update in the dialog to retry loading the configuration
    (gh#agama-project/agama#3621).

++++ agama-yast:

  - Version 22

++++ alsa:

  - Update to alsa-lib 1.2.16.1:
    a minor fix release, updating UCM and conf API.
    For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.16_v1.2.16.1#alsa-lib

++++ alsa-ucm-conf:

  - Update to alsa-ucm-conf 1.2.16.1:
    a minor fix update, addressing various regressions and fixes.
    For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.16_v1.2.16.1#alsa-ucm-conf

++++ apko:

  - Update to version 1.2.17:
    * build(deps): bump go.opentelemetry.io/otel/trace from 1.43.0 to
    1.44.0 (#2256)
    * build(deps): bump go.opentelemetry.io/otel from 1.43.0 to
    1.44.0 (#2258)
    * build(deps): bump go.step.sm/crypto from 0.81.0 to 0.82.0
    (#2270)
    * build(deps): bump chainguard.dev/sdk from 0.1.55 to 0.1.57
    (#2275)
    * build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0
    (#2265)
    * build(deps): bump google.golang.org/api from 0.280.0 to 0.283.0
    (#2262)
    * fix(auth): let chainctl write to terminal for interactive login
    (#2276)
    * paths: preserve setuid/setgid/sticky bits in permissions
    (#2274)
    * build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#2264)
    * build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0
    (#2266)
    * build(deps): bump github/codeql-action from 4.36.0 to 4.36.2
    (#2267)
    * build(deps): bump chainguard-dev/actions from 1.6.19 to 1.6.22
    (#2272)
    * build(deps): bump gopkg.in/ini.v1 from 1.67.2 to 1.67.3 (#2273)
    * Match apk-tools' provider comparison ordering in the solver
    (#2271)
    * expandapk: materialize uncompressed .dat.tar atomically (#2269)

++++ aws-c-s3:

  - Update to version 0.12.6
    * Support s2n-tls on macOS by @sfod in (#640)
    * fix copy object mpu by @sbiscigl in (#643)
    * CopyObject limitations by @TingDaoK in (#641)

++++ btrfsprogs:

  - update to 7.0
    * btrfstune: add ability to do offline conversion to the remap tree
    (experimental feature)
    * mkfs: add hole detection when precalculating size for --rootdir
    * fixes: recognize fs-verity tree items in various tools (check)
    * enable PCLMUL implementation on Musl (previously using SSE 4.2 at best)
    * help format changed to be in line with common packages like util-linux
    * reject writes to filesystem during check/btrfstune in case there's pending
    state of device replace or balance
    * other:
    * build ARM64 static binaries (attached to GH release) backward
    compatibility level is 'archv8-a'
    * CI updates
    * documentation updates

++++ coturn:

  - Update to version 4.13.1
    * null-terminate server_name in stun_is_challenge_response_str.
    * Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks.
    * Auto-deny coturn's own database backend endpoints as relay
    peers.
    * Deny link-local / ULA / site-local relay peers by default.

++++ cpuid:

  - Update to release 20260503
    * Added synth decoding for Medusa Point, Fire Range, Granite
    Ridge, Ryzen 200, Hawk Point Refresh, Bartlett Lake, Xbox
    Series S/X (ProjectX), Zhaoxin KaiXian/KX-7000, Wildcat Lake
    * Added showing CPPC floor performance counter, Matrix Multiple &
    Reversal instruction availability, RMPCHKD instruction
    availability.

++++ crmsh:

  - Update to version 5.1.0+20260615.8409ea5a:
    * Dev: bootstrap: add a warning about deprecating unencrypted/unauthenticated knet transport (jsc#PED-16433)
    * Dev: bootstrap: update warning about deprecating legacy transports (jsc#PED-16433)

++++ dabstar:

  - Update to version 5.3.0
    * Fixed issue #118: scan failures when the DC avoidance algorithm
    is enabled.
    * Cleaned up various GUI elements.
    * Added missing ITU code table entries for ITU Region 3: Asia
    and the Pacific.
    * Renamed Ensemble List filter labels for improved clarity.
    * Added several minor fixes and improvements.

++++ dealers-choice:

  - dealers-choice 0.0.15:
    * regression fix: joining a hand in progress no longer crashes the client
    * deckhandler: shuffle and recycle the discard pile when the deck runs out
    mid-draw, fixing duplicate cards dealt in multi-player draw games
    * pokeval: fix California lowball tie-breaks

++++ libdnf-plugin-txnupd:

  - Backport fix from upstream to fix linking with libtukit
    + Patch: 3add4c39b5506f8bfafd1daca3bf6165e55c5e18.patch

++++ exfatprogs:

  - Update to 1.4.2:
    Changes:
    * exfatprogs: install lsdosattr and chdosattr in /bin instead of
    /sbin.
    Bug fixes:
    * dump.exfat: prevent heap buffer overflow in name parsing.

++++ facetimehd:

  - Update to version 0.7.0.2
    * Fixes apps that need sequence and timestamps (PipeWire / gstreamer)

++++ faugus-launcher:

  - Bump to version 1.22.4
  - Upstream changes:
    * Fixed launch arguments with spaces
  - For version 1.22.3:
    * Updated screenshots
    * Updated Portuguese translation
    * Remove game from custom order
    * New Launch Arguments UI
    * italian translation for 1.22
    * Update proton_manager.py
    * Revert "Merge pull request #730 from Ganeron11/clean"
    * Update proton_manager.py
    * centralize .exe icon extraction into utils.py
  - For version 1.22.2:
    * Revert "centralize .exe icon extraction into utils.py"
    * centralize variant config into VARIANTS dict and throttle progress updates
    * Add files via upload
    * Update faugus-launcher.po ja 1.22.1
    * code cleanup
  - For version 1.22.1:
    * Updated screenshots
    * Show icon when moving game
    * Removed the HDR option
    * Updated Portuguese translation
    * Added custom sort
    * remove unused variables
    * Clean up launcher.py
    * remove unused imports
    * Sort alphabetically when menu is not displayed
    * Fixed category ids
    * Added another lsfg-vk path
    * Updated Portuguese translation
    * Remember sort and category
    * remove redundant nested condition and simplify validate_settings_field
    * Fixed latest played and update list
    * translate backup and window settings
    * Renamed categories checkbox
    * Added sort button
    * Reworked Categories interface
    * centralize json operations to utils.py
    * centralize game field mapping to uitls.py
    * Added zoom slider for banners
    * centralize .exe icon extraction into utils.py
    * extract duplicated image file filter into shared function
    * use shared ConfigManager instead of local implementation
    * centralize update_games_json to utils.py
    * centralize on_button_kofi_clicked and on_button_paypal_clicked to utils.py
    * centralize on_button_search_protonfix_clicked to utils.py
    * centralize find_largest_resolution to utils.py
    * centralize on_entry_query_tooltip to utils.py
    * centralize on_entry_changed to utils.py
    * Updated the Chinese (Traditional) translation
    * centralize is_valid_image to utils.py
    * skip update_icon() in check_running() when no games active
    * centralize path constants in path_manager.py
    * extract common command check helper
    * polish(zh-CN): change 3 entries
    * centralize lossless scaling env vars into utils.py
    * fix(zh-CN): correct 1 entry
    * centralize IS_FLATPAK to path_manager_py
    * centralize canberra-gtk-play calls into play_notification_sound()
    * italian translation for 1.21
    * add_windows_file_filters to utils.py
    * refactor: move format_title to utils.py
    * remove redundant LOG_DIR lookup
    * translate(zh-CN): completed chinese simplified translation and polished old entries

++++ forgejo-longterm:

  - Update to version 15.0.3:
    + Changelog for versions:
  - 15.0.3: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.3.md
  - 15.0.2: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.2.md
  - 15.0.1: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.1.md
  - 15.0.0: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.0.md
  - 14.0.0: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/14.0.0.md
  - 13.0.0: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.0.md
  - 12.0.0: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/12.0.0.md

++++ forgejo-runner:

  - add config.yaml as %ghost, use _sharedstatedir

++++ ftxui:

  - Update to 7.0.0:
    See https://github.com/ArthurSonzogni/FTXUI/releases/tag/v7.0.0

++++ gap:

  - Update to release 4.16.0
    * Added `EnumeratorOfPartitionsSet` enumerator.
    * Added `IsGenericMatrixRep` matrix object type.
    * Added `PositionNonZeroInRow` for matrices and matrix objects.
    * Added `DirectSumGModule`.
    * Added `IsSquareMat` and `IsAntisymmetricMat`.
    * Added `IsSymmetricMatrix`.
    * Added `RandomMatrix`, `RandomInvertibleMatrix`; and fix a
    problem with a new feature for matrix groups.
    * Added `ConformalSymplecticGroup`.
    * Added `AddMatrix`, `MultMatrix` (plus explicit left/right side
    variants) for in-place modification of matrices.
    * Added `FoldLeft`, `FoldLeftX`; and `ForAllX`, `ForAnyX`,
    `FilteredX`, `NumberX`, `PerformX` to complement `ListX`,
    `SetX`, `SumX`, `ProductX`.

++++ gap-classicalmaximals:

  - Initial package (version 1.1) for build.opensuse.org

++++ gap-examplesforhomalg:

  - Update to release 2025.12.01
    * No changelog was provided

++++ gap-gapdoc:

  - Update to release 1.6.10
    * No changelog was provided

++++ gap-gauss:

  - Update to release 2025.12.01
    * No changelog was provided

++++ gap-gaussforhomalg:

  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-generalizedmorphismsforcap:

  - Update to release 2025.12.01
    * No changelog was provided

++++ gap-gradedmodules:

  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-gradedringforhomalg:

  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-hapcryst:

  - Update to release 0.2.0
    * Change `TranslationsToBox` back to returning a list, resolve
    inconsistencies between its documentation and behavior.
    * Fix `DimensionSquareMat` to actually reject non-square
    matrices, and also to return `fail` instead of raising an error
    for bad inputs (as documented).
    * Fix `IsSquareMat` to not return true for every matrix.

++++ gap-homalg:

  - Update to release 2025.12.01
    * No changelog was provided
  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-ibnp:

  - Update to release 0.18
    * Fixed the example which failed to abort: added qo-example.tst

++++ gap-io_forhomalg:

  - Update to release 2025.12.01
    * No changelog was provided

++++ gap-linearalgebraforcap:

  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-localizeringforhomalg:

  - Update to release 2026.04.01
    * No changelog was provided
  - Initial package (version 2.1.0) for build.opensuse.org

++++ gap-matgrp:

  - Update to release 0.73
    * No changelog was provided

++++ gap-matricesforhomalg:

  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-modulargroup:

  - Initial package (version 2.0.2) for build.opensuse.org
  - Update to release 2026.04.01
    * No changelog was provided

++++ gap-monoidalcategories:

  - Update to release 2026.05.02
    * No changelog was provided

++++ gap-nconvex:

  - Update to release 2025.12.02
    * No changelog was provided

++++ gap-nofoma:

  - Initial package (version 1.0.1) for build.opensuse.org

++++ gap-ringsforhomalg:

  - Update to release 2026.05.01
    * No changelog was provided

++++ gap-sco:

  - Update to release 2025.12.01
    * No changelog was provided

++++ gap-walrus:

  - Update to release 0.9992
    * Updates to the testsuite and CI/CD scripts

++++ hledger-ui:

  - Update hledger-ui to version 1.52.1 revision 2.
    Upstream has revised the Cabal build instructions on Hackage.

++++ ghc-vty:

  - Update vty to version 6.6.
    6.6
  - --
    * Added support for horizontal scrolling inputs. The `Button` type in
    `Graphics.Vty.Input.Events` got new constructors `BScrollLeft` and
    `BScrollRight` for Vty backend implementations that support horizontal
    scrolling inputs.

++++ ghc-vty-unix:

  - Update vty-unix to version 0.3.0.0.
    Upstream has edited the change log file since the last release in
    a non-trivial way, i.e. they did more than just add a new entry
    at the top. You can review the file at:
    http://hackage.haskell.org/package/vty-unix-0.3.0.0/src/CHANGELOG.md

++++ libcamera:

  - Update to release 0.7.1
    * The software now uses the C++20 dialect.
    * The "SoftISP" now supports multi-threaded Debaying.
    * Improved the RKISP1 IPA and Mali-C55 hardware specific code,
    including for enabling cmaera support on Renesas RZ/V2H and
    RZ/V2NP platforms.

++++ kernel-default:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-source:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-source-longterm:

  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 56e7bc4
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit 926094e

++++ kernel-docs:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-firmware-amdgpu:

  - Update to version 20260614 (git commit 8d7543434b2d):
    * amdgpu: DMCUB updates for various ASICs

++++ kernel-firmware-bluetooth:

  - Update to version 20260614 (git commit 8d7543434b2d):
    * rtl_bt: Update RTL8852A BT USB firmware to 0x244F_91B6
    * QCA: Update Bluetooth WCN3950 firmware 1.3.0-00108 to 1.3.0-00184

++++ kernel-firmware-qcom:

  - Update to version 20260614 (git commit 8d7543434b2d):
    * qcom: update CDSP firmware for shikra platform

++++ kernel-firmware-realtek:

  - Update to version 20260614 (git commit 8d7543434b2d):
    * realtek: rt1321: Update the patch code to v1.10

++++ kernel-kvmsmall:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-longterm:

  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 56e7bc4
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit 926094e

++++ kernel-obs-build:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-obs-qa:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-syms:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kernel-syms-longterm:

  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 56e7bc4
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit 926094e

++++ kernel-vanilla:

  - Delete
    patches.suse/media-ipu-bridge-Add-upside-down-sensor-DMI-quirk-fo.patch.
    This patch was merged to 7.1-rc1, so it was applied twice.
  - commit b572de5
  - Refresh
    patches.suse/selftests-namespaces-Fix-waitpid-race-in-listns_efault_tes.patch.
  - Refresh
    patches.suse/selftests-namespaces-Kill-grandchild-in-nsid-fixture-teard.patch.
  - Refresh
    patches.suse/selftests-namespaces-Skip-efault-tests-when-listns-is-not-.patch.
    Update upstream status.
  - commit 2ebf0bc
  - Update patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch.
    Replace arch_ima_get_secureboot() call by arch_get_secureboot() to update
    for 7.1 kernel.
  - commit e6e2f10
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
    (cherry picked from commit c7a57a2b24918f1dd3365e56210b4f0aae663f16)
  - apparmor: fix use-after-free in rawdata dedup loop (bko#221513).
  - commit 5807b63
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
    (cherry picked from commit 65d5a585a9fea5f40a1da0e20217aa062f95b44a)
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
    (cherry picked from commit 43454f55637bff80a9bbe035dd7a8c52cb494e83)
  - apparmor: fix uninitialised pointer passed to
    audit_log_untrustedstring() (bsc#1259668).
  - apparmor: don't audit files pointing to aa_null.dentry
    (bsc#1259668).
  - commit d8bfaae

++++ kitty:

  - Update to 0.47.4:
    * Linux: Fix a regression in the previous release that broke rendering of
    bitmap color fonts (#10145)
    * Linux: Allow fake italics defined via a matrix in fontconfig settings to
    work for fonts like Fira Code that do not ship with an italic face (#10120)

++++ kmod:

  - riscv-hwprobe.patch: handle riscv_hwprobe in syscall wrapper, fixes testsuite

++++ kubevirt1.8:

  - Fork of kubevirt 1.8.3 as the versioned package kubevirt1.8,
    so multiple KubeVirt minor releases can be maintained in parallel
    (packaged like kubectl). Provides/Obsoletes the unversioned
    kubevirt-* subpackages.

++++ libabigail:

  - Update to release 2.10
    * Speedup compute_aliases_for_elf_symbol
    * Fix assert on split debug info with no program headers

++++ suitesparse:

  -  Don't build with openblas for SLE 16.1

++++ libcamera-full:

  - Update to release 0.7.1
    * The software now uses the C++20 dialect.
    * The "SoftISP" now supports multi-threaded Debaying.
    * Improved the RKISP1 IPA and Mali-C55 hardware specific code,
    including for enabling cmaera support on Renesas RZ/V2H and
    RZ/V2NP platforms.

++++ libcfile:

  - Update to release 20260615
    * Testsuite updates

++++ libcthreads:

  - Update to release 20260615
    * Testsuite updates

++++ libexe:

  - Update to release 20260524
    * The python3 layer uses the wide char API now
  - Delete system-libs.patch (obsolete)

++++ lldpd:

  - Add libcap-devel to BuildRequires to build with support for
    libpcap.  This will allow the monitor process to drop its
    privileges instead of running as root, improving security.

++++ luajit:

  - riscv64-support.patch: apply bugfix from
    openresty/luajit2/pull/236#issuecomment-4706366520

++++ lzma-sdk:

  - Update to release 26.01
    * Some minor bugs were fixed

++++ libmspub:

  - Force -std=gnu++17 when compiling with GCC >= 16 to fix the
    broken build

++++ ncurses:

  - Add ncurses patch 20260613
    + add ich/ich1 to putty -TD
    + reorder %i's in some capabilities for better matching of blocks -TD
    + add sc/rc to ti928 -TD
    + add rin to ncr260vt300an and ncr260vt100an, matching the AT&T
    ind/indn -TD
    + add rwidm, kdch1 to att730 -TD
    + change %2d and %3d to %02d and %03d to match original termcaps -TD
    + reduce unnecessary %2d and %3d to just %d -TD
    + correct conversion of termcap %2 and %3 to terminfo in _nc_captoinfo.

++++ openjph:

  - Update to 0.28.1:
    * Fix 32-bit x86 build of the AVX2 block decoder #281

++++ libqxp:

  - Add autoreconf to fix configure not detecting boost headers
  - Force -std=gnu++17 when compiling with GCC >= 16 to fix
    deprecation warnings

++++ s2n:

  - Update to version 1.7.4
    * test: add integration tests for serialization (#5861)
    * ci: fix OpenSSL 1.0.2u download in Rust bindings CI (#5868)
    * refactor: reset d2i pointer before private key type-hint fallback (#5844)
    * ci: update to CBMC 6.9.0 (#5867)
    * refactor(metrics-subscriber): key handshake counters by IANA id (#5858)
    * test: document io behaviors (#5864)
    * chore: update fxhash dependency (#5869)
    * refactor(metrics-subscriber): serialize FrozenCounter as a list (#5870)
    * fix: relax cert key preferences requirement (#5860)
    * build(deps): update s2n-codec requirement from 0.78 to 0.79
    in /bindings/rust/standard (#5872)
    * fix(config): Re-complete domain cert map after failed add (#5846)
    * feat(metrics-subscriber): Public access to types for deserialization (#5875)
    * build(deps): bump the all-gha-updates group across 1 directory with 2 updates (#5878)
    * build(deps): update s2n-codec requirement from 0.79 to 0.80
    in /bindings/rust/standard (#5874)
    * chore: bindings release 0.3.37 (#5882)
    * refactor: add iovec definition for Windows (#5880)
    * refactor: disable MLock on Windows (#5881)
    * test(metrics-subscriber): add memory profile test (#5883)
    * refactor: gate KTLS module out of Windows build (#5886)
    * refactor: replace MIN/MAX with S2N_MIN/S2N_MAX to remove
    <sys/param.h> dependency (#5879)
    * feat(metrics-subscriber): pluggable synthetic-traffic detector (#5885)
    * fix: validate pointer parameters in public API functions (#5889)
    * feat(serialize): add SSLv3 and TLS 1.0 CBC implicit IV preservation (#5873)
    * refactor(metrics-subscriber): cache parsed ClientHello lists (#5884)
    * feat(metrics-subscriber): add operation field to Attribution (#5892)
    * chore: release metrics subscriber v0.0.3 (#5896)
    * fix: pad DH shared secret to constant length (#5778)
    * feat: add PQ-compatible variants of security policies (#5887)
    * build(deps): bump aws-actions/configure-aws-credentials from
    6.1.1 to 6.1.3 in /.github/workflows in the all-gha-updates
    group across 1 directory (#5894)
    * feat: add unstable API to allow IP addresses in CN for hostname validation (#5897)
    * refactor: gate socket support for Linux only (#5895)
    * ci: set up Windows MSYS2 Github Actions (#5898)
    * chore: add new team member (#5899)
    * build(deps): update tabled requirement from 0.20.0 to 0.21.0
    in /bindings/rust/standard (#5901)
    * build(deps): bump the all-gha-updates group in /.github/workflows
    with 3 updates (#5902)
    * build(deps): update s2n-codec requirement from 0.80 to 0.81
    in /bindings/rust/standard (#5900)
    * feat(metrics-schema): Seperate out schema serialization from
    s2n-tls-metrics-subscriber (#5877)
    * feat(event): add security policy label to handshake event (#5893)
    * fix: enable s2n-tls feature probes on Windows (#5907)
    * test(metrics): add EMF snapshot test (#5909)
    * refactor(metrics snapshot test): use per-unit measurements (#5910)
    * refactor: make MetricLabel more generic (#5912)

++++ sg3_utils:

  - Update to version 1.48+35.c49e7c08:
    * configure.ac: reset version to 1.48

++++ python-torch:

  - Backport upstream patch to fix build on aarch64:
    * xnnpack-aarch64-fix.patch

++++ python-torch-openmpi4:

  - Backport upstream patch to fix build on aarch64:
    * xnnpack-aarch64-fix.patch

++++ ublksrv:

  - Hardcode version during compilation for --version (bsc#1268274)
  - Add 0001-targets-fix-potential-buffer-overflow-in-memmove.patch (bsc#1268274)

++++ vinyl-cache:

  - Update to release 9.0.1
    * A deficiency in HTTP/2 request parsing has been fixed by
    properly comparing pseudo-header names instead of doing a
    prefix match. [boo#1267553, CVE-2026-50052]
  - Add 0001-Fix-DESTDIR-builds.patch

++++ melange:

  - Update to version 0.53.3:
    * fix(qemu): pass SLIRP DNS address via kernel cmdline when
    QEMU_NET_CIDR is set (#2570)
  - Update to version 0.53.2:
    * build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 in
    the gomod group (#2569)
    * build(deps): bump the gomod group across 1 directory with 12
    updates (#2567)

++++ mesheryctl:

  - update to 1.0.43:
    * General
  - Bump shell-quote from 1.8.3 to 1.8.4 in
    /install/docker-extension/ui @dependabot[bot] (#19948)
  - [Docs] Fix broken mesheryctl reference page anchor links
    @copilot-swe-agent[bot] (#20029)
  - Update MAINTAINERS.md: Add Mericio's last name and adjust
    table formatting. @simihablo (#20005)
  - fix(tests): remove seeding assertions from
    MapPreferencePersister test @ishwar170695 (#19602)
  - Update integrations-updater.yml @marblom007 (#20002)
    * Meshery CLI
  - Restucture docs and fix 404 path resolve, toggle relative Url
    to false @CodexRaunak (#19997)
    * Maintenance
  - Add sparse checkout @CodexRaunak (#19998)
  - Update hugo.yml @CodexRaunak (#20007)
  - ci(docs): sparse, blobless checkout for Hugo Pages deploy
    @leecalcote (#20004)
  - CI: Bump notify-providers to include additional provider
    @sarajkrishnasingh (#20000)
  - Restucture docs and fix 404 path resolve, toggle relative Url
    to false @CodexRaunak (#19997)
    * Documentation
  - [Docs] Fix broken Credential Schema hyperlink @emphor11
    (#19990)
  - Revise description for Academies extension @winkletinkle
    (#20026)
  - Fix link to meshery-academy in documentation @marblom007
    (#20027)
  - Restucture docs and fix 404 path resolve, toggle relative Url
    to false @CodexRaunak (#19997)
  - [Docs] Fix broken mesheryctl registry hyperlinks in registry
    concept … @aprv10 (#19988)
  - fix: improve mobile search experience @Sbragul26 (#19881)

++++ mistral-vibe:

  - Update to 2.16.0:
  - Added
  - Fuzzy search in slash command autocomplete
  - Syntax-highlighted, line-numbered, theme-aware diffs for
    file edits
  - Changed
  - `/resume` now scopes the session picker to the current
    folder
  - Clipboard copy confirmations now appear inline instead of
    stacking toast notifications
  - ACP teleports now use the client title as the Vibe Code
    project name when no explicit project name is co nfigured
  - Fixed
  - ACP max-output-token responses now stop gracefully with
    `max_tokens` instead of surfacing internal error s
  - Context-too-long responses wrapped as HTTP 422 are now
    classified correctly
  - SSE streams are parsed on CR/LF boundaries only, avoiding
    crashes on valid Unicode line separators in JS ON strings
  - CLI banner now shows the Free plan correctly
  - Mistral backend no longer sends reasoning content when
    model thinking is off
  - Add fix_tests.patch (gh#mistralai/mistral-vibe!796) which fixes
    test failures in build environments

++++ nekobox:

    Update to 5.11.21
  - Add happ links and full JSON subscription support
  - Add ability to modify or disable indicator borders
  - Improve basic settings functionality

++++ open-vmdk:

  - Remove Legal-Review-Notice again
  - Remove pytest/configs/EULA.txt during %prep:
    it contains VMware proprietary EULA text used only as pytest test
    fixture data and is not required for building or running
    open-vmdk/vmdk-tools.

++++ passt:

  - Add 0001-SELinux-Dontaudit-access-to-dri-devices.patch to dontaudit DRI
    AVCs for pasta (bsc#1259898)
  - Install pesto, its SELinux policy and man page
  - Update to version 20260612.a9c61ff:
    * util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning
    * conf, util: Disable IPv6 if explicit IPv6 socket probe fails
    * tcp_splice: Improve EOF and read stall exit conditions
    * passt, tcp: Inline CALL_PROTO_HANDLER() and merge tcp_timer()
    * tcp_splice: Remove questionable "optimisation" of pending bytes tracking
    * tcp_splice: Simplify / correct OUT_WAIT flag handling
    * tcp_splice: Simplify shutdown(2) handling
    * tcp_splice: Remove goto from forwarding loop
    * tcp_splice: Improve EOF exit condition for the loop
    * tcp_splice: Simplify EPOLLRDHUP / eof / FIN handling
    * tcp_splice: Remove never-invoked SO_RCVLOWAT logic
    * tcp: Don't leak sockets on error paths
    * tcp, tcp_splice: Make helper for setting SO_LINGER socket option
    * vhost_user: Offer VIRTIO_NET_F_GUEST_CSUM
    * ip: Wrap CASE macro body in braces for pre-C23 compatibility
    * tcp_splice: Simplify tracking of read/written bytes
    * tcp_splice: Clean up flow control path for splice forwarding
    * tcp_splice: Avoid missing EOF recognition while forwarding
    * tcp_splice: Improve error reporting
    * tcp_vu: Support multibuffer frames in tcp_vu_send_flag()
    * tcp_vu: Support multibuffer frames in tcp_vu_sock_recv()
    * tcp_vu: Build headers on the stack and write them into the iovec
    * tcp: Encode checksum computation flags in a single parameter
    * udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()
    * iov: Introduce IOV_PUSH_HEADER() macro
    * udp_vu: Allow virtqueue elements with multiple iovec entries
    * selinux: Allow pasta to create and use its control socket when started by Podman
    * Makefile: Remove misleading comments on BASE_*FLAGS
    * netlink: Fix comments to variables for netlink sockets and sequence
    * netlink: Use regular request/response netlink socket for initial neighbour sync
    * conf, repair, tap: Document reasons for blocking Unix sockets
    * tap: Report accept() errors
    * treewide: Add SOCK_CLOEXEC to accept() calls that are missing it
    * vhost-user: Centralise Ethernet frame padding in vu_collect() and vu_pad()
    * tcp: Pass explicit data length to tcp_fill_headers()
    * vu_common: Pass explicit frame length to vu_flush()
    * pcap: Pass explicit L2 length to pcap_iov()
    * checksum: Pass explicit L4 length to checksum functions
    * udp_vu: Pass iov explicitly to helpers instead of using file-scoped array
    * udp_vu: Move virtqueue management from udp_vu_sock_recv() to its caller
    * vu_common: Move vnethdr setup into vu_flush()
    * iov: Add iov_memcpy() to copy data between iovec arrays
    * iov: Introduce iov_memset()
    * util: Fix changes to assert_with_msg()
    * fwd_rule: Allow parsing * as a forwarding address
    * fwd_rule: Don't attempt dual stack listen()s if only one IP family
    * test: Add test for builds with -DNDEBUG
    * Fix build with -DNDEBUG
    * test: Extend exeter build tests to cover more recent binaries
    * lib/term: Quote tr character ranges to prevent glob expansion
    * pesto: Run static checkers on pesto sources
    * passt-repair: Run static checkers
    * passt-repair: Simplify construction of Unix path from inotify
    * passt-repair: Split out inotify handling to its own function
    * Makefile: Split static checker targets
    * cppcheck, clang-tidy: Static checkers don't need non-preprocessor flags
    * Makefile: Split $(FLAGS) into cpp and cc components
    * Makefile: Add header dependencies for secondary binaries
    * Makefile: Remove unhelpful $(HEADERS) variable
    * Makefile: Use common binary compilation rule
    * Makefile: Make conditional definition of $(BIN) clearer
    * Makefile: Use make variables for static checker configuration
    * clang-tidy: Suppress some new unhelpful new warnings
    * treewide: Make some additional variables static
    * packet, clang-tidy: Packet pool buffers are not NULL
    * clang-tidy: Suppress sscanf() warning harder
    * clang-tidy: Squash inconsistent brace warnings in foreach macros
    * conf: Fix not-actually-const parameter to conf_runas() and conf_ugid()
    * virtio: Reduce scope of variable
    * netlink: erromsg should be const in nl_status()
    * hooks: Copy static build of pesto and related man page to server
    * fedora: Install pesto, its SELinux policy, and the man page from the spec file
    * selinux: Add file context and type enforcement for pesto
    * apparmor: Add policy file for pesto
    * pesto, conf, fwd_rule: Add options and modes to add, delete, clear rules
    * fwd_rule: Fix static checkers warnings in fwd_rule_add()
    * conf, fwd: Allow switching to new rules received from pesto
    * pesto, conf: Send updated rules from pesto back to passt/pasta
    * pesto: Parse and add new rules from command line
    * pesto: Read current ruleset from passt/pasta and optionally display it
    * inany: Prepare inany.[ch] for sharing with pesto tool
    * ip: Prepare ip.[ch] for sharing with pesto tool
    * pesto: Expose list of pifs to pesto and display them
    * pesto, conf: Have pesto connect to passt and check versions
    * pesto, log: Share log.h (but not log.c) with pesto tool
    * pesto: Introduce stub configuration tool
    * fwd_rule: Fix some format specifiers
    * pif: Limit pif names to 128 bytes
    * fwd: Generalise fwd_rules_info()
    * fwd_rule: Move conflict checking back within fwd_rule_add()
    * fwd, conf: Move rule parsing code to fwd_rule.[ch]
    * fwd_rule: Move ephemeral port probing to fwd_rule.c
    * conf, fwd: Stricter rule checking in fwd_rule_add()
    * tcp: Use SO_MEMINFO for accurate send buffer overhead accounting
    * tcp: Handle errors from tcp_send_flag()
    * fwd, conf: Add capabilities bits to each forwarding table
    * conf: Don't pass raw commandline argument to conf_ports_spec()
    * conf: Move SO_BINDTODEVICE workaround to conf_ports()
    * conf: Allow user-specified auto-scanned port forwarding ranges
    * conf: Move "all" handling to port specifier
    * doc: Rework man page description of port specifiers
    * tcp: Replace send buffer boost with EPOLLOUT monitoring
    * conf: Rework checking for garbage after a range
    * conf: Rework stepping through chunks of port specifiers
    * conf: Don't be strict about exclusivity of forwarding mode
    * fwd: Improve error handling in fwd_rule_add()
    * fwd_rule: Move rule conflict checking from fwd_rule_add() to caller
    * fwd: Split rule building from rule adding
    * conf: Pass protocol explicitly to conf_ports_range_except()
    * fwd_rule: Move forwarding rule formatting
    * fwd: Better split forwarding rule specification from associated sockets
    * conf: Permit -[tTuU] all in pasta mode
    * doc: Consolidate -[tu] option descriptions for passt and pasta
    * conf: Move first pass handling of -[TU] next to handling of -[tu]
    * conf: Simplify handling of default forwarding mode
    * conf: Split parsing of port specifiers from the rest of -[tuTU] parsing
    * tap, tcp, udp: Use rate-limited logging
    * conf: use a single buffer for print formatting in conf_print()
    * log: Add rate-limiting macros for log messages
    * fwd: Split forwarding rule specification from its implementation state
    * bitmap: Split bitmap helper functions into their own module
    * ip: Define a bound for the string returned by ipproto_name()
    * conf: Remove redundant warning when SO_BINDTODEVICE is unavailable
    * conf: Move check for disabled interfaces earlier
    * conf: Move check for mapping port 0 to caller
    * conf: Don't bother complaining about overlapping excluded ranges
    * fwd, conf: Expose ephemeral ports as bitmap rather than function
    * fwd: Allow FWD_DUAL_STACK_ANY flag to be passed directly to fwd_rule_add()
    * fwd: Store forwarding tables indexed by (origin) pif
    * fwd: Look up rule index in fwd_sync_one()
    * fwd: Move selecting correct scan bitmap into fwd_sync_one()
    * serialise: Add helpers for serialising unsigned integers
    * serialise: Split functions user for serialisation from util.c
    * vhost_user: Fix assorted minor cppcheck warnings
    * fwd: Comparing rule can be const
    * conf: runas can be const
    * treewide: Spell ASSERT() as assert()
    * vu_common: Move iovec management into vu_collect()
    * vu_handle_tx: Pass actual remaining out_sg capacity to vu_queue_pop()
    * virtio: Pass iovec arrays as separate parameters to vu_queue_pop()
    * pif: Remove unused PIF_NAMELEN
    * doc: Fix formatting of (DEPRECATED) notes in man page
    * Makefile: Use $^ to avoid duplication in static checker rules
    * conf: Parse all forwarding options at the same time
    * conf: Don't defer handling of --dns option
    * fwd: Always open /proc/net{tcp,tcp6,udp,udp6} in pasta mode
    * fwd: Unify TCP and UDP forwarding tables
    * fwd: Split forwarding table from port scanning state
    * Fix misnamed field in struct ctx comments
    * fwd: Don't initialise unused port bitmaps
    * tcp: Remove stale description of port_to_tap field
    * conf, fwd: Make overall forwarding mode local to conf path
    * netlink: Allow NULL to be passed as addr parameter to nl_addr_get (again)
    * netlink: Return prefix length for IPv6 addresses in nl_addr_get()
    * iov: Add iov_truncate() helper and use it in vu handlers
    * tcp: Avoid comparison of expressions with different signedness in RTT_SET()
    * tcp: Avoid comparison of expressions with different signedness in tcp_timer_handler()
    * migrate: Rename v1 address functions to v2 for clarity
    * vu_common: Always set num_buffers in virtio-net header
    * clang-tidy: Don't insist on #ifdef over #if defined()
    * fwd, pif: Replace with pif_sock_l4() with pif_listen()
    * tcp: Use flow_foreach_of_type() in tcp_{keepalive,inactivity}
    * Add missing includes to headers
    * tcp: Send TCP keepalive segments after a period of tap-side inactivity
    * tcp: Extend tcp_send_flag() to send TCP keepalive segments
    * tcp: Re-introduce inactivity timeouts based on a clock algorithm
    * tcp: Remove non-working activity timeout mechanism
    * tcp_vu, udp_vu: Fix comment headers for header length functions
    * Fix build when HAS_GETRANDOM is undefined
    * tcp_vu, udp_vu: Account for virtio net header in minimum frame size
    * tcp_vu: vu_pad() expects l2 length
    * conf: Support CIDR notation for -a/--address option
    * virtio: Introduce VNET_HLEN macro for virtio net header length
    * tcp: Move tap header update out of tcp_fill_headers()
    * udp: Split activity timeouts for UDP flows
    * checksum: add VSX fast path for POWER8/POWER9
    * migrate: Use forward table information to close() listening sockets
    * tcp, tcp_splice: Check for failures of shutdown(2)
    * tcp: Eliminate FIN_TIMEOUT
    * tcp: Retransmit FINs like data segments
    * tcp_splice: Force TCP RST on abnormal close conditions
    * tcp: Properly propagate tap-side RST to socket side
    * doc: Add test program verifying socket RST behaviour
    * tcp: Add error checking for flow_epoll_set() in tcp_flow_migrate_target()

++++ perl-Config-IniFiles:

  - updated to 3.002000
    see /usr/share/doc/packages/perl-Config-IniFiles/Changes

++++ perl-URI:

  - updated to 5.350.0 (5.35)
    see /usr/share/doc/packages/perl-URI/Changes
    5.35      2026-06-14 23:04:12Z
  - Strip leading zeros from port numbers in canonical URIs (GH#69) (GH#162)

++++ prek:

  - Update to version 0.4.5:
    * Highlights
    0.4.5 completes prek's pre-commit language coverage. With R,
    Conda, Perl, and coursier now supported, prek supports every
    language available in pre-commit, plus prek-only modern
    languages such as Bun and Deno.
    This is full feature parity with pre-commit. The last major
    compatibility gap is closed, and prek is now on the path to
    1.0.
    * Enhancements
  - Add Perl language support (#2201)
  - Add R language support (#2206)
  - Add Conda language support (#2203)
  - Add coursier language support (#2194)
  - Add group filters to list (#2152)
  - Remove legacy repo path support (#2150)
  - Skip cloning fully filtered remote repos (#2151)
    * Performance
  - Avoid building JSON trees in syntax hooks (#2156)
  - Scan mixed line endings without line vector (#2160)
  - Skip file scan for always-run no-filename hooks (#2155)
  - Use fixed buffer for EOF scan (#2163)
  - Use fixed buffer for private key scan (#2164)
    * Bug fixes
  - Fix pretty-format-json CRLF handling (#2210)
  - Handle missing blobs in diff snapshots (#2211)
  - Ignore coursier channel from working repo (#2202)
    * Dependencies
  - Update Rust crate assert_fs to v1.1.4 (#2183)
  - Update Rust crate async_zip to 0.0.18 (#2217)
  - Update Rust crate http to v1.4.1 (#2184)
  - Update Rust crate ignore to v0.4.26 (#2218)
  - Update Rust crate mea to v0.6.4 (#2185)
  - Update Rust crate memchr to v2.8.1 (#2186)
  - Update Rust crate reqwest to v0.13.4 (#2187)
  - Update Rust crate serde-saphyr to 0.0.27 (#2188)
  - Update Rust crate toml_edit to v0.25.12 (#2189)
  - Update Rust crate which to v8.0.3 (#2219)
  - Update dependency uv to v0.11.17 (#2182)
  - Update dependency uv to v0.11.19 (#2214)

++++ pspp:

  - fix build with gcc15 boo#1268308, add pspp-2.1.1-fix-gcc15.patch

++++ python-click:

  - Update to 8.4.1:
    * get_parameter_source() is available during eager callbacks and
    type conversion again.
    * Zsh completion scripts parse correctly on Windows.
    * Shell completion of Enum values used as Choice options produces a
    valid completion result.
    * Fix empty byte-string handling in echo.
    * Fix closed file error with echo_via_pager.
    * Fix open_url on Windows when the file path contains spaces.
    Version 8.4.0:
    * ParamType typing improvements.
  - ParamType is now a generic abstract base class, parameterized by
    its converted value type.
  - ~ParamType.convert return types are narrowed on all concrete
    types (str for STRING, int for INT, etc.).
  - ~ParamType.to_info_dict returns specific ~typing.TypedDict
    subclasses instead of dict[str, Any].
  - CompositeParamType and the number-range base are now generic
    with abstract methods.
    * Refactor convert_type to extract type inference into a private
    _guess_type helper, and add typing.overload signatures.
    * Parameter typing improvements.
  - Parameter is now an abstract base class, making explicit that it
    cannot be instantiated directly.
  - Parameter.name is now str instead of str | None. When
    expose_value=False, the name is set to "" instead of None.
  - The ctx parameter of Parameter.get_error_hint is now typed
    as Context | None, matching the runtime behavior.
    * Split string values from default_map for parameters with nargs > 1
    or Tuple type, matching environment variable behavior.
    * Auto-detect type=UNPROCESSED for flag_value of non-basic types
    (not str, int, float, or bool), so programmer-provided Python
    objects like classes and enum members are passed through unchanged
    instead of being stringified. Previously type=click.UNPROCESSED
    had to be set explicitly.
    * The error hint now uses Command.get_help_option_names to
    pick non-shadowed help option names, so Try '... -h' no longer
    points to a subcommand option that shadows -h. The longest
    surviving name is shown (--help over -h) for readability.
    * Fix readline functionality on non-Windows platforms. Prompt text
    is now passed directly to readline instead of being printed
    separately, allowing proper backspace, line editing, and line
    wrapping behavior.
    * Use os.startfile on Windows to open URLs in open_url,
    replacing the start built-in which cannot be invoked without
    shell=True.
    * Fix Fish shell completion errors when option help text contains
    newlines.
    * Add NoSuchCommand exception with suggestions for misspelled
    commands.
    * Use ValueError message when conversion in FuncParamType would
    fail.
    * Add click.get_pager_file for file-like access to an output pager.
    * ~click.formatting.wrap_text now measures line width in visible
    characters, ignoring ANSI escape sequences.
    * Fix HelpFormatter.write_usage emitting only a blank line
    when called without args. The usage prefix and program name are
    now written even when no arguments follow, and the trailing
    separator space is stripped so the line ends at the program name.
    * Show custom error messages from types when prompt with
    hide_input=True fails validation, instead of always showing a
    generic message. Built-in type messages mask the input value.
    * Add capture parameter to CliRunner with two modes: sys
    (default) and fd. fd redirects file descriptors 1 and 2 via
    os.dup2 so output that bypasses sys.stdout (stale stream
    references, C extensions, subprocesses, faulthandler) is captured
    with proper isolation.
    * Revert the 8.3.3 change that exposed the original file descriptor
    via fileno() on the redirected CliRunner streams in the default
    capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI
    no longer mutate the host runner's stdout, which broke Pytest's
    fd-level capture teardown. C-level consumers that need a real fd
    should use capture="fd".
    * Mark additional built-in strings with gettext() to extend
    translation coverage.
    * Fix feature switch groups (several flag_value options sharing one
    parameter name) silently dropping an explicit default when a
    sibling option without an explicit default was declared first.
    Arbitration is now source-aware: a more explicit
    ParameterSource always wins, and within
    ParameterSource.DEFAULT, an option that received an explicit
    default= keyword wins over a sibling whose default was
    auto-derived. The 8.3.x first-wins fallback for remaining ties was
    reverted to the pre-8.3.x last-wins fallback.
    * Fix missing space between option help text and the (DEPRECATED)
    label, and localize the option label so it matches the command
    label. The label and the DeprecationWarning reason suffix are now
    produced by shared helpers.
    * Document short option stacking (-abc is parsed as -a -b -c) and
    clarify that multi-character short option names are not supported.

++++ python-azure-mgmt-cloudhealth:

  - New upstream release
    + Version 1.0.0b2
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-devhub:

  - New upstream release
    + Version 1.0.0b2
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Adjust upstream source name in spec file
  - Drop extra LICENSE.txt as upstream now ships its own
  - Remove unzip package from BuildRequires
  - Rename LICENSE.txt to LICENSE in %files section
  - Switch source archive format to TAR.GZ
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-healthbot:

  - Initial build
    + Version 1.0.0

++++ python-azure-mgmt-napsteromniagentapi:

  - Initial build
    + Version 1.0.0b1

++++ python-azure-mgmt-standbypool:

  - New upstream release
    + Version 2.1.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-storagemover:

  - New upstream release
    + Version 3.1.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Update Requires from pyproject.toml

++++ python-celery:

  - Return click-plugins to requiremets, still needed

++++ python-dask:

  - update to 2026.6.0:
    * Improve pandas 3.1 compatibility, including
    add_prefix/add_suffix and DataFrame.drop changes
    (:pr:`12414`, :pr:`12447`) `Guido Imperiale`_
    * Fix groupby compatibility with pandas 2.2 and 2.3 and test
    against intermediate NumPy and pandas versions (:pr:`12372`)
    `Guido Imperiale`_
    * Store empty arrays with Zarr 3.2.0 (:pr:`12366`) `Guido
    Imperiale`_
    * Fix quantile and nanquantile behavior (:pr:`12380`) `Guido
    Imperiale`_
    * Add support for Cholesky decomposition with complex dtypes
    (:pr:`12416`) `Niclas Rieger`_
    * Fix dataframe correctness issues in DataFrame.merge and
    Series.map (:pr:`12430`, :pr:`12432`) `nn`_, `Mike
    Evdokimov`_
    * Overhaul the publish_dataset extension (:pr-
    distributed:`9217`) `Guido Imperiale`_
    * Overhaul task stream handling (:pr-distributed:`9230`, :pr-
    distributed:`9282`, :pr-distributed:`9293`) `Guido
    Imperiale`_, `MohammadYusif`_
    * Fix a race condition in SubprocessCluster startup (:pr-
    distributed:`9292`) `Guido Imperiale`_
    * Clean up deprecated Distributed APIs across scheduler,
    worker, CLI, plugin, and progress handling (:pr-
    distributed:`9222`, :pr-distributed:`9225`, :pr-
    distributed:`9238`, :pr-distributed:`9240`, :pr-
    distributed:`9250`) `Guido Imperiale`_
    * Migrate CI and local workflows to Pixi (:pr:`12389`, :pr-
    distributed:`9276`) `Guido Imperiale`_
    * Add AI contribution guidance with AGENTS.md and CLAUDE.md
    (:pr:`12415`, :pr-distributed:`9279`) `Guido Imperiale`_
    * Add PyPI release workflows with GitHub Actions Trusted
    Publishing (:pr:`12452`, :pr-distributed:`9297`) `Matthew
    Rocklin`_
  - stop testing for python 3.10 and 3.11

++++ python-distributed:

  - update to 2026.6.0:
    * Add PyPI release workflow @mrocklin
    * Fix test failures caused by port 8787 already in use
    @crusaderky
    * Migrate from black to `ruff format` @crusaderky
    * SubprocessCluster: fix random crash on start @crusaderky
    * Refactor get_task_stream @crusaderky
    * fix: use task-stream index instead of wall clock in
    get_task_stream context manager (#9253) @MohammadYusif
    * Bump actions/checkout from 6.0.2 to 6.0.3
    @[dependabot[bot]](https://github.com/apps/dependabot)
    * Bump codecov/codecov-action from 6 to 7
    @[dependabot[bot]](https://github.com/apps/dependabot)
    * Do not build the distributed pixi package twice @crusaderky
    * Fix flaky `test_steal_twice` and `test_steal_when_more_tasks`
    @crusaderky
    * Clarify scheduler unpickling in protocol docs @peter941221
    * Reinstate no-queue tests @crusaderky
    * Bump release-drafter/release-drafter from 6 to 7
    @[dependabot[bot]](https://github.com/apps/dependabot)
    * Clarify unsatisfied resource restrictions in resource docs
    @peter941221
    * Fix import-time coverage @crusaderky
    * Improve CLI error message for unknown options to dask worker
    (#9094) @ernestprovo23
    * Run (most) CUDA tests in pixi @crusaderky
    * Migrate CI to pixi @crusaderky
    * Add AGENTS.md / CLAUDE.md; add guidelines re. AI pull
    requests @crusaderky
    * Fix tests vs. NumPy nightly builds @crusaderky
    * uvloop tests @crusaderky
    * Fix flaky `test_call_stack_future` @crusaderky
    * drop dependency on 'urllib3' @jameslamb
    * Remove `avoid_ci` mark @crusaderky
    * Print host_info in CI without needing NumPy @crusaderky
    * Fix typos @crusaderky
    * Support pixi in dask/dask CI @crusaderky
    * Truncate large coro repr in retry log output @ernestprovo23
    * Add explicit check for name not None @maneesh29s
    * XFAIL `test_scheduler_bokeh.py::test_simple` in Windows
    @crusaderky
    * Clean up deprecated loop properties and parameters
    @crusaderky
    * Clean up deprecations in Scheduler, Worker, Nanny @crusaderky
    * Clean up deprecated client context in different tasks/threads
    @crusaderky
    * Clean up deprecated Prometheus metrics @crusaderky
    * Clean up deprecations in `distributed.deploy` @crusaderky
    * Clean up deprecated `stream` RPC handler argument @crusaderky
    * Clean up deprecations in CLI @crusaderky
    * Clean up deprecations in `security` @crusaderky
    * Clean up deprecated rpc synchronous context manager
    @crusaderky
    * Clean up deprecated async listener.stop() @crusaderky
    * Clean up deprecations in register_plugin @crusaderky
    * Clean up deprecations in `SchedulerPlugin.remove_worker`
    @crusaderky
    * Clean up minimum pyarrow version checks @crusaderky
    * Partial review of task streams @crusaderky
    * Update outdated work stealing docs regarding worker
    restrictions @kevinziroldi
    * Fix memray CI; move back from mamba to conda @crusaderky
    * Install keras with conda @crusaderky
    * Clean up Cython @crusaderky
    * Use `@dataclass(slots=True)` (with constraints from Python
    <3.14) @crusaderky
    * Type annotations for `client.Future` @crusaderky
    * Clean up deprecated Lock client parameter @crusaderky
    * Clean up deprecated nested_deserialize @crusaderky
    * Clean up deprecations in `distributed.compatibility`
    @crusaderky
    * Clean up deprecations in utils_test @crusaderky
    * Clean up deprecations in `distributed.utils` @crusaderky
    * Clean up deprecations in ProgressBar @crusaderky
    * Run more tests when requests is not installed @crusaderky
    * Standardize and increase async_poll_for timeout @crusaderky
    * Relax unreasonably short test timeouts @crusaderky
    * Use f-strings @DimitriPapadopoulos
    * Bump actions/checkout from 4.1.3 to 6.0.2
    @DimitriPapadopoulos
    * [trivial] Update link to bokeh sources in comment @crusaderky
    * Apply ruff/pyupgrade rule UP031 @DimitriPapadopoulos
    * Homogeneous environment names @DimitriPapadopoulos
    * Bump codecov/codecov-action from 3 to 6
    @[dependabot[bot]](https://github.com/apps/dependabot)
    * Overhaul `publish_dataset` extension @crusaderky
    * Fix flaky `test_mixing_clients_same_scheduler` @crusaderky
    * `@contextmanager` should return `Generator[T]` @crusaderky
    * Fix flaky `test_actor.py::test_failed_worker` @crusaderky
    * Clean up info parameters in transition to memory @crusaderky
    * Move state validation from Scheduler to SchedulerState
    @crusaderky
    * Bump to black 26.3.1 @crusaderky
    * Tweak scheduler annotations @crusaderky
    * Bump conda-incubator/setup-miniconda from 3.2.0 to 4.0.1
    @[dependabot[bot]](https://github.com/apps/dependabot)
    * Fix typos @DimitriPapadopoulos
    * Bug: dashboard would not show no-worker tasks @crusaderky
    * See the Changelog for more information.
  - skip building + testing for python 3.11

++++ python-immutabledict:

  - skip performance tests in OBS

++++ python-pandas:

  - skip testing for python 3.11

++++ python-pygit2:

  - update to 1.19.3:
    * Memory fixes #1368 #1417 #1443
    * Fix Repository.ident #1461
    * Documentation and annotation fixes #410 #1289 #1323 #1333 #1458 #1460

++++ python-reproject:

  - skip builds for python311 for the test flavor.

++++ python-requests-cache:

  - add avoid-vacuum-in-transaction.patch

++++ quickjs:

  - Switch back to upstream release version
  - own lib folder from devel package
  - Update to version 2026-06-04:
    * added custom malloc for small blocks (11% faster on bench-v8)
    * micro optimizations (30% faster on bench-v8)
    * added resizable array buffers
    * added ArrayBuffer.prototype.transfer
    * added the Iterator object and methods
    * added set methods
    * added Atomics.pause
    * added added Map and WeakMap upsert methods
    * added Math.sumPrecise()
    * added regexp duplicate named groups
    * added base64 and hexadecimal encodings for Uint8Array
    * misc bug fixes

++++ raspberrypi-firmware:

  - Enable 3D video hardware acceleration for RPi5 based boards.

++++ raspberrypi-firmware-config:

  - Enable 3D video hardware acceleration for RPi5 based boards.

++++ raspberrypi-firmware-config-camera:

  - Enable 3D video hardware acceleration for RPi5 based boards.

++++ rpmlint:

  - Update to version 2.9.0+git20260528.2490edb3:
    * dbus-services: whitelist qSnapper (bsc#1261537)
    * Bump github/codeql-action from 4.35.2 to 4.36.0
    * BuildRootAndDateCheck: Convert date errs to warning
    * Bump github/codeql-action from 4.35.1 to 4.35.2
    * Update openSUSE's licenses.toml
    * Fix: Add sysusers.d to usrlibbinaryexception
    * SpecCheck: Fix typo in the 'no-%check-section' explanation
    * Bump github/codeql-action from 4.34.1 to 4.35.1
    * test: Add PKG-INFO to egg-info mocks for Python 3.15 compatibility
    * Reorder param doc rpmlint/checks/TagsCheck.py
    * test: Add more tests for dependencies
    * test: Add tests for SELinuxIndependentModuleCheck
    * TagsCheck: Reorder is_devel and is_source parameters
    * Add SELinuxIndependentModuleCheck to test_lint.py
    * Set scoring for selinux-incorrect-if-file-location
    * Add check for SELinux Independent Modules

++++ rpmlint-strict:

  - Update to version 2.9.0+git20260528.2490edb3:
    * dbus-services: whitelist qSnapper (bsc#1261537)
    * Bump github/codeql-action from 4.35.2 to 4.36.0
    * BuildRootAndDateCheck: Convert date errs to warning
    * Bump github/codeql-action from 4.35.1 to 4.35.2
    * Update openSUSE's licenses.toml
    * Fix: Add sysusers.d to usrlibbinaryexception
    * SpecCheck: Fix typo in the 'no-%check-section' explanation
    * Bump github/codeql-action from 4.34.1 to 4.35.1
    * test: Add PKG-INFO to egg-info mocks for Python 3.15 compatibility
    * Reorder param doc rpmlint/checks/TagsCheck.py
    * test: Add more tests for dependencies
    * test: Add tests for SELinuxIndependentModuleCheck
    * TagsCheck: Reorder is_devel and is_source parameters
    * Add SELinuxIndependentModuleCheck to test_lint.py
    * Set scoring for selinux-incorrect-if-file-location
    * Add check for SELinux Independent Modules

++++ rpmlint-test:

  - Update to version 2.9.0+git20260528.2490edb3:
    * dbus-services: whitelist qSnapper (bsc#1261537)
    * Bump github/codeql-action from 4.35.2 to 4.36.0
    * BuildRootAndDateCheck: Convert date errs to warning
    * Bump github/codeql-action from 4.35.1 to 4.35.2
    * Update openSUSE's licenses.toml
    * Fix: Add sysusers.d to usrlibbinaryexception
    * SpecCheck: Fix typo in the 'no-%check-section' explanation
    * Bump github/codeql-action from 4.34.1 to 4.35.1
    * test: Add PKG-INFO to egg-info mocks for Python 3.15 compatibility
    * Reorder param doc rpmlint/checks/TagsCheck.py
    * test: Add more tests for dependencies
    * test: Add tests for SELinuxIndependentModuleCheck
    * TagsCheck: Reorder is_devel and is_source parameters
    * Add SELinuxIndependentModuleCheck to test_lint.py
    * Set scoring for selinux-incorrect-if-file-location
    * Add check for SELinux Independent Modules

++++ rubygem-agama-yast:

  - Version 22

++++ stgit:

  - Update to version 2.6.0:
    * chore: update changelog for 2.6.0
    * fix(import): respect --name verbatim, ignoring stgit.namelength
    * test(refresh): use test_when_finished for status.renames cleanup
    * expect over unwrap for test
    * bugfix: issue #615, add Copied variant to Status enum and move panic to a copied status, add integration test
    * docs: Update copyright year
    * chore: update gix to 0.83 (CVE-2026-40034, bsc#1266429)
    * chore: update compatible transitive dependencies
    * chore: update winnow to 1.0.3
    * chore: update jiff to 0.2.24
    * ci: drop dead CARGO_TARGET_*_STRIP env vars from package build
    * ci: soft-pin cargo-deb to ^3.0
    * ci: bump cargo-generate-rpm pin to ^0.20.0
    * ci: bump GitHub Actions to Node 24 runtimes
    * chore: update winnow to 1.0.1
    * chore: update clap to 4.6.1
    * chore: update gix to 0.81
    * chore: bump MSRV to 1.85
    * chore: update transitive deps
    * chore: update winnow to 0.7.15
    * chore: update thiserror to 2.0.18
    * chore: update tempfile to 3.27.0
    * chore: update tar to 0.4.45
    * chore: update serde_json to 1.0.149
    * chore: update jiff to 0.2.23
    * chore: update indexmap to 2.14.0
    * chore: update flate2 to 1.1.9
    * chore: update ctrlc to 3.5.2
    * chore: update clap to 4.5.61
    * chore: update anyhow to 1.0.102
    * chore: update anstyle to 1.0.14

++++ strace:

  - Update to strace 7.1
    * Implemented wall-clock-aware columns (wall-total, wall-min, wall-max,
    wall-avg) for the -c/--summary-only report, allowing wall-clock and
    system CPU times to be displayed side by side in a single run.
    * Included out-of-range syscalls in the -c/--summary-only report.
    * Updated decoding of sched_getattr syscall.
    * Implemented decoding of FS_IOC_SHUTDOWN, PIDFD_GET_INFO, and
    PIDFD_GET_*_NAMESPACE ioctl commands.
    * Implemented decoding of IFLA_BR_FDB_N_LEARNED, IFLA_BR_FDB_MAX_LEARNED,
    and IFLA_BR_STP_MODE netlink attributes.
    * Updated lists of CLONE_*, FSMOUNT_*, KT_*, KVM_*, LANDLOCK_*, NETDEV_*,
    NL80211_*, and PIDFD_* constants.
    * Updated lists of ioctl commands from Linux 7.1.
    * Implement EPERM diagnostics and give a hint about yama
    (jsc#PED-15928).

++++ traefik:

    Important: Please read the migration guide.
  - Version 3.7.5
    Bugs fixed
    * k8s/gatewayapi
  - Reject cross-provider references with backendRefs.namespace
    * k8s/ingress-nginx
  - Pass endpointslice fencing on ingress-nginx provider
  - Skip ingress when auth-secret resolution fails
    * server
  - Bump to github.com/pires/go-proxyproto v0.12.0
    * tls
  - Fix routers with same host, different tlsoptions on different entryPoint
  - Fix snicheck for routers with no hosts
  - Version 3.7.4
    Bugs fixed
    * http3
  - Bump github.com/quic-go/quic-go to v0.59.1
    * k8s/gatewayapi
  - Fix BackendTLSPolicy status update
    * middleware
  - Fix redis write timeout option configuration
    * tls
  - Fix snicheck with keepalive
    * webui
  - Bump axios to v1.17.0
  - Bump react-router and jsdom
  - Version 3.7.3
    CVE fixed
    * CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
    * CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)
    * CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)
    Bugs fixed
    * accesslogs
  - Escape double quotes in quoted log fields
    * file
  - Improve file provider behavior regarding dangling symlinks
    * k8s/gatewayapi
  - Bump github.com/moby/spdystream to v0.5.1
  - Change default values and expose configuration for Kubernetes client
    QPS and Burst
  - Escape exact gRPC method matches
    * k8s/ingress
  - Avoid ingress path matcher injection and backport 11d2514
    * k8s/ingress-nginx
  - Clear Ssl-Client-* headers when no client certificate is present
  - Trim quotes from proxy_set_header header name
    * logs, middleware
  - Allow query parameters to be dropped from RequestPath in access log
    * middleware, authentication
  - Add error on basic auth build if users is empty
    * middleware
  - Reject requests with different paths after StripPrefix and
    StripPrefixRegex normalisation
    * server
  - Bump github.com/bytedance/sonic to v1.15.1
  - Bump golang.org/x/crypto to v0.52.0
  - Bump golang.org/x/net to v0.55.0
  - Move snicheck to ctx instead of simulated routing
    * tls
  - Compute resolved tlsOptions after applying models
    * webui, tcp
  - Fix TCP router service resolution in dashboard flow diagram
  - Version 3.7.1
    CVE fixed
    * CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
    Bugs fixed
    * k8s/ingress, k8s/crd, k8s/gatewayapi
  - Add CrossProviderNamespaces option
    * k8s/crd
  - Fix cross-provider ref check for Kubernetes CRD provider
  - Version 3.7.0
    Enhancements
    * accesslogs, k8s/ingress-nginx, k8s/ingress
  - Add Kubernetes Ingress logs fields
    * accesslogs, k8s/ingress-nginx
  - Support nginx.ingress.kubernetes.io/enable-access-log annotation
    * accesslogs, otel
  - Allow Stdio access logs alongsige OTLP logging
    * acme
  - Add CertificateTimeout ACME configuration option
    * k8s/crd
  - Add ingressClassName field to the CRDs spec
  - Service failover support in TraefikService CRD
    * k8s/crd, service
  - Support cipher suites configuration with ServersTransport
    * k8s/gatewayapi
  - Add secret support for BackendTLSPolicy caCertificateRefs
  - Bump sigs.k8s.io/gateway-api to v1.5.1
  - Support multiple certificateRefs on gateway listeners
    * k8s/ingress, middleware, k8s/crd, service, k8s/gatewayapi
  - Services middleware and Gateway API filters on HTTP backends
    * k8s/ingress-nginx
  - Add custom-http-errors and default-backend annotations
  - Add limit-burst-multiplier annotation support
  - Add limit-connections support
  - Add nginx.ingress.kubernetes.io/proxy-connect-timeout annotation
  - Add rewrite-target nginx annotations support
  - Add support for app-root nginx annotation
  - Add support for auth-signin annotation
  - Add support for from-to-www-redirect NGINX annotation
  - Add support for proxy-read-timeout and proxy-send-timeout NGINX
    annotations
  - Add support for session-cookie-expires nginx annotation
  - Add support for upstream-hash-by NGINX annotation
  - Add support for variable interpolation in auth-signin NGINX annotation
  - Allow entry points to be specified on Nginx Ingresses
  - Implement proxy-http-version annotation
  - Implement server-snippet and configuration-snippet annotations
    * k8s/ingress-nginx, k8s/ingress, rules
  - Add wildcard host in Host and HostSNI matchers
    * k8s/ingress-nginx, middleware, authentication
  - Add support for auth-snippet
    * k8s/ingress-nginx
  - Nginx x-forwarded-prefix annotation
  - Support auth-tls-pass-certificate-to-upstream annotation
  - Support auth-tls-secret and auth-tls-verify-client annotations
  - Support limit-rpm annotation for ingress-nginx
  - Support limit-rps annotation for Ingress NGINX
  - Support NGINX buffering annotations
  - Support NGINX canary annotations
  - Support NGINX custom-headers annotation
  - Support NGINX global auth annotation
  - Support nginx.ingress.kubernetes.io/allowlist-source-range
  - Support NGINX upstream-vhost annotation
  - Support NGINX whitelist-source-range annotation
  - Support permanent-redirect and temporal-redirect annotations
  - Support proxy-next-upstream* annotations
  - Support server-alias annotation for Ingress NGINX
  - Support upstream-keepalive-timeout
  - Use a metamodel to generate dynamic configuration in ingress-nginx
    * k8s/knative
  - Support knative v1.20.0
    * metrics
  - Support file path for metrics.influxdb2.token option
    * middleware
  - Add encodedCharacters middleware
    * middleware, authentication
  - Add authSignInURL in forward auth middleware
    * middleware
  - Enable retries based on HTTP response status codes, timeout, and
    non-idempotent methods
    * provider
  - Add providers routing precedence configuration
    * server
  - Add global option to disable X-Forwarded-For appending
  - Replace Split in loops with more efficient SplitSeq
    * service
  - Failover according to response status code
    * tls
  - Make TLSStore gracefully handle missing secrets
  - Use unicode.MaxASCII for clearer ASCII check
    * webui
  - Add dashboard name configuration
  - Details pages UI improvement
  - Display server weight in service detail view
    * webui, tls
  - Add certificates menu and overview
    * webui
  - Web UI dashboard improvements
    Bug fixes
    * acme
  - Add missing renew options
  - Add timeout to ACME-TLS/1 challenge handshake
  - Alter TLS renewal period
  - Bump github.com/go-acme/lego/v4 to v4.35.2
  - Remove invalid private key in log
  - Replace hardcoded references to LetsEncrypt in log messages
    * api
  - Fix allow colons and tildes in api.basePath validation
    * cli
  - Fix health check ping
    * docker
  - Auto-negotiate Docker API Version
  - Bump Docker and OpenTelemetry dependencies
    * docker, docker/swarm
  - Auto-negotiate Docker API version
    * docker
  - Downgrade log level for missing container on inspect
    * docker, ecs
  - Migrate to github.com/moby/moby modules
    * fastproxy
  - Bump github.com/valyala/fasthttp to v1.69.0
    * grpc
  - Bump google.golang.org/grpc to v1.79.3
    * healthcheck, grpc
  - Remove path parsing with grpc healthcheck
    * healthcheck
  - Reject absolute URL in healthcheck path configuration
  - Validate healthcheck path configuration
    * http3
  - Bump github.com/quic-go/quic-go to v0.59.0
    * http
  - Add maxResponseBodySize configuration on HTTP provider
    * k8s/crd
  - Fix panic with Failover services in Kubernetes
    * k8s/crd, k8s
  - Honor allowCrossNamespace with chain middleware CRD
    * k8s/crd
  - Remove cross-provider sanitization for Kubernetes service loading
    * k8s
  - Fix condition used for serving and fenced endpoints
    * k8s/gatewayapi
  - Fix Gateway API router's rules
  - Fix incorrect hostname matching between listener and route
    * k8s/ingress
  - Fix ingress router's rule
  - Fix panic for empty defaultBackend and defaultBackend without resources
    * k8s/ingress-nginx
  - Add AllowCrossNamespaceResources and GlobalAllowedResponseHeader
    options to control custom headers annotations
  - Add ipAllowListStrategy option for allowlist/whitelist annotations
  - Avoid 302 redirect when rewrite-target value is not an absolute URL
    for ingress-nginx provider
  - Deprecate Kubernetes Ingress NGINX provider experimental flag
  - Do not require a port for ExternalName services
  - Fix auth-response-headers whitespace trimming in ingress-nginx provider
  - Fix custom headers annotation with 503 Service Unavailable
  - Fix nginx.ingress.kubernetes.io/proxy-ssl-verify annotation support
  - Fix nginx rewrite target
  - Fix NGINX sslredirect annotation support
  - Fix proxy-ssl-verify annotation
  - Fix regressions after refacto of the ingress-nginx provider
  - Fix rewrite directive in configuration-snippet to trim quotes
  - Fix rewrite-target annotation handling with empty path and non-regex
    path
  - Fix rewrite-target to handle full URL
  - Fix service unavailable on ingress-nginx
  - Fix SSL redirect behavior for ingress-nginx provider
  - Fix SSL redirect to match NGINX behavior
  - Fix the service name for ingress-nginx provider
  - Fix TLS behavior in ingress-nginx provider
  - Fix typo in default CORS allowed headers
  - Fix use-regex annotation behavior and add strictValidatePathType
    config for ingress-nginx provider
  - Fix use-regex nginx annotation
  - Handle duplicate server-alias on ingress-nginx provider
  - Handle empty rewrite-target like unset rewrite-target
  - Prevent Ingress Nginx provider http router to attach to an entrypoint
    with TLS
  - Use QuoteMeta for cookie name when building canary rules
    * k8s, k8s/ingress-nginx
  - Add regression test for ingress default backend without rules
    * logs, metrics, tracing
  - Bump go.opentelemetry.io/otel
    * logs, otel
  - Add OTel-conformant trace context attributes to access logs
    * metrics, tracing, accesslogs
  - Fix ObservabilityConfig SetDefaults
    * middleware
  - Add errorRequestHeaders option to Errors middleware
    * middleware, authentication
  - Add maxResponseBodySize configuration to forwardAuth middleware
  - Change ForwardAuth error log level from DEBUG to ERROR
  - Cleanup and make ForwardAuth logs consistent
  - Fix trustForwardHeader on forward auth middleware
  - Handle empty/missing User-Agent header
  - Make basic auth check timing constant
  - Prevent duplicate user headers in basic and digest auth middleware
  - Remove map lookup making the basic auth notFoundSecret empty
    * middleware
  - Bump github.com/klauspost/compress v1.18.4
  - Deprecate ForwardAuth.TrustForwardHeader option
  - Fix case sensitivity on x-forwarded headers for Connection
  - Fix HasSecureHeadersDefined returning false when stsSeconds is 0
  - Fix StripPrefix and StripPrefixRegex to slice the prefix using
    encoded prefix length
    * middleware, k8s/ingress-nginx
  - Fix app-root with query params redirect
  - Fix custom error pages behavior for ingress-nginx provider
  - Fix rewrite target with full URL and no regex in ingress path
  - Preserve request query on absolute-URL redirect
  - Resolve NGINX variables in ingress-nginx upstream-vhost annotation
    * middleware, k8s, k8s/ingress-nginx
  - Fix from to www nginx annotation
    * middleware
  - Remove untrusted X headers with underscores
  - Sanitize the request URL after stripping the prefix
    * otel
  - Bump go.opentelemetry.io/otel dependencies
    * plugins
  - Validate plugin module name
    * redis
  - Fix mutually exclusive verification for Redis
    * server
  - Bump github.com/vulcand/oxy to v2.1.0
  - Bump golang.org/x/crypto to v0.45.0
  - Bump golang.org/x/net to v0.51.0
  - Filter unknown nodes with file and env for the deprecation loader
  - Fix comment and unnecessary allocation in withRoutingPath
  - Fix deny encoded characters
  - Fix multi-layer routing with models
  - Fix TLS handshake error handling
  - Make encoded character options opt-in
  - Make the aggregator compute provider namespace for router's parentRefs
  - Print access logs for rejected requests and warn about new behavior
  - Reject suspicious encoded characters
  - Remove conn deadline after STARTTLS negociation
    * server, tcp
  - Fix postgres STARTTLS with TLS termination
    * service
  - Avoid recursion with services
    * sticky-session, k8s/crd
  - Make SameSite cookie value case-insensitive
    * tls
  - Fix verifyServerCertMatchesURI function behavior
  - Restore default cipher suites when serversTransport has no explicit
    cipherSuites
    * tls, server
  - Cap TLS record length to RFC 8446 limit in ClientHello peeking
    * tls
  - Support fragmented TLS client hello
    * tracing, otel
  - Use ParentBased sampler to respect parent span sampling decision
    * udp
  - Revert "Avoid allocations in readLoop by using sync.Pool"
    * webui
  - Bump dependencies of documentation and webui
  - Bump lodash version
  - Fix basePath validation for dashboard template
  - Fix blocked navigation on Safari
  - Fix missing type definition
  - Fix priority display in dashboard and ACME bypass redirect
  - Remove AGPL license in code
  - Restore remote Upgrade to Hub button web component
  - Upgrade form-data to 2.5.4, 3.0.4, 4.0.4
  - Use url.Parse to validate X-Forwarded-Prefix value
  - Validate X-Forwarded-Prefix value for dashboard redirect

++++ traefik2:

  - Version 2.11.50
  - Bug fixes:
    * tls
  - Fix routers with same host, different tlsoptions on different entryPoint
  - Fix snicheck for routers with no hosts
  - Version 2.11.49
  - Bug fixes:
    * http3
  - Bump github.com/quic-go/quic-go to v0.59.1
    * tls
  - Fix snicheck with keepalive
    * webui
  - Bump axios to v1.17.0
  - Version 2.11.48
  - CVE fixed:
    * CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
  - Bug fixes:
    * k8s/ingress
  - Avoid ingress path matcher injection and backport 11d2514
    * middleware, authentication
  - Add error on basic auth build if users is empty
    * middleware
  - Reject requests with different paths after StripPrefix and
    StripPrefixRegex normalisation
    * server
  - Bump golang.org/x/crypto to v0.52.0
  - Bump golang.org/x/net to v0.55.0
  - Move snicheck to ctx instead of simulated routing
    * tls
  - Compute resolved tlsOptions after applying models
  - Version 2.11.47
    * Not released

++++ trivy:

  - update to 0.71.1 (bsc#1269269, CVE-2026-55092):
    * fix(oci): validate artifact filename
    * fix: forward ospkg detector options through ospkg.NewScanner
    * fix(vex): load VEX documents from within the repository
    directory
    * fix: surface the original analysis error instead of context
    cancellation
    * ci: expect GitHub App bot as backport PR author

++++ vermouth:

  - Bump to version 1.9.2
  - Upstream changes:
    * feat: GOG store support (#50)
    * Update sums

++++ warewulf4:

  - updating to v4.7.0 with following security fixes
    * fixed CVE-2026-39821 (bsc#1266483)
    * fixed CVE-2026-33814 (bsc#1265653)
  - v4.7.0 with significant changes relative to the v4.6.x series which are:
    * New wwctl unset command
    * Refactored server routes (URLs)
    * New /files/ route for serving individual files and templates
    * Server TLS support
    * Removed support for fetching individual overlays and individual files from overlays
    * Fixed whitespace handling around template functions
    * Security fixes, including updated Go and library versions
  - changes from v4.6.5:
    * new wwctl overlay info command
    * fixed wwctl image import --update option
    * cross-arch support for wwclient
    * improved IPv6 support
    * improved support for bonded interfaces
    * renamed debian.interfaces overlay to ifupdown
    * new systemd-networkd overlay
    * warewulf-dracut fixes, including "provision-to-disk" fixes
  - remove slurm-overlay package

++++ weblate:

  - CVE-2026-45106: stored HTML injection in editor search preview
    (bsc#1268130)
    * CVE-2026-45106.patch
  - CVE-2026-50127: VCS_RESTRICT_PRIVATE did not properly account for
    some transitional IPv6 ranges, multicast addresses, or some
    semi-private IPv4 ranges (bsc#1268134)
    * CVE-2026-50127.patch

++++ xmpp-dns:

  - Update to 0.6.3:
    * Add support for NO_COLOR environment variable (see https://no-color.org/).

++++ zk:

  - Update to version 0.15.5:
    * List, edit and filter for broken links with --broken-links
    * Update strftime package, supporting %g and %G formats in the
    {{format-date}} helper
    * Option to append links to selected text, instead of replacing
    * Paths with ~ and env variables no longer error when passed to
  - -notebook-dir and --working-dir
    * Guard LSP against unnecessary erroring on missing textDocument/definition
    capabilities

------------------------------------------------------------------
------------------  2026-6-14  -  Jun 14 2026  -------------------
------------------------------------------------------------------

++++ MozillaFirefox:

  - Mozilla Firefox 152.0
    https://www.firefox.com/en-US/firefox/152.0/releasenotes/
    MFSA 2026-57 (bsc#1268071)
    * CVE-2026-12289 (bmo#2023443)
    Privilege escalation in the Graphics: WebRender component
    * CVE-2026-12290 (bmo#2024852)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12291 (bmo#2036929)
    Use-after-free in the Networking: HTTP component
    * CVE-2026-12292 (bmo#2038465)
    Incorrect boundary conditions in the Web Audio component
    * CVE-2026-12293 (bmo#2039568)
    Use-after-free in the Graphics: WebGPU component
    * CVE-2026-12294 (bmo#2039873)
    Sandbox escape in the DOM: Workers component
    * CVE-2026-12295 (bmo#2040160)
    Sandbox escape in the DOM: Navigation component
    * CVE-2026-12296 (bmo#2040515)
    Sandbox escape in the Security: Process Sandboxing component
    * CVE-2026-12297 (bmo#2041610)
    Sandbox escape due to incorrect boundary conditions in the
    Networking component
    * CVE-2026-12298 (bmo#2041981)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12299 (bmo#2043139)
    JIT miscompilation in the DOM: Core & HTML component
    * CVE-2026-12300 (bmo#1704114)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12301 (bmo#2015647)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12302 (bmo#2034489)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12303 (bmo#2034608)
    Information disclosure due to incorrect boundary conditions
    in the Graphics: WebGPU component
    * CVE-2026-12304 (bmo#2034944)
    Same-origin policy bypass in the Networking: Cookies component
    * CVE-2026-12305 (bmo#2037290)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12306 (bmo#2037323)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12307 (bmo#2038133)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12308 (bmo#2038302)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12309 (bmo#2038476)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12310 (bmo#2039707)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12311 (bmo#2040177)
    Information disclosure, sandbox escape in the Security:
    Process Sandboxing component
    * CVE-2026-12312 (bmo#2040383)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12313 (bmo#2040477)
    Information disclosure, sandbox escape in the Security:
    Process Sandboxing component
    * CVE-2026-12314 (bmo#2041856)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12315 (bmo#2042058)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12316 (bmo#2045496)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12317 (bmo#2007083)
    Memory safety bug fixed in Firefox 152
    * CVE-2026-12318 (bmo#2023478)
    Incorrect boundary conditions in the Libraries component in NSS
    * CVE-2026-12319 (bmo#2026933)
    Denial-of-service in the Audio/Video: Playback component
    * CVE-2026-12320 (bmo#2027572)
    Information disclosure in the Password Manager component
    * CVE-2026-12321 (bmo#2032943)
    JIT miscompilation in the JavaScript: WebAssembly component
    * CVE-2026-12322 (bmo#2033848)
    Clickjacking issue in the Widget: Gtk component
    * CVE-2026-12323 (bmo#2035027)
    Spoofing issue in the DOM: Core & HTML component
    * CVE-2026-12324 (bmo#2038444)
    Incorrect boundary conditions in the Graphics: CanvasWebGL
    component
    * CVE-2026-12325 (bmo#2039443)
    Denial-of-service in the Graphics: ImageLib component
    * CVE-2026-12326 (bmo#1767455, bmo#2004308, bmo#2021955, bmo#2024445,
    bmo#2025960, bmo#2028182, bmo#2029066, bmo#2029403, bmo#2029435,
    bmo#2029765, bmo#2029803, bmo#2029883, bmo#2030110, bmo#2030149,
    bmo#2030366, bmo#2030374, bmo#2030564, bmo#2030570, bmo#2030573,
    bmo#2031120, bmo#2032264, bmo#2033234, bmo#2033411, bmo#2034816,
    bmo#2035907, bmo#2035963, bmo#2036895, bmo#2036898, bmo#2036907,
    bmo#2036909, bmo#2036928, bmo#2036931, bmo#2036932, bmo#2036934,
    bmo#2038695, bmo#2039050, bmo#2039238, bmo#2039463, bmo#2041741,
    bmo#2042465, bmo#2042718, bmo#2042760, bmo#2042781, bmo#2042907,
    bmo#2044433, bmo#2044831, bmo#2045307, bmo#2045398, bmo#2045516,
    bmo#2045572)
    Memory safety bugs fixed in Firefox 152 and Thunderbird 152
    * CVE-2026-12327 (bmo#2011842, bmo#2023902, bmo#2025512, bmo#2027312,
    bmo#2029444, bmo#2036571, bmo#2036900, bmo#2036936, bmo#2037995,
    bmo#2038551, bmo#2040717, bmo#2042724)
    Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird
    ESR 140.12, Firefox 152 and Thunderbird 152
    * CVE-2026-12328 (bmo#2029402, bmo#2038477, bmo#2039726, bmo#2041373,
    bmo#2042268, bmo#2042451, bmo#2042782, bmo#2042858, bmo#2042929,
    bmo#2042965, bmo#2043213)
    Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR
    140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
  - requires NSS 3.124
  - rebased patches

++++ apparmor:

  - update to AppArmor 5.0.1
  - several fixes (including boo#1267425)
  - new profiles: glycin.bwrap and glycin.loaders
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_5.0.1
    for the upstream changelog
  - remove upstream(ed) patches:
  - changes-since-v5.0.0.diff
  - curl.diff
  - who.diff
  - remove revert-plasmashell.diff, profile was fixed upstream
  - add lsblk-mr2147.diff: fix FSTYPE and UUID in lsblk (boo#1267853)

++++ biome:

  - Update to version 2.5.0:
    * 5,000+ files changed across 833 commits
    * see https://github.com/biomejs/biome/compare/%40biomejs/biome%402.4.5...%40biomejs/biome%402.5.0
    * or see CHANGELOG.md

++++ cava:

  - Update to 1.0.0:
    * output/shaders: add Orion circle shaders (static + rotating)
    * SDL_GLSL: add gain option, reduce overhead, and harden long-run timing
    * core: tie smoothing to elapsed sample count
    * Additional pipewire error handling

++++ cdemu-client:

  - Update to release 3.3.1
    * Add Romanian translations

++++ cdemu-daemon:

  - Update to release 3.3.1
    * Fix use-after-free in READ DISC INFORMATION
    * Fix NWA returning 0 for sessions after the first
    * READ SUBCHANNEL command: return error if Mode-1 Q data cannot
    be found
    * device-recording/load: fix stale cue_entry causing NULL
    open_track on second SAO burn

++++ llvm:

  - Also have clang-devel require llvm-devel.

++++ lsp-plugins:

  - update to 1.2.33
    * Fixed PipeWire driver linkage error.

++++ coturn:

  - Update to version 4.13.0
    * Wrap atomic everywhere.
    * Fix sendmmsg stride bug in multiplex-peer UDP batch flush.
    * Reap TURN permissions/channels via a per-thread sweep instead
    of per-object timers.
    * Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO
    batching.
    * Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics
    * Restrict recvmmsg fast path to shared fan-in sockets
    (make --udp-recvmmsg useful standalone).
    * Enable --udp-recvmmsg by default on Linux.
    * Security hardening: port parsing, admin brute-force throttle,
    credential log redaction, constant-time compare, OAuth bounds
    checks, permission cap (#1932).
    * Add continuous latency mode to stunclient.
    * Fix test_redis_format link failure.
    * Fix configure MANPREFIX typo.
    * Fix missing sqlite3 dependendcy.
    * Fix UDP receive buffer ownership.

++++ e-antic:

  - Update to release 2.1.1
    * Fixed compatibility with SageMath 10.7, 10.8, 10.9
    * Fixed an issue in `fmpz_poly_num_real_roots_0_1_sturm` where
    sometimes the number of sign changes in the Sturm sequence was
    miscounted.
    * Fixed failing doctest due to noisy deprecation warning from
    cppyy.

++++ fast_float:

  - Update to release 8.2.10
    * Detect uint64 overflow that wraps past min_safe in
    parse_int_string.
    * Replace checked re-parse with O(1) simdjson-style overflow
    check.

++++ gcdemu:

  - Update to release 3.3.1
    * Add Romanian translations

++++ iosevka-fonts:

  - Update to v34.6.3
    * Changes of version 34.6.3
    = Add Characters:
    ~ SYMBOL FOR SUBSTITUTE FORM TWO (U+2426) (#3221).

++++ kdiskmark:

  - Update to version 3.3.0
    * Added interactive terminal interface (TUI)
    * New configuration option to enable/disable --refill_buffers
    * Added Korean (ko_KR) localization
    * Fixed halved results with multiple jobs, now using fio --group_reporting
  - Use upstream release assets for SingleApplication dependency
  - Use Qt6 for build

++++ kernel-default:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-source:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-docs:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-kvmsmall:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-obs-build:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-obs-qa:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-syms:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ kernel-vanilla:

  - update to 7.1 final
  - refresh configs
  - commit 957a9a8
  - config: update and reenable armv7hl configs
  - option values copied from armv7hl
  - commit cce93c7
  - config: update and reenable armv7hl configs
  - option values copied from arm64 except
  - DRM_TILCDC_PANEL_LEGACY=y
  - CLK_RV1103B=y
  - commit 8a5016d
  - config: update and reenable arm64 configs
  - option values copied from x86_64, i386 and riscv64 except
  - ARM64_ERRATUM_4193714=y
  - ARM64_LSUI=n
  - STM32_DBG_BUS=n
  - DWMAC_NUVOTON=m
  - PINCTRL_ELIZA=m
  - PINCTRL_HAWI=m
  - PINCTRL_IPQ5210=m
  - PINCTRL_MILOS_LPASS_LPI=m
  - PINCTRL_SDM670_LPASS_LPI=m
  - PINCTRL_RTD1625=m
  - CHARGER_MAX77759=m
  - MACSMC_POWER=m
  - SND_SOC_TEGRA_WM8962=n
  - SND_SOC_TEGRA_CPCAP=n
  - USB_DWC3_IMX=m
  - MMC_SDHCI_BST=m
  - CLK_ELIZA_DISPCC=m
  - CLK_ELIZA_TCSRCC=m
  - CLK_GLYMUR_GPUCC=m
  - CLK_GLYMUR_VIDEOCC=m
  - CLK_NORD_GCC=m
  - IPQ_GCC_5210=m
  - CLK_NORD_TCSRCC=m
  - SM_GPUCC_8750=m
  - ARCH_R9A08G046=y
  - ARCH_TEGRA_238_SOC=y
  - RESET_SKY1=y
  - NVIDIA_TEGRA410_CMEM_LATENCY_PMU=m
  - NVIDIA_TEGRA410_C2C_PMU=m
  - INTERCONNECT_QCOM_ELIZA=m
  - NTFS_DEBUG=n
  - NTFS_FS_POSIX_ACL=y
  - commit 4326118

++++ libapparmor:

  - update to AppArmor 5.0.1
  - several fixes (including boo#1267425)
  - new profiles: glycin.bwrap and glycin.loaders
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_5.0.1
    for the upstream changelog
  - remove upstream(ed) patches:
  - changes-since-v5.0.0.diff
  - curl.diff
  - who.diff
  - remove revert-plasmashell.diff, profile was fixed upstream
  - add lsblk-mr2147.diff: fix FSTYPE and UUID in lsblk (boo#1267853)

++++ libbfio:

  - Update to release 20260612
    * No changelog was provided

++++ libchdr:

  - Initial package (version ) for build.opensuse.org

++++ libetpan:

  - update to 1.10.1 (e02145e) via _service
    cosmetic correction to version.h, and new SONAME

++++ libmirage:

  - Update to release 3.3.2
    * ISZ filter: add support for alternative multi-part naming
    schemes
    * ISZ filter: implement decryption support
    * ISZ filter: add missing g_variant_unref() call
    * DMG filter: fix memory leaks in rsrc_fork_read_binary()
    * DAA filter: fix support for large (>= 4GB) images
    * DMG filter: fix stream opening on multi-segment DMG images
    * DMG filter: fix multi-segment file naming scheme
    * DMG filter: EncrCDSA stream: add support for AES-encrypted key
    * DMG filter: add support for segmented encrypted images
    * TOC image: fix handling of DATAFILE without offset or length
    * fragment: Add fast versions of reading main channel and
    subchannel data

++++ libstorage-ng:

  - merge gh#openSUSE/libstorage-ng#1079
  - fixed error message
  - 4.5.331

++++ libtorrent:

  - Update to release 0.16.14
    * Removed encoding name/path attribute handling.
    * Removed address based throttling.

++++ perl-Business-ISBN-Data:

  - updated to 20260613.1.0 (20260613.001)
    see /usr/share/doc/packages/perl-Business-ISBN-Data/Changes
    20260613.001 2026-06-13T07:15:29Z
    * data update for 2026-06-13

++++ perl-Crypt-OpenSSL-RSA:

  - Rebase Crypt-OpenSSL-RSA.patch
  - updated to 0.410.0 (0.41)
    see /usr/share/doc/packages/perl-Crypt-OpenSSL-RSA/Changes

++++ perl-Net-CIDR-Set:

  - updated to 0.220.0 (0.22)
    see /usr/share/doc/packages/perl-Net-CIDR-Set/Changes
    0.22      2026-06-13 14:44:25+01:00 Europe/London
    [Toolchain]
  - Set the static install flag
  - Adjusted build prerequisites to be recommended instead of required.
  - Sign distribution with SigStore.
    [Tests]
  - Added author tests.
  - Update minimum prereqs for some tests.

++++ perl-Net-SSLeay:

  - Remove test-32_x509_get_cert_info-allow-single-colon.patch (fixed upstream)

++++ perl-PPIx-QuoteLike:

  - updated to 0.24.0 (0.024)
    see /usr/share/doc/packages/perl-PPIx-QuoteLike/Changes
    0.024		2026-06-13	T. R. Wyant
    Remove references to the RT bug tracking system.
    Replace wyant@cpan.org with harryfmudd@comcast.net.
    Repackage licenses so that GitHub can find them (maybe).
    Thanks to Mikko Koivunalho (specifically his blog post
    https://blogs.perl.org/users/mikko_koivunalho/2025/11/github-and-the-perl-license.html
    for the how-to.
    Add SECURITY policy.
    No functional changes.
  - updated to 0.92.0 (0.092)
    see /usr/share/doc/packages/perl-PPIx-Regexp/Changes
    0.092		2026-06-13	T. R. Wyant
    Remove references to the RT bug tracking system.
    Replace wyant@cpan.org with harryfmudd@comcast.net.
    Correct documentation errors.
    No functional changes.

++++ perl-Test-Simple:

  - updated to 1.302221
    see /usr/share/doc/packages/perl-Test-Simple/Changes
    1.302221  2026-06-13 22:12:23-07:00 America/Los_Angeles

++++ perl-WWW-Mechanize:

  - updated to 2.210.0 (2.21)
    see /usr/share/doc/packages/perl-WWW-Mechanize/Changes
    2.21      2026-06-13 07:53:14Z
    [FIXED]
  - Link extraction no longer drops links which follow an unclosed <a> tag
    (GH#212) (Olaf Alders)

++++ postsrsd:

  - Update to release 2.1.0
    * Reload configuration on SIGHUP.
    * inotify support to watch domains-file for changes and
    reconfigure automatically.
    * Better integration with systemd via sd_notify.
    * SECCOMP support for better sandboxing while handling untrusted
    input.

++++ pv:

  - Update to release 1.11.0
    * New --monitor option to run a command and watch its input,
    output, or both.
    * Allow fractional values for --rate-limit.

++++ python-SQLAlchemy:

  - update to 2.0.50:
    * https://docs.sqlalchemy.org/en/21/changelog/changelog_20.html#change-2.0.50

++++ python-openstacksdk:

  - update to 4.15.0:
    * mypy: Remove unnecessary ignore
    * Add support for share snapshot manage, unmanage
    * Add support for share, share snapshot reset_state,
    force_delete
    * Add quota set resource to shared file system
    * Add share types resource to shared file system
    * Add support for share soft delete, restore
    * Add share snapshot metadata resource to shared file system
    * Add share network subnet metadata resource to shared file
    system
    * Add ServerExternalEvents resource for os-server-external-
    events API
    * Add service resource to shared file system
    * trivial: Order share proxy methods
    * key-manager: add secret consumer support
    * Add share replica resource to shared file system
    * network: Extend add_interface_to_router with advertise_host
    * docs: Use glob for resources docs
    * Migrate resources to Resource.create_opts (2/2)
    * Migrate resources to Resource.create_opts (1/2)
    * resource: Add Resource.create_opts
    * Make use of _transform_create_request helper
    * resource: Drop Resource.create_exclude_id_from_body
    * resource: Add _transform_create_response helper
    * typing: Invert checks
    * typing: Add annotations to remaining methods (workflow)
    * typing: Add annotations to remaining methods
    (shared_file_system)
    * typing: Add annotations to remaining methods (placement)
    * typing: Add annotations to remaining methods (orchestration)
    * typing: Add annotations to remaining methods (object_store)
    * typing: Add annotations to remaining methods (network)
    * typing: Add annotations to remaining methods (message)
    * typing: Add annotations to remaining methods (load_balancer)
    * typing: Add annotations to remaining methods (instance_ha)
    * typing: Add annotations to remaining methods (image)
    * typing: Add annotations to remaining methods (identity)
    * Add router_route field to network Quota resources
    * drop deprecated openstack.version
    * typing: Fix some bugs in compute proxy
    * shared_file_system: set min microversion for availability
    zones
    * Identity: Deprecate find_policy()
    * Stop Proxy.request() from shadowing connect_retries
    * Add reproducer tests for connect_retries being ignored
    * Add comprehensive functional tests for Identity v3 Service
    resource
    * typing: Add annotations to remaining methods (dns)
    * typing: Add annotations to remaining methods (database)
    * typing: Add annotations to remaining methods
    (container_infrastructure_management)
    * typing: Add annotations to remaining methods (compute)
    * typing: Add annotations to remaining methods (clustering)
    * typing: Add annotations to remaining methods (block_storage)
    * typing: Add annotations to remaining methods
    (baremetal_introspection)
    * typing: Add annotations to remaining methods (baremetal)
    * typing: Add annotations to remaining methods (accelerator)
    * Add share transfer to shared file system
    * proxy: Add Proxy._update helper
    * resource: Deprecate find_* ignore_missing param
    * block storage: Add QoSSpec
    * cloud: Deprecate nova-network support
    * trivial: Remove dead code
    * Remove tests.fakes module
    * Remove dead fakes
    * volume v2: Add missing attach, detach params
    * trivial: Cleanup remaining proxy docstrings
    * Deprecate incorrect update_* methods
    * typing: Add annotations to all Proxy.patch_* methods
    * Deprecate support for passing individual patches
    * Add support for key manager quota API
    * baremetal: Use Proxy._list for list operations
    * typing: Add annotations to all Proxy.*s methods
    * typing: Add annotations to all Proxy.update_* methods
    * Deprecate incorrect get_*_metadata methods
    * typing: Add annotations to all Proxy.get_* methods
    * typing: Add annotations to all Proxy.delete_* methods
    * tests: Fix intermittent JSONDecodeError in unit test setUp
    * trivial: Clean up docstrings in all Proxy.create_* methods
    * trivial: Clean up docstrings in all Proxy.find_* methods
    * trivial: Clean up docstrings for Resource
    * trivial: Clean up docstrings for Proxy
    * Drop _id suffix from proxy methods
    * tests: Correct types of IDs
    * typing: Sync wait_for_delete signatures
    * typing: Prefer Mapping, Sequence
    * typing: Add types to fixtures
    * Drop Python 3.10 support

++++ python-oslo.config:

  - update to 10.5.0:
    * typing: Accept tuples to exception
    * Bump python version in mypy check
    * fix: setuptools.package.find is a glob
    * cfg: Accepts string groups for RequiredOptError
    * Drop Python 3.10
    * trivial: Remove unnecessary :type: docstrings
    * Remove unnecessary annotation
    * Deprecate version module

++++ python-oslo.metrics:

  - update to 0.16.0:
    * tox: Use new constraints option
    * Use built-in fail method
    * tests: Drop invalid method
    * Update packaging configuration
    * ruff: Configure hacking as external linter
    * Update master for stable/2026.1

++++ python-oslo.policy:

  - update to 5.1.0:
    * tox: Use new constraints option
    * typing: Fix compatibility with typed testtools, oslotest
    * Update packaging configuration
    * ruff: Configure hacking as external linter
    * Update master for stable/2026.1
    * Replace usage of undocumented logging.WARN

++++ python-oslo.utils:

  - update to 10.1.1:
    * typing: Fix hint for time_it
    * tests: Tweak subprocess.check_output
    * tests: Fix occasional failure in format tests
    * LUKSInspector: Decrypt the first block
    * Add params to FileInspector and associated tools
    * Add ContainerFileInspector for wrapper formats
    * typing: Add overloads for
    excutils.forever_retry_uncaught_exceptions
    * typing: Add overloads for netutils.parse_host_port
    * Fix typo
    * Deprecate version module
    * tox: Use new constraints option
    * Refactor _UTCNow class to utcnow() function
    * Deprecate legacy time override functions
    * typing: Add type annotations for testscenarios in
    StringToBytesTest
    * typing: Allow None default for bool_from_string
    * typing: Improve netutils.urlsplit signature
    * typing: Improve timeutils.StopWatch signature
    * Fix return type of raise_with_cause
    * Update packaging configuration
    * ruff: Configure hacking as external linter
    * Update master for stable/2026.1
    * Remove `debtcollector` dependency
    * Fix shallow masking of secrets
    * Update CLI to allow enabling logging output
    * Refactor force_reraise
    * fix force_reraise to be annotated as NoReturn
  - add 0001-Refactor-TimeFixture-to-use-unittest.mock.patch

++++ python-pyghmi:

  - update to 1.6.17:
    * Fix XCC firmware updates
    * Add http boot dev
    * Fix other redfish update backends
    * Make changes for MegaRac
    * Remove stray debug output
    * More enhancements for generic MegaRAC
    * Handle None Gateway value
    * Change FPGA to BCD format
    * Fix bootsourceoverridemode

++++ python-zope.event:

  - update to 6.2:
    * Move package metadata from setup.py to pyproject.toml.
    * Allow setuptools < 82 as build system.

++++ python-heatclient:

  - update to 5.2.0:
    * tox: Use new constraints option
    * tox: Use new constraints option
    * Fix: Add event ID to default stack event list output
    * Fix: Python 3.14 compatibility for file URL construction
    * Update master for stable/2026.1

++++ python-manilaclient:

  - update to 6.1.0:
    * Replace OVN Metadata agent with OVN agent
    * Follow up on share replica metadata changes
    * fix stale API examble and typo in user/api.rst
    * update stale OpenStack references in README.rst
    * fix formatting errors in pyproject.toml
    * doc: fix share network docstrings
    * doc: Fix wrong class references in manager docstrings
    * doc: Update OS_TENANT_NAME to OS_PROJECT_NAME
    * Fix typo 'occured' should be 'occurred'
    * Fix option to override API endpoint
    * Update master for stable/2026.1

++++ python-os-traits:

  - update to 3.8.0:
    * Add a new trait for Intel TDX
    * Deprecate version attribute
    * Add a new trait for AMD SEV-SNP

++++ python-oslo.middleware:

  - update to 8.1.0:
    * tox: Use new constraints option
    * tests: Use subTest
    * typing: Fix compatibility with typed testtools, oslotest
    * Update packaging configuration
    * ruff: Configure hacking as external linter
    * Update master for stable/2026.1

++++ python-CommonMark:

  - update to 0.9.2:
    * Deprecate package. Use markdown-it-py instead.
    * Remove testing on python 3.4.

++++ python-ZEO:

  - update to 6.2:
    * Move package metadata from setup.py to pyproject.toml.
    * Fix ZEO cache tracing to work after year 2038.
    * Add support for Python 3.14.
    * Drop support for Python 3.9.

++++ python-aiocsv:

  - update to 1.4.1:
    * python 3.14 and free-threading
    * Prevent _parser.Parser from being shared across threads
    * Add missing Py_CLEAR(Parser->buffer_str)

++++ python-aiodns:

  - update to 4.0.4:
    * Raise ``DNSError(ARES_ENODATA)`` from ``query()`` when the
    answer section has no records of the requested qtype,
    restoring the pycares 4.x NODATA contract and avoiding
    ``AttributeError`` for CNAME/SOA/PTR callers (#254).
    * Add the missing ``build-backend`` entry to ``pyproject.toml``
    so PEP 517 builds from the sdist work without falling back to
    the deprecated legacy setuptools backend (#252).
    * Restore license metadata that was dropped during the
    ``pyproject.toml`` migration in #244, so packaging tools
    again detect aiodns as MIT-licensed (#250).
    * Re-release of 4.0.1; the 4.0.1 wheel build failed because the
    release workflow still invoked ``python setup.py`` after #244
    removed ``setup.py``, so 4.0.1 never reached PyPI. The
    release workflow now uses ``python -m build`` (#248).
    * Fix ``Future exception was never retrieved`` when pycares
    raises ``AresError`` synchronously, e.g. for malformed
    hostnames (#245, fixes #231)
    * Modernized package setup using ``pyproject.toml`` instead of
    ``setup.py`` (#244)

++++ python-aiosmtplib:

  - update to 5.1.1 (CVE-2026-53533, bsc#1268219):
    * Security: Reject control characters (the C0 range 0x00-0x1F
    and DEL 0x7F, including CR, LF, and NUL) in SMTP command
    arguments, preventing command injection via input passed to
    mail(), rcpt(), vrfy(), expn() or sendmail(). Such input now
    raises ValueError before anything is written to the
    connection. More details: https://github.com/cole/aiosmtplib/
    security/advisories/GHSA-v3q9-hj7j-63hq Thanks to
    @tonghuaroot for the report.
    * Bugfix: SMTP.quit() no longer hangs until the read timeout
    when the peer drops the transport with an exception after
    QUIT is sent but before the 221 reply is parsed (e.g. AWS SES
    closing TLS without close_notify).

++++ python-apprise:

  - update to 1.11.0:
    * A big win for this release is priortization of grouped/tagged
    content. Basically, this release allows you to tag multiple
    items and provide a weight to them.   Apprise will attempt to
    notify the highest priority/weighted services first (of same
    level), and only if this level fails will it try the next.
    Tagging is no longer just a `tag`.  It's now `weight:tag`
    too;  for example `100:friends`  associates the weight of
    `100` with the tag `friends`.  You can still continue to
    notify friends with your Apprise calls, but if there are
    weight categories, then these will be factored into the
    order.  Highest priority (weighted) tags have a lower integer
    value (zero being the  higest priority).  Only the next
    priority will be notified if the first fails.
    * This releae also allows you to set up a notifiation service
    to gracefully fail and not have Apprise itself report a
    failure.  This is useful for situations where you notify
    several end points and you really don't care if they're
    unavailable or not.   Apprise wil do it's usual best effort
    to send the notification, but not treat it as a failure if it
    can't get through. Use `optional=yes` on your Apprise URL.
    * Thirdly, this release introduces retries! You can now have
    Apprise attempt to notify your endpoint a second, or a third,
    (up to 10x) tries before giving up and deeming it unable to
    send the notification.  Use `retry=X` on your Apprise URL

++++ python-arviz-stats:

  - update to 1.2.0:
    * Return shapley values in original order
    * scale ISJ bw estimate by grid range rather than data range
    * Add kde2d functions
    * Generalize and refactor bayes_factor
    * Add p_worse, diff and elpd diagnostics to compare
    * prepare release

++++ python-autoray:

  - update to 0.8.11:
    * **Enhancements:**
    * Added initial MLX backend support including
    `random.default_rng`, dtype-aware creation wrappers,
    `to_numpy`, `count_nonzero`, `ravel`, and `linalg.svd`
    support.
    * Added `infer_backend_device_dtype` for shared backend,
    device, and dtype inference from `like` values.
    * Exported `DoFunc` for reusable call-time auto-dispatch, with
    faster `do` and `get_namespace` dispatch paths.
    * Refreshed package metadata, pixi environments, docs
    infrastructure, and CI, including the `testmlx` environment
    and MLX CI job.
    * Reworked backend tests around the unified `XFAILS` registry
    and expanded linear algebra coverage.
    * **Bug Fixes:**
    * Cached failed `.device` and `.dtype` probes in
    `get_namespace` to avoid repeated slow exceptions for array
    classes such as JAX tracers (#30).
    * Fixed `autojit` with lazy `lazy_astype` dtype evaluation.
    * Added TensorFlow `astype` handling and a NumPy-like Torch
    `nonzero` wrapper.
    * Fixed reduced and batched SVD shape handling in
    `svd_manual_full_matrices_kwarg`.
    * Fixed `prime_factors` to preserve integer factors.

++++ python-backports.zstd:

  - update to 1.6.0:
    * Update code with CPython 3.14.6 version

++++ python-bytecode:

  - update to 0.18.1:
    * Fix an AssertionError in stack-size computation when a single
    exception region is split into multiple TryBegin instances
    sharing one handler (as produced by bytecode-rewriting tools
    that wrap a whole function body in a single handler).
    TryBegin/TryEnd are now matched on the handler block rather
    than on TryBegin identity.
    * drop support for Python 3.9 and 3.10 PR #180
    * Replace string literal type annotations with postponed
    evaluation using from __future__ import annotations PR #191
    * multiple performance improvements PRs #172, #193, #196, #194,
    [#197], #198, #199, #200, #201, #202, #203
    * BasicBlock, Bytecode, and ConcreteBytecode now validate
    inserted instructions at insertion time (append, extend,
    insert, __setitem__) rather than during iteration. Code that
    relied on catching ValueError from list(block) or for instr
    in block: must wrap the insertion call instead. PR #199
    * Fix handling of END_ASYNC_FOR which is a backward jump PR
    [#179]

++++ python-cachetools:

  - update to 7.1.4:
    * Minor unit test improvements.
    * Update build environment.
    * Minor type stub improvements.
    * Update build environment.
    * Minor type stub improvements.
    * Minor documentation improvements.
    * Modernize build environment.
    * Various type stub improvements.

++++ python-certifi:

  - update to 2026.5.20:
    * remove O=Chunghwa Telecom Co., Ltd. OU=ePKI Root Certification Authority

++++ python-cloup:

  - update to 3.1.0:
    * Drop support for Click < 8.1.0. Previous Cloup versions have
    a bug with path parameter types in Click < 8.1.0, since they
    pass the `executable` kwarg to `click.Path`, a kwarg added in
    Click 8.1.
    * Fix type error related to checking if Command is a
    MultiCommand (deprecated since Click 8.2) (see #202).
    * Fix ParamType typing for Click 8.4

++++ python-cmd2:

  - update to 4.0.0:
    * Previously, `cmd2` relied on the GNU Readline library for
    command history. As of version 4.0.0,
    * `cmd2` has migrated to prompt-toolkit for
    * all input and history handling.
    * [cmd2.Cmd][] uses `prompt-toolkit` to provide familiar
    command-line history capabilities while also
    * `prompt-toolkit` saves everything you type, whether it is a
    valid command or not. `cmd2` only saves input to internal
    history if the command parses successfully and is a valid
    command. This design choice was intentional, because the
    contents of history can be saved to a file as a script, or
    can be re-run. Not saving invalid input reduces unintentional
    errors when doing so.
  - drop failing_tests.patch (upstream)

++++ python-cryptography:

  - update to 49.0.0:
    * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
    * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
    * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
    * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
    * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
    * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
    * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
    * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
    * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
    * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
    * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
    * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
    * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.

++++ python-cryptography-vectors:

  - update to 49.0.0:
    * Update test vectors to match python-cryptography 49.0.0

++++ python-cucumber-tag-expressions:

  - update to 10.0.0:
    * [NET] - Upgraded Test project dependencies and adjusted test
    code due to breaking changes in MSTest v4.

++++ python-czifile:

  - update to 2026.6.12:
    * Add CziDirectoryEntryDV.asimage convenience method.
    * Refactor segment, directory, and content file parsing
    (breaking).
    * Add memmap parameter to CziFile/imread for lock-free parallel
    subblock reads.
    * Add writable property to BinaryFile.
    * Change read_content functions to accept bytes or memoryview.
    * Remove read_array function.
    * Require imagecodecs >= 2026.6.6 for zstd1 codec.
    * Support Python 3.15.

++++ python-debugpy:

  - update to 1.8.21:
    * Return evaluate result in DAP response body instead of
    writing to stdout: #2027
    * Prevent invalid `scopes` request from crashing debug session:
    * Skip uninitialized `__slots__` in variable resolver: #2024
    * Handle `-c` arguments that are `bytes` instead of `str`:
    * Fix evaluation of variables from chained exception frames:
    * `ContinueRequest` with a specific `threadId` no longer
    resumes all threads (in-process adapter): #2012
    * Avoid strong reference to exceptions during unwind: #2008
    * Show error message on evaluate failures in the hover context:
    * Display `dlerror` output when `dlopen` fails: #2000
    * Replace removed `pkgutil.get_loader` with
    `importlib.util.find_spec` in `get_fullname`: #1998
    * Enhancements:
    * Add option to ignore all system exit codes: #2017
    * Pull changes from pydevd up to March 2026: #2010
    * Infrastructure work:
    * Suppress Flawfinder false positives on Cython memcpy / read-
    loop iterators (TSA #2816216, #2816217, #2816218, #2816219,
    [#2816220]): #2028, #2029, #2030, #2031, #2032

++++ python-decorator:

  - update to 5.3.1:
    * Added license SPDX identifier to pyproject.toml (reported by
    * Christian Lackas).

++++ python-dep-logic:

  - update to 0.6.0:
    * Explicitly check for invalid versions in more places

++++ python-disposable-email-domains:

  - update to 0.0.202:
    * refreshed to latest state from https://github.com/disposable-email-domains/disposable-email-domains

++++ python-django-redis:

  - update to 7.0.0:
    * Added the ability to pass redis username in the cache options
    * `RedisCache` does not attempt to close clients which have not
    been initialized.
    * Add sorted set operations (zadd, zrange, zrem, etc.) and
    mixins for RedisCache
    * Centralize configuration in `pyproject.toml`, drop EoL Python
    & Django versions, and add support & testing for modern Python &
    Django versions.
    * Provide TypeVar defaults & provide initial typing for
    `RedisCache`.
    * Fix IntEnum encoding
    * Fix incorrect Redis typing that relied on the legacy `types-
    redis` package, and update the public API to avoid exposing
    redis-py key types (the encode/decode/make_key methods allow
    a different API surface).

++++ python-esptool:

  - update to 5.3.0:
    * **reset**: support hardware flow control adapters
    * **espefuse**: Update efuse table for ESP32-H21
    * **flasher_stub**: Support USB-Serial/JTAG on ESP32-S31,
    prevent crashes during clock init
    * **espefuse**: Update efuses for ESP32S31
    * **espefuse**: add raw_value to JSON summary output
    * **esp32s31**: Add stub flasher support
    * **espefuse**: Add calib efuse fields for ESP32C5
    * **esptool**: Adds efuse version and pkg efuses for ESP32H4
    * **espefuse**: Update efuse table for ESP32H4
    * **esptool**: Disallow erasing key recovery info sectors when
    FE using KM is enabled
    * **esp32-p4**: Support ECO7 (rev3.2)
    * **stub_flasher**: Print a message when the new stub flasher
    is being used
    * **esp32c61**: Add large flash support
    * **stub_flasher**: Bump new stub to v0.3.0 with ESP32-C2 fixes
    and ESP32-C61 large flash
    * **write-flash**: Log which file is being flashed when
    multiple files are given
    * **write-flash**: Fully reflash all data when fast reflash
    verification fails
    * **espefuse**: Add --after option to reset the chip after the
    operation is finished
    * Use vid pid detection instead of UARTDEV_BUF_NO
    * Add support for plugin system for optionally loading stub
    features
    * improve flash connection verification with SFDP register
    check

++++ python-eval-type-backport:

  - update to 0.4.0:
    * Add install_patch() function for easy usage, updated docs

++++ python-fastapi:

  - update to 0.136.3:
    * Do not accept underscore headers when using
    `convert_underscores=True` (the default).
  - update to 0.136.2:
    * Validate Server Sent Event fields to avoid applications
    from sending broken data.
    * Document `--entrypoint` CLI option.
    * Update and simplify docs about help and management.
    * Add docs references to central contributing docs.
    * Update security policy
    * Improve layout and styling.
    * Refactor opinions section with interactive tabs and new
    logos.
    * Add FastAPI Conf '26 announcement to docs.
    * Update tests, don't double dispose the engine.
    * Speed up test suite via caching and fixture scopes to make
    it ~24% faster.

++++ python-flufl.bounce:

  - update to 5.0.1:
    * Fix a false recognition of Microsoft bounces from the
    Groupwise detector. :GL:`16` Found and fixed by Mark Sapiro.
    * Major project management modernization.
    * Add Mark as a named co-owner.
    * Drop Python 3.9, add Python 3.13, 3.14, and 3.15.
    * Added recognition for a non-compliant Earthlink DSN.
    * Fixed a long-standing bug in the Caiwireless detector that
    returned a set of individual address characters instead of
    the bouncing address itself, and added a test exercising the
    previously buggy return path.
    * Replaced deprecated/removed pkg_resources.
    * Replaced the zope.interface dependency with typing.Protocol;
    the IBounceDetector marker interface has been renamed to
    BounceDetector.  This is a backwards incompatible change.
    * The return types of scan_message, all_failures, and detector
    process methods are now frozenset[bytes] instead of mutable
    set[bytes]; the NoTemporaryFailures, NoPermanentFailures, and
    NoFailures sentinel constants are correspondingly empty
    frozensets rather than empty tuples.  This is a backwards
    incompatible change.
  - Remove use-correct-assertion-methods.patch (obsolete).

++++ python-graphql-core:

  - update to 3.2.11:
    * Allow configuration of the `ofType` introspection depth
    * Add support for directives on directive definitions
    * Restore variable own-property checks in `value_from_ast`
    * Remove unused variable-definition tracking in
    `ValuesOfCorrectTypeRule`
  - update to 3.2.10:
    * New features:
    * Add support for schema coordinates (parsing and resolving)
    * Support descriptions on executable definitions (e.g. variable
    definitions)
    * Add a `max_coercion_errors` option
    * Fix incorrect validation errors when variable descriptions
    are used
    * Don't add sibling errors after null propagation has occurred
    * Remove erroneous `oneOf` validation from the "values of
    correct type" rule
    * Validate that nullable variables aren't passed to `oneOf`
    input object fields (per spec)
    * Catch unhandled exceptions during abstract type resolution
  - update to 3.2.9:
    * Fix `OverlappingFieldsCanBeMergedRule` to catch field-merge
    conflicts hidden behind nested fragments
    * Fix handling of empty selection sets
    * Correctly type extensions in `GraphQLFormattedError`
    * Add `kind` to the introspection query/mutation/subscription
    root types
    * Expose `token_count` on `DocumentNode`
    * Preserve schema and input-field properties (e.g.
    descriptions) when sorting

++++ python-habanero:

  - update to 2.4.0:
    * fixed return type declaration for Crossref.works (#204)
    thanks @StarryWorm
    * use with open() context manager to properly close files in
    tests (#206) thanks @Stephen0512
    * pyyaml package moved from dependencies to the optional dev
    depencies group (#210) thanks @hseg
    * updated package for new filters; now documented options for
    the select parameter; documented new field queries;
    documented new facet count options

++++ python-hiredis:

  - update to 3.4.0:
    * Add support for building and releasing hiredis-py on Windows
    ARM64
    * Use hiredis v1.4.0 with improved floating-point number
    parsing
    * Drop python and pypy 3.8 support, test against pypy-3.11
    * Update dependencies and fix CI
    * Fix benchmarking for hiredis-py
    * Update workflow versions to address Node v20 deprecation
    * Run integration tests on Windows ARM64 for Python 3.11 and
    * MNT: do not use deprecated load_module method
    * Use Python 3.11 in FreeBSD CI run

++++ python-idna:

  - Update to 3.18:
    * Add a display argument to decode() that passes through invalid
    labels rather than raising an exception.
    * Substantial 75% reduction in memory usage through new data
    structures and processing speed optimizations.
    * Added a general 1024-character input length cap to the public
    validation, conversion, and codec entry points.
    * Add a command-line interface (python -m idna, also available as
    the idna script).
    * Raise the minimum supported Python version to 3.9.
    * Various code quality improvements.

++++ python-lazr.config:

  - update to 3.1:
    * Add support for Python 3.12 and 3.13.
    * Remove support for Python 3.7 and below.

++++ python-lmdb:

  - update to 2.2.1:
    * ``lmdb.aio`` async wrapper methods (on ``AsyncEnvironment``,
    ``AsyncTransaction``, and ``AsyncCursor``) are now real class
    attributes rather than synthesized by ``__getattr__``, making
    them visible to ``dir()``, ``inspect.signature()``, ``help()``,
    IPython, and stubtest. Non-callable attributes still proxy through.
    * Added type stubs for the ``lmdb.aio`` module.
    * Fix a segmentation fault on Linux/aarch64 when an
    ``Environment`` is closed from a different thread than the one
    holding an active write transaction. ``Environment.close()``
    now waits for the owning thread to release the write
    transaction before unmapping the lock file.
    * Reject adversarial on-disk values that could overflow size
    arithmetic or cause implementation-defined narrowing of
    ``mv_size`` when reading crafted databases. (#462, #463)
    * Fix crashes on out-of-memory conditions in the CPython
    extension's error paths. (#453)
    * Remove remaining Python 2 compatibility code.

++++ python-meson-python:

  - update to 0.20.0:
    * Add support for targeting the Android platform.

++++ python-more-itertools:

  - update to 11.1.0:
    * `numeric_range` was updated to fix its handling of empty
    ranges (thanks to rhettinger)
    * `peekable` was updated to fix typing issues (thanks to
    DORI2001, powellnorma, Pandede, m9810223, and rhettinger)
    * `islice_extended` was optimized for memory usage and speed
    (thanks to ben42code, rhettinger, and pochmann)
    * `serialize` now supports the generator methods `throw`,
    `send`, and `close` (thanks to rhettinger)
    * `seekable` now supports implements `__getitem__` for cached
    elements (thanks to SAY-5, jenstroeger, and JamesParrott)

++++ python-pika:

  - update to 1.4.1:
    * Fix Channel.close() for channels with multiple consumers

++++ python-pipdeptree:

  - update to 3.1.0:
    * feat(cli): add --summary health report (text/rich/json)
  - update to 3.0.0:
    * chore: improve pipdeptree maintenance path
    * refactor: Remove setuptools check when getting installed
    version
    * feat(cli): auto-detect active virtualenv by default
    * feat(extras): default --extras to explicit, add active/none
    modes
    * feat(cli): accept extras in --packages filter
    * feat(api): add programmatic render() for notebooks
    * feat(cli): add from-index subcommand to resolve a tree from
    a package index
    * feat(cli): add from-lock subcommand to render a PEP 751
    lock offline

++++ python-poetry:

  - update to 2.4.1:
    * Re-allow `installer==0.7.0` (#10887).
    * Fix an issue where `poetry update <package>` failed when
    `<package>` was a transitive dependency (#10885).

++++ python-pyOpenSSL:

  - update to 26.3.0:
    * Dropped support for Python 3.8.
    * The minimum cryptography version is now 49.0.0.
    * Removed deprecated OpenSSL.crypto.X509Req,
    OpenSSL.crypto.dump_certificate_request, and
    OpenSSL.crypto.load_certificate_request. cryptography.x509
    should be used instead.
    * OpenSSL.SSL.Connection.set_session now raises ValueError if
    the Session was obtained from a Connection that was using a
    different Context than this one. OpenSSL requires (but does
    not verify) that sessions only be re-used with a compatible
    SSL_CTX, so this contract is now enforced.
    * Deprecated OpenSSL.crypto.PKey.generate_key and
    OpenSSL.crypto.PKey.check. The key generation and loading
    APIs in cryptography should be used instead.
    * Deprecated OpenSSL.crypto.dump_privatekey. The serialization
    APIs on cryptography private key types should be used
    instead.
    * Deprecated all the mutable APIs on OpenSSL.crypto.X509:
    set_version, set_pubkey, sign, set_serial_number,
    gmtime_adj_notAfter, gmtime_adj_notBefore, set_notBefore,
    set_notAfter, set_issuer, and set_subject.
    cryptography.x509.CertificateBuilder should be used instead.
    * Deprecated OpenSSL.SSL.Context.set_passwd_cb. Users should
    decrypt and load their private keys themselves, with
    cryptography's key loading APIs, and then call
    OpenSSL.SSL.Context.use_privatekey.
    * Deprecated OpenSSL.crypto.X509Name, as well as the remaining
    APIs that consume or return it:
    OpenSSL.crypto.X509.get_issuer,
    OpenSSL.crypto.X509.get_subject, and
    OpenSSL.SSL.Context.set_client_ca_list. The APIs in
    cryptography.x509 should be used instead.
    * OpenSSL.SSL.Connection.get_client_ca_list now takes an
    as_cryptography keyword-argument. When True is passed then
    cryptography.x509.Name are returned, instead of
    OpenSSL.crypto.X509Name. In the future, passing False (the
    default) will be deprecated.

++++ python-pydantic-settings:

  - update to 2.14.1:
    * Bump the python-packages group with 4 updates
    * Bump the python-packages group with 5 updates
    * Bump the github-actions group with 3 updates
    * Bump the python-packages group with 2 updates
    * Fix field named `cls` conflicting with classmethod parameter

++++ python-pyotp:

  - Update to version 2.10.0
    * Fix parse_uri mis-parsing of encoded colon in issuer/account
    name.
    * Simplified and improved generate_otp() performance in Steam
    class.
    * Check digest function to prevent error on OTP Generation.
    * Ignore non-standard otpauth parameters.
    * use strings as immutable default arguments.

++++ python-reportlab:

  - update to 4.5.1:
    * fix tests/runAll.py to avoid issues with sys.args
    * fix no such attribute in lib.utils.rl_warn
    * SVGCanvas new keyword argument fontSizer defaulting to 'px'
    * add rl_warn to lib/utils.py and use in tables (via extra
    allowTableBoundsErrors bits).
    * rl_config.register_reset can have callback and now handles
    methods
    * shapes.py fix Group.asDrawing
    * fix __rl_get_module__ for Python 3.15
    * moved extformat.py elsewhere
    * added combineTransforms
    * improve colors.cssParse
    * change None to mean no-draw in acroform.py
    * extend allowTableBoundsErrors scope

++++ python-reproject:

  - update to 0.20.0:
    * Support 32-bit floats in reproject_adaptive
    * Fix setting shape which is deprecated, and use reshape()
    instead
    * Improve accuracy for high-resolution images in
    reproject_exact
    * Added Python 3.14 CI jobs
    * Add a new Montage accuracy test in ICRS
    * Clean up private/public API
    * Migrate to new astropy-unified theme
    * BLD: cleanup manifest template
    * Upgrade PyPI CI publishing to use Trusted Publishing
    * Enable limited API builds only when building wheels for
    publishing
    * Fix caplog-related failures in
    test_reproject_parallel_broadcasting

++++ python-rich-argparse:

  - update to 1.8.0:
    * Python 3.8 is no longer supported (EOL since 7/10/2024)
    * Add support for PyPy 3.11
    * Add `ExtendedParagraphRichHelpFormatter` to
    `rich_argparse.contrib`. This is similar to
    `ParagraphRichHelpFormatter` but with better support for
    paragraph spacing.
  - drop fix-tests.patch, py3141.patch: upstream

++++ python-rq:

  - update to 2.9.1:
    * `Job.create()` now supports `retry` argument. Thanks
    @sethuvishal!
    * Add compatibility with `redis-py` >= 8. Thanks @selwin!
    * Added `json` and `pickle` shorthand aliases for serializers.
    These can now be used when creating queues/workers and with
    the `--serializer` CLI option. Thanks @selwin!
    * Fixed a bug where `SpawnWorker` does not use user supplied
    serializer. Thanks @selwin!
    * `Queue.parse_args()` now returns a `EnqueueArgs` named tuple.
    Thanks @libmilos-so!
    * Fixed a race condition that could cause worker keys in Redis
    to get out of sync when Redis is under load. Thanks
    @terencehonles!
    * Enqueueing deferred jobs now removes them from
    `DeferredJobRegistry`. Thanks @selwin!
    * `SpawnWorker` now uses `repr()` when reconstructing worker,
    job and queue identifiers in child processes. Thanks @selwin!

++++ python-securesystemslib:

  - update to 1.4.0:
    * HSMSigner: Fix usage with multi-byte keyids
    * SigstoreSigner: Update to current sigstore-python API
    * Deprecate Python 3.9 support
    * Various testing changes -- note that AWS is currently not
    tested in CI (see #1104)

++++ python-seedir:

  - update to 0.5.1:
    * GitHub workflows for testing the code (on pushes and pulls to
    `main` and `dev`) and for uploading to PyPI (on new release).
    * Created a pyproject.toml
    * Add CONTRIBUTING.md for instructions on how to contribute to
    the project
    * `seedir.fakedir.fakedir_fromstring` has been refactored.  The
    logic is essentially the same, but there have been some
    simplifications and more comments have been added.
    * The `itemlimit` now accepts a 2-tuple as an argument,
    indicating a separate limit for folders and files
    (respectively).
    * Added two parameters for handling errors when trying to list
    the children of a directory:
    * `acceptable_listdir_errors`: One or more error types
    (`Exceptions`) which are ignored when occurring during a
    directory listing call.  E.g., a permissions error.
    * `denied_string`: String to add to follow directory entries
    for which the error was triggered.
    * More test cases added
    * The main algorithm for folder tree traversal has been
    refactored.
    * The unit tests are now structured for pytest.
    * `seedir.folderstructure.FolderStructure` is now an abstract
    class that cannot be directly instantiated.  The functions
    that previously needed to be provided as arguments for the
    constructor must now be implemented as part of a subclass
    (see getting started for an example)
    * `slash` is now totally deprecated; use `folderend` instead.

++++ python-soundcloud-v2:

  - update to 1.7.0:
    * fix: use curl_cffi to bypass TLS fingerprinting on
    /users/{id}/tracks

++++ python-specfile:

  - update to 0.41.0:
    * Fixed an issue where the value of a tag could have been
    incorrectly expanded if the spec file contained a macro
    definition shadowing the tag name

++++ python-stripe:

  - update to 15.2.1:
    * #1825 Add "source" field to user-agent header
  - update to 15.2.0:
    * #1816 Update generated code
    * Add support for new resource
    `v2.commerce.ProductCatalogImport`
    * Add support for `create` and `retrieve` methods on resource
    `v2.commerce.ProductCatalogImport`
    * Add support for `bizum_payments` and `scalapay_payments` on
    `Account.Capability`, `AccountCreateParamsCapability`, and
    `AccountModifyParamsCapability`
    * Add support for `automatic_transfer_rules_by_currency` on
    `BalanceSettings.Payment.Payout` and
    `BalanceSettingsModifyParamsPaymentPayout`
    * Add support for `start_of_day` on
    `BalanceSettings.Payment.SettlementTiming` and
    `BalanceSettingsModifyParamsPaymentSettlementTiming`
    * Add support for `description` on
    `ChargeCreateParamsTransferDatum`,
    `PaymentIntent.TransferDatum`,
    `PaymentIntentCreateParamsTransferDatum`, and
    `PaymentIntentModifyParamsTransferDatum`
    * Add support for `bizum` on `Charge.PaymentMethodDetail`,
    `ConfirmationToken.PaymentMethodPreview`,
    `ConfirmationTokenCreateParamsPaymentMethodDatum`,
    `PaymentAttemptRecord.PaymentMethodDetail`,
    `PaymentIntent.PaymentMethodOption`,
    `PaymentIntentConfirmParamsPaymentMethodDatum`,
    `PaymentIntentConfirmParamsPaymentMethodOption`,
    `PaymentIntentCreateParamsPaymentMethodDatum`,
    `PaymentIntentCreateParamsPaymentMethodOption`,
    `PaymentIntentModifyParamsPaymentMethodDatum`,
    `PaymentIntentModifyParamsPaymentMethodOption`,
    `PaymentMethodConfigurationCreateParams`,
    `PaymentMethodConfigurationModifyParams`,
    `PaymentMethodConfiguration`, `PaymentMethodCreateParams`,
    `PaymentMethod`, `PaymentRecord.PaymentMethodDetail`,
    `SetupIntent.PaymentMethodOption`,
    `SetupIntentConfirmParamsPaymentMethodDatum`,
    `SetupIntentConfirmParamsPaymentMethodOption`,
    `SetupIntentCreateParamsPaymentMethodDatum`,
    `SetupIntentCreateParamsPaymentMethodOption`,
    `SetupIntentModifyParamsPaymentMethodDatum`, and
    `SetupIntentModifyParamsPaymentMethodOption`
    * Add support for `scalapay` on `Charge.PaymentMethodDetail`,
    `Checkout.Session.PaymentMethodOption`,
    `ConfirmationToken.PaymentMethodPreview`,
    `ConfirmationTokenCreateParamsPaymentMethodDatum`,
    `PaymentAttemptRecord.PaymentMethodDetail`,
    `PaymentIntent.PaymentMethodOption`,
    `PaymentIntentConfirmParamsPaymentMethodDatum`,
    `PaymentIntentConfirmParamsPaymentMethodOption`,
    `PaymentIntentCreateParamsPaymentMethodDatum`,
    `PaymentIntentCreateParamsPaymentMethodOption`,
    `PaymentIntentModifyParamsPaymentMethodDatum`,
    `PaymentIntentModifyParamsPaymentMethodOption`,
    `PaymentMethodConfigurationCreateParams`,
    `PaymentMethodConfigurationModifyParams`,
    `PaymentMethodConfiguration`, `PaymentMethodCreateParams`,
    `PaymentMethod`, `PaymentRecord.PaymentMethodDetail`,
    `Refund.DestinationDetail`,
    `SetupIntentConfirmParamsPaymentMethodDatum`,
    `SetupIntentCreateParamsPaymentMethodDatum`,
    `SetupIntentModifyParamsPaymentMethodDatum`, and
    `checkout.SessionCreateParamsPaymentMethodOption`
    * Add support for `mandate` on
    `Charge.PaymentMethodDetail.Twint`,
    `PaymentAttemptRecord.PaymentMethodDetail.Twint`, and
    `PaymentRecord.PaymentMethodDetail.Twint`
    * Add support for new values `bizum` and `scalapay` on enums
    `PaymentIntentConfirmParams.excluded_payment_method_types`,
    `PaymentIntentCreateParams.excluded_payment_method_types`,
    `PaymentIntentModifyParams.excluded_payment_method_types`,
    `SetupIntentCreateParams.excluded_payment_method_types`,
    `SetupIntentModifyParams.excluded_payment_method_types`, and
    `checkout.SessionCreateParams.excluded_payment_method_types`
    * Change type of `PaymentIntentConfirmParamsPaymentMethodOption
    Twint.setup_future_usage`, `PaymentIntentCreateParamsPaymentM
    ethodOptionTwint.setup_future_usage`, `PaymentIntentModifyPar
    amsPaymentMethodOptionTwint.setup_future_usage`, and `checkou
    t.SessionCreateParamsPaymentMethodOptionTwint.setup_future_us
    age` from `literal('none')` to `enum('none'|'off_session')`
    * Add support for new values `bizum` and `scalapay` on enum
    `checkout.SessionCreateParams.payment_method_types`
    * ⚠️ Change type of `Checkout.Session.PaymentMethodOption.Twint
    .setup_future_usage` and
    `PaymentIntent.PaymentMethodOption.Twint.setup_future_usage`
    from `literal('none')` to `enum('none'|'off_session')`
    * Add support for new values `bizum` and `scalapay` on enums
    `ConfirmationTokenCreateParamsPaymentMethodDatum.type`,
    `PaymentIntentConfirmParamsPaymentMethodDatum.type`,
    `PaymentIntentCreateParamsPaymentMethodDatum.type`,
    `PaymentIntentModifyParamsPaymentMethodDatum.type`,
    `SetupIntentConfirmParamsPaymentMethodDatum.type`,
    `SetupIntentCreateParamsPaymentMethodDatum.type`, and
    `SetupIntentModifyParamsPaymentMethodDatum.type`
    * ⚠️ Add support for new values `bizum` and `scalapay` on enums
    `ConfirmationToken.PaymentMethodPreview.type` and
    `PaymentMethod.type`
    * Add support for new values `bizum` and `scalapay` on enums
    `CustomerListPaymentMethodsParams.type`,
    `PaymentMethodCreateParams.type`, and
    `PaymentMethodListParams.type`
    * Add support for `credited_items` on
    `InvoiceItem.ProrationDetail`
    * Add support for new value `twint` on enums
    `InvoiceCreateParamsPaymentSetting.payment_method_types`,
    `InvoiceModifyParamsPaymentSetting.payment_method_types`, `Su
    bscriptionCreateParamsPaymentSetting.payment_method_types`,
    and
    `SubscriptionModifyParamsPaymentSetting.payment_method_types`
    * Add support for `discountable` on `InvoiceCreatePreviewParams
    ScheduleDetailPhaseAddInvoiceItem`,
    `SubscriptionCreateParamsAddInvoiceItem`,
    `SubscriptionModifyParamsAddInvoiceItem`,
    `SubscriptionSchedule.Phase.AddInvoiceItem`,
    `SubscriptionScheduleCreateParamsPhaseAddInvoiceItem`, and
    `SubscriptionScheduleModifyParamsPhaseAddInvoiceItem`
    * Add support for `billing_schedules` on
    `InvoiceCreatePreviewParamsSubscriptionDetail`,
    `SubscriptionCreateParams`, `SubscriptionModifyParams`, and
    `Subscription`
    * Add support for new value `max_billed_until` on enums
    `InvoiceCreatePreviewParamsSubscriptionDetail.cancel_at`,
    `SubscriptionCreateParams.cancel_at`, and
    `SubscriptionModifyParams.cancel_at`
    * Add support for `amount_paid_off_stripe` on `Invoice`
    * ⚠️ Add support for new value `twint` on enums
    `Invoice.PaymentSetting.payment_method_types` and
    `Subscription.PaymentSetting.payment_method_types`
    * Add support for `twint` on `Mandate.PaymentMethodDetail` and
    `SetupAttempt.PaymentMethodDetail`
    * Add support for `metadata` on `PaymentIntent.TransferDatum`,
    `PaymentIntentCreateParamsTransferDatum`,
    `PaymentIntentModifyParamsTransferDatum`, and
    `Subscription.PendingUpdate`
    * Add support for `payment_data` on
    `PaymentIntent.TransferDatum`,
    `PaymentIntentCreateParamsTransferDatum`, and
    `PaymentIntentModifyParamsTransferDatum`
    * ⚠️ Add support for new values `bizum` and `scalapay` on enums
    `PaymentIntent.excluded_payment_method_types` and
    `SetupIntent.excluded_payment_method_types`
    * Add support for `blik_authorize` on
    `PaymentIntent.NextAction` and `SetupIntent.NextAction`
    * Add support for `payment_method_options` on
    `PaymentLinkCreateParams`, `PaymentLinkModifyParams`, and
    `PaymentLink`
    * Add support for new value `bizum` on enums
    `PaymentLinkCreateParams.payment_method_types` and
    `PaymentLinkModifyParams.payment_method_types`
    * ⚠️ Add support for new value `bizum` on enum
    `PaymentLink.payment_method_types`
    * Add support for `active` on
    `PaymentMethodConfigurationListParams`
    * Add support for `billed_until` on `SubscriptionItem`
    * Add support for `discount` and `discounts` on
    `Subscription.PendingUpdate`
    * Add support for `verifone_m425`, `verifone_p630`,
    `verifone_ux700`, and `verifone_v660p` on
    `Terminal.Configuration`,
    `terminal.ConfigurationCreateParams`, and
    `terminal.ConfigurationModifyParams`
    * Add support for new values `simulated_verifone_m425`,
    `simulated_verifone_p630`, `simulated_verifone_ux700`,
    `simulated_verifone_v660p`, `verifone_m425`, `verifone_p630`,
    `verifone_ux700`, and `verifone_v660p` on enum
    `terminal.ReaderListParams.device_type`
    * Add support for `api_error` and `print_content` on
    `Terminal.Reader.Action`
    * ⚠️ Add support for new value `print_content` on enum
    `Terminal.Reader.Action.type`
    * ⚠️ Add support for new values `simulated_verifone_m425`,
    `simulated_verifone_p630`, `simulated_verifone_ux700`,
    `simulated_verifone_v660p`, `verifone_m425`, `verifone_p630`,
    `verifone_ux700`, and `verifone_v660p` on enum
    `Terminal.Reader.device_type`
    * Add support for `customer` on
    `test_helpers.TestClockCreateParams`
    * Add support for new value `2026-05-27.dahlia` on enum
    `WebhookEndpointCreateParams.api_version`
    * Add support for `signer` on `V2.Core.Account.Identity.Busines
    sDetail.Document.ProofOfRegistration`, `V2.Core.Account.Ident
    ity.BusinessDetail.Document.ProofOfUltimateBeneficialOwnershi
    p`, `v2.core.AccountCreateParamsIdentityBusinessDetailDocumen
    tProofOfRegistration`, `v2.core.AccountCreateParamsIdentityBu
    sinessDetailDocumentProofOfUltimateBeneficialOwnership`, `v2.
    core.AccountModifyParamsIdentityBusinessDetailDocumentProofOf
    Registration`, `v2.core.AccountModifyParamsIdentityBusinessDe
    tailDocumentProofOfUltimateBeneficialOwnership`, `v2.core.Acc
    ountTokenCreateParamsIdentityBusinessDetailDocumentProofOfReg
    istration`, and `v2.core.AccountTokenCreateParamsIdentityBusi
    nessDetailDocumentProofOfUltimateBeneficialOwnership`
    * Add support for `azure_event_grid` on
    `V2.Core.EventDestination` and
    `v2.core.EventDestinationCreateParams`
    * ⚠️ Add support for new value `no_azure_partner_topic_exists`
    on enum
    `V2.Core.EventDestination.StatusDetail.Disabled.reason`
    * ⚠️ Add support for new value `azure_event_grid` on enum
    `V2.Core.EventDestination.type`
    * Add support for new value `azure_event_grid` on enum
    `v2.core.EventDestinationCreateParams.type`
    * ⚠️ Add support for new value
    `meter_event_value_too_many_digits` on enums `EventsV1Billing
    MeterErrorReportTriggeredEvent.Reason.ErrorType.code` and
    `EventsV1BillingMeterNoMeterFoundEvent.Reason.ErrorType.code`
    * Add support for event notifications
    `V2CommerceProductCatalogImportsFailedEvent`,
    `V2CommerceProductCatalogImportsProcessingEvent`,
    `V2CommerceProductCatalogImportsSucceededEvent`, and
    `V2CommerceProductCatalogImportsSucceededWithErrorsEvent`
    with related object `v2.commerce.ProductCatalogImport`
    * Add support for error codes
    `payment_method_microdeposit_processing_error` and
    `siret_invalid` on `Invoice.LastFinalizationError`,
    `PaymentIntent.LastPaymentError`, `SetupAttempt.SetupError`,
    `SetupIntent.LastSetupError`, and `StripeError`
    * #1813 Emit warning when `stripe-notify` header is present in
    response
    * See the changelog for more details.

++++ python-structlog:

  - update to 26.1.0:
    * Support for *better-exceptions* is deprecated and will be
    removed within a year.
    * Use our Rich integration or copy-paste the one line of code
    you need.
    * Python 3.15 support.
    * `structlog.dev.rich_monochrome_traceback` for Rich-based
    monochrome exception rendering and add support for it
    throughout `structlog.dev.ConsoleRenderer` when the user asks
    for no colors.
    * `structlog.BytesLogger` now has a `name` attribute which
    allows you to use it with the
    `structlog.stdlib.add_logger_name()` processor *without*
    using the standard library integration.
    * `structlog.processors.CallsiteParameterAdder` now supports
    `CallsiteParameter.QUAL_MODULE` that adds the qualified
    import name of the module of the callsite, or `__main__` if
    the module is the entry point.
    * This is only available for *structlog*-originated events
    since the standard library has no equivalent (except for the
    convention of setting the logger's name to `__name__`).
    * `structlog.stdlib.BoundLogger` now has `is_enabled_for()` and
    `get_effective_level()` methods that are snake_case aliases
    for its `isEnabledFor()` and `getEffectiveLevel()` methods.
    * This makes it more compatible with the native
    `structlog.typing.FilteringBoundLogger`, so you can swap
    configurations without changing your call sites.

++++ python-testfixtures:

  - update to 12.0.1:
    * Fix bug where :class:`frozensets <frozenset>` would not
    :func:`compare` equal when a library requiring ignore_eq for
    its types, such as :doc:`polars <polars>`, was present.
    * Comparers have moved from :mod:`!testfixtures.comparison` to
    :mod:`testfixtures.comparers`.
    * :func:`!django_compare` has been removed, :func:`compare` now
    works with Django models.
    * Refactoring of :class:`LogCapture` to introduce support for
    :doc:`loguru <loguru>`, :doc:`structlog <structlog>` and
    similar support for :doc:`twisted <twisted>` by way of the
    new :class:`~testfixtures.logcapture.CaptureSource`
    architecture.
    * :func:`compare` now supports per-type ignore_eq.
    * :func:`compare` now supports both :doc:`polars <polars>` and
    :doc:`pandas <pandas>` dataframes.
    * :func:`compare` now provides better feedback when objects
    being compared raised exceptions in their :any:`str` or
    :any:`repr`.
    * Added raises parameter to :meth:`OutputCapture.compare`,
    :meth:`LogCapture.check` and :meth:`LogCapture.check_present`
    to they can be more easily used in compositions.

++++ python-txtorcon:

  - update to 26.6.0:
    * eliminate GeoIP as a dependency (#409)
    This will still load Tor's geoip-db if GeoIP is installed, and
    the database is found database. Essentially this is just
    optimization: txtorcon will ask Tor for
    the country-code of anything interesting via the existing
    `get_location()` API.  +

++++ python-ty:

  - update to 0.0.49:
    * Fix site-package error when multiple versions of Python are
    installed in system path
    * Point at attribute's binding site in `invalid-await
    diagnostic
    * Report redefined legacy TypeVars
    * Add dedicated TDDs for narrowing constraints
    * Avoid caching same-file raw signatures
    * Cache reachability evaluations during inference
    * Compact retained definition maps
    * Omit redundant definition inference owner keys
  - update to 0.0.48:
    * Avoid redundant constraint saturation work
    * Add support for TypedDict `extra_items`
    * Improve `closed=True` TypedDict precision
    * Require subtyping for transitive constraint pivots
    * Sync vendored typeshed stubs (#25828). Typeshed diff
  - update to 0.0.47:
    * Avoid panicking on encountering a recursive NamedTuple that
    references a recursive NewType
    * Fix out-of-bound panic in notebooks involving suppression
    comments
    * Preserve overloads through callable protocol decorators
    * Sync vendored typeshed stubs (#25779). Typeshed diff
    * Avoid caching specialization-invariant known instances
    * Avoid resolving overload sets for ordinary functions
    * Store common definition inference results inline
    * Use `Box` etc. in `Files`
  - update to 0.0.46:
    * Avoid crash when hovering over Callable
    * Support `Callable()` in match statement class patterns
    * Improve support for `enum.property`
  - update to 0.0.45:
    * Avoid treating dynamic class attributes as instance
    attributes
    * Fix divergence in recursive inference due to ambiguous
    overload
    * Preserve literal promotion for mixed bounds
    * ### Diagnostics
    * Add `missing-type-argument` lint rule
    * ### Core type checking
    * Add support for narrowing on tuple match cases
    * Check implicit open TypedDict extra items
    * Create fresh copies of generic callable typevars
    * Preserve deprecation on replacement functions
    * Preserve intersection receivers during attribute lookup
    * Preserve transparent callable decorators
    * ### Performance
    * Avoid AST load for callable description names
    * Avoid caching absent class decorators and type parameters
    * Avoid caching atomic type specializations
    * Avoid caching constant constraint relations
    * Avoid caching missing implicit attributes
    * Avoid caching trivial class-header queries
    * Avoid caching trivial member lookups
    * Bypass member lookup for module imports
    * Cache constraint implication checks
    * Cache upper-bound satisfiability
    * Compact retained function type signatures
    * Compact retained use-def bindings
    * Consolidate retained narrowing constraints
    * Construct trivial constraint sets directly
    * Resolve function descriptors directly
    * Share code-generator classification across specializations
    * Share parameter lists with `Arc`
    * Use same-file expression inference in reachability
  - update to 0.0.44:
    * Avoid treating `sys.implementation.version` like
    `sys.version_info`
    * Fix anchor point for override diagnostics
    * Show type alias value on hover
    * Add caching for pattern match narrowing
    * Compact retained definition and expression identities
    * Reuse expression cache for TypedDict union inference
    * Upgrade Salsa
  - update to 0.0.43:
    * Don't inject `Unknown` from non-callable elements of
    intersection call
    * Don't needlessly disambiguate the same type alias
    * Fix variance inference for nested type aliases
    * Ignore rejected member annotations for synthesized bindings
    * Normalize dynamic class literals in cycle recovery
    * Register file roots for first-party search paths
    * Treat union-bound typevars like unions for `possibly-missing-
    attribute`

++++ python-uharfbuzz:

  - update to 0.55.0:
    * Bump urllib3 from 2.6.3 to 2.7.0 in /docs
    * Bump idna from 3.10 to 3.15 in /docs
    * Warn when using deprecated .create() methods
    * Render Sphinx deprecation notice from @deprecated decorator
    * Fix get_nominal_glyph and get_metric_position return
    annotations
    * Fix get_metric_position_with_fallback to use self
    * Fix get_axis_range return annotation
    * Update to HarfBuzz 14.2.1
    * Bind hb_face_set_get_table_tags_func()

++++ python-uv:

  - update to 0.11.21:
    * Add CPython 3.13.14 and 3.14.6
    * Add `environment.root` to `uv workspace metadata --sync`
    * Allow `uv upgrade` to update a single dependency constraint
    * Compute and pass `uv workspace metadata` payload in `ty
    check`
    * Make packaged applications the default for `uv init`
    * Add parallel discovery of Python versions for `uv python
    list`
    * Avoid normalizing source distribution names twice
    * Improve cache robustness and pruning behavior
    * Allow CI cache pruning without an sdist bucket
    * Avoid overflow when reading malformed cache entries
    * Preserve cached Python downloads during cache pruning
    * Reject running inside the cache
    * Fix Python discovery and version request edge cases
    * Avoid panics for Unicode Python version requests
    * Fix handling of non-critical errors in `uv python list` with
    path requests
    * Fix stop-discovery-at regression
    * Harden parsing and validation for package metadata,
    requirements, markers, URLs, and conflict sets
    * Allow trailing commas in version specifiers
    * Avoid panics for invalid UTF-8 URL credentials
    * Avoid panics for malformed source distribution filenames
    * Avoid panics for trailing extra separators
    * Avoid stack overflow for recursive requirements path aliases
    * Ignore reversed string compatible-release markers
    * Reject duplicate entries in conflict sets
    * Reject malformed hash options in requirements files
    * Reject source distribution filenames without a separator
    * Use UTF-8 lengths for requirement errors
    * Use UTF-8 lengths for trailing marker errors
    * Use byte offsets when peeking over requirements
    * Validate GraalPy ABI suffixes
    * Improve wheel entry-point error handling and virtual
    environment activation quoting
    * Propagate errors when reading wheel entry points
    * Quote virtual environment activation paths with shell
    metacharacters

++++ python-uv-build:

  - update to 0.11.7:
    * Upgrade CPython build to 20260414 including an OpenSSL
    security upgrade
    * Elevate configuration errors to `required-version` mismatches
    * Further improve TLS certificate validation messages
    * Improve `--exclude-newer` hints

++++ python-validate-pyproject:

  - update to 0.25:
    * Document `pipx run --spec='validate-pyproject[all]' validate-
    pyproject --help` by @cclauss
    * Test on Python 3.14 by @cclauss
    * Add PEP 794 support by @henryiii
    * Fix broken store loading if properties is nested by @henryiii
    * Fix more integer types by @henryiii
    * Update `uv` integration a bit by @henryiii
    * Allow `package-data` for stubs packages by @cdce8p
  - update to 0.24.1:
    * Fixed multi plugin id was read from the wrong place
    * Implemented alternative plugin sorting,
    https://github.com/abravalheri/validate-pyproject/pull/243
  - update to 0.24:
    * Fix integration with `SchemaStore` by loading extra/side
    schemas, #226, #229.
    * Add support for loading extra schemas, #226.
    * Fixed verify author dict is not empty, #232.
    * Added support for `validate_pyproject.multi_schema` plugins
    with extra schemas, #231.
    * `validate-pyproject` no longer communicates test dependencies
    via the `tests` extra and documentation dependencies
    dependencies via the `docs/requirements.txt` file. Instead
    `dependency-groups` have been adopted to support CI
    environments, #227.
    * As a result, `uv`'s high level interface also works for
    developers. You can use the `dependency-groups` package on
    PyPI if you need to convert to a classic requirements list.
    * Contributions by @henryiii.
  - update to 0.23:
    * Validate SPDX license expressions
  - update to 0.22:
    * Prevent injecting defaults and modifying input in-place,
  - update to 0.21:
    * Added support PEP 735
    * Added support PEP 639
    * Renamed testing extra to test
    * General updates in CI setup
  - update to 0.20.2:
    * Attempt to solve problems with release pipeline (CI), related
    to https://github.com/actions/upload-artifact/issues/618.
    * The package code is unchanged regarding v0.20.
  - update to 0.20.1:
    * Attempt to solve problems with release pipeline (CI).
    * The package code is unchanged regarding v0.20
  - update to 0.20:
    * ``setuptools`` plugin:
    * Update `setuptools.schema.json` in
    https://github.com/abravalheri/validate-pyproject/pull/206
  - update to 0.19:
    * Relax requirements about module names to also allow dash
    characters, #164
    * Migrate metadata to ``pyproject.toml`` , #192
  - update to 0.18:
    * Allow overwrite when schemas refer to the same `tool`,  #175.
  - update to 0.17:
    * Update version regex according to latest packaging version,
    https://github.com/abravalheri/validate-pyproject/pull/153
    * Remove duplicate `# ruff: noqa` by @Avasam,
    https://github.com/abravalheri/validate-pyproject/pull/158
    * Remove invalid top-of-the-file `# type: ignore` statement by
    @Avasam, https://github.com/abravalheri/validate-
    pyproject/pull/159
    * Align `tool.setuptools.dynamic.optional-dependencies` with
    `project.optional-dependencies,
    https://github.com/abravalheri/validate-pyproject/pull/170
    * Bump min Python version to 3.8,
    https://github.com/abravalheri/validate-pyproject/pull/167
  - update to 0.16:
    * Fix setuptools readme field , #116
    * Fix missing type keywords, #117
    * Add schema validator check, #118
    * Add ``SchemaStore`` conversion script, #119
    * Support uint formats (used by Ruff), #128
    * Allow tool(s) to be specified via URL (added CLI option:
    ``--tool``), #121
    * Allow schemas to be specified from ``SchemaStore`` (added CLI
    option: ``--store``), #133

++++ python-wakeonlan:

  - update to 3.3.0:
    * Add support for SecureOn password
    * Use trusted publishing

++++ python-weblate-language-data:

  - update to 2026.8:
    * ### Changes and improvements
    * feat: cover all Debian supported locales
    * feat: incorporate population data from wikidata
    * fix: use Sorani / Kurmanji to name Kurdish variants
    * chore: make the generated md compatible with the formatter
    * fix: add type annotations
    * feat: add Scots (Ulster)

++++ python-xmldiff:

  - update to 3.0:
    * Updated Python versions. 3.8 and 3.9 still works, but is
    officially unsupported, added 3.13, 3.14 and 3.15 to the
    supported versions.
    * Speeding up diffing by using dequeue [barucden]
    * Support namespace-prefixed move nodes [barucden]
    * Improved matching in certain cases [barucden]
    * UpdateTextIn() and UpdateTextAfter() now also has optional
    parameters "oldtext" which contains the text before update,
    or None, if there was no text.
    * Fixed a bug in the parsing of diff files.
  - drop fix-error-type.patch (upstream)

++++ python-zeroconf:

  - update to 0.149.16 (CVE-2026-48487, bsc#1268235):
    * Re-release for GHSA-qc2x-6f54-m6h9
    * Preserve scope_id when scoped AAAA arrives alongside unscoped
    * Skip NSEC records in ServiceBrowser to suppress spurious
    * Add blockbuster to detect blocking calls in asyncio tests
    * Scale aggregation timings 10x to speed up timing-dependent
    tests
    * Shave loopback timing overhead from remaining slow tests
    * Widen QM follow-up window in info_asking_default test
    * Bound record payload reads against rdlength overrun
    * Extract loopback Zeroconf fixtures and mock_incoming_msg
    helper

++++ python-zope.interface:

  - update to 8.5:
    * Build and upload free-threaded (cp314t, cp315t) wheels for
    all platforms. Expand CI testing for free-threaded Python
    3.14t from Linux-only to all platforms (macOS, Windows), and
    add 3.15t CI. See issue 374.
    * Replace all remaining PyDict_GetItem() calls in the C
    extension with exception-safe alternatives (PyDict_Contains,
    PyDict_GetItemWithError). PyDict_GetItem silently swallows
    exceptions from __hash__/__eq__, causing isOrExtends() to
    return False instead of raising TypeError for unhashable
    objects. Also use PyType_GetDict() on Python 3.13+ for free-
    threading safety when accessing the type dict. See issue 357.

++++ qsnapper:

  - Add 0001-improve-translation-installation.patch

++++ rtorrent:

  - Update to release 0.16.14
    * Deprecated or removed commands: `file.append`, `encoding.add`,
    `throttle.ip`, `dht.throttle.name`
    * DHT is now auto by default if session.path is set.
    * Max memory usage is now 32Gb by default on 64-bit platforms,
    and 1Gb on 32-bit platforms. As such there's no need for most
    users to change this value.

++++ scribus:

  - Add more upstream changes:
    * scribus_poppler_26_06_0_part2.patch
    * scribus_poppler_26_06_0_part3.patch

++++ tig:

  - tig 2.6.1:
    * Fix editor command injection vulnerability (boo#1268218)
    * bug fixes for UI and git operations
    * Handle the NO_COLOR environment variable

++++ viddy:

  - Update to version 1.3.1:
    * fix: satisfy clippy -D warnings
    * fix: create backup with owner-only permissions
    * docs: fix typos again
    * feat: made interval step and min interval configurable
    * feat: support for increasing and decreasing interval

------------------------------------------------------------------
------------------  2026-6-13  -  Jun 13 2026  -------------------
------------------------------------------------------------------

++++ DoomRunner:

  - added fix-symlinks.patch

++++ MozillaThunderbird:

  - Mozilla Thunderbird 140.12.0 ESR
    MFSA 2026-61 (bsc#1268071)
    * CVE-2026-12289 (bmo#2023443)
    Privilege escalation in the Graphics: WebRender component
    * CVE-2026-12290 (bmo#2024852)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12291 (bmo#2036929)
    Use-after-free in the Networking: HTTP component
    * CVE-2026-12292 (bmo#2038465)
    Incorrect boundary conditions in the Web Audio component
    * CVE-2026-12294 (bmo#2039873)
    Sandbox escape in the DOM: Workers component
    * CVE-2026-12295 (bmo#2040160)
    Sandbox escape in the DOM: Navigation component
    * CVE-2026-12298 (bmo#2041981)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12296 (bmo#2040515)
    Sandbox escape in the Security: Process Sandboxing component
    * CVE-2026-12297 (bmo#2041610)
    Sandbox escape due to incorrect boundary conditions in the
    Networking component
    * CVE-2026-12299 (bmo#2043139)
    JIT miscompilation in the DOM: Core & HTML component
    * CVE-2026-12329 (bmo#2044738)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12302 (bmo#2034489)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12304 (bmo#2034944)
    Same-origin policy bypass in the Networking: Cookies component
    * CVE-2026-12305 (bmo#2037290)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12306 (bmo#2037323)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12307 (bmo#2038133)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12308 (bmo#2038302)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12309 (bmo#2038476)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12310 (bmo#2039707)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12311 (bmo#2040177)
    Information disclosure, sandbox escape in the Security:
    Process Sandboxing component
    * CVE-2026-12312 (bmo#2040383)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12313 (bmo#2040477)
    Information disclosure, sandbox escape in the Security:
    Process Sandboxing component
    * CVE-2026-12314 (bmo#2041856)
    Memory safety bug fixed in Thunderbird ESR 140.12
    * CVE-2026-12315 (bmo#2042058)
    Mitigation bypass in the DOM: Security component
    * CVE-2026-12330 (bmo#2029326)
    Incorrect boundary conditions in the Internationalization
    component
    * CVE-2026-12324 (bmo#2038444)
    Incorrect boundary conditions in the Graphics: CanvasWebGL
    component
    * CVE-2026-12325 (bmo#2039443)
    Denial-of-service in the Graphics: ImageLib component
    * CVE-2026-12327 (bmo#2011842, bmo#2023902, bmo#2025512, bmo#2027312,
    bmo#2029444, bmo#2036571, bmo#2036900, bmo#2036936, bmo#2037995,
    bmo#2038551, bmo#2040717, bmo#2042724)
    Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird
    ESR 140.12, Firefox 152 and Thunderbird 152
    * CVE-2026-12328 (bmo#2029402, bmo#2038477, bmo#2039726, bmo#2041373,
    bmo#2042268, bmo#2042451, bmo#2042782, bmo#2042858, bmo#2042929,
    bmo#2042965, bmo#2043213)
    Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR
    140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

++++ audacious:

  - Update to version 4.6.1
    * Use XDG cache dir to store temporary files
    * Accept embedded lyrics in more cases
    * Bump .so and plugin ABI versions retrospectively
    * Fix build on systems using musl instead of glibc

++++ audacious-plugins:

  - Update to verstion 4.6.1
    * Fix build on systems using musl instead of glibc

++++ chromium:

  - added patches:
    * disable-ai.patch (re-add since now ported to 149)
  - added configs:
    * disable-ai.json
    (both parts taken from fedora package)

++++ lsp-plugins:

  - update to 1.2.31
    * In this release we introduce support of PipeWire without and
    intermediate JACK layer.
    * The overall change list is the following:
    * Added new 'standalone' build feature which now replaces the 'jack'
    build feature for launching standalone plugins.
    * The feature 'jack' is now responsible for building JACK audio
    backend for standalone plugins.
    * Moved all JACK-related code into a separate lsp-audio-jack module.
    * Added support of PipeWire audio backend using lsp-audio-pipewire
    module, new build feature 'pipewire'.
    * Updated build system: ASAN, CROSS_COMPILE, DEBUG, DEVEL, PROFILE,
    STRICT, TEST, TRACE makefile flags replaced with 'asan', 'crosscompile',
    'debug', 'devel', 'profile', 'strict', 'test' and 'trace' FEATURE flags.
    * Updated makefiles to not to clash with launcher tool on MacOS.
    * Some fixes arount CLAP plugin format for better support of MacOS
    (contributed by Benjamin Zeiss @ GitHub).
    * Added previous and next preset selection in the preset window.
    * Added possibility to reveal played sample on 'Listen' button press
    for Sampler, Multisampler and Trigger plugin series.
    * Updated behaviour of the AudioSample controller when displaying load status
    to prevent the UI blinking when switching between samples in the file navigator.
    * Extended dynamics range for Gate and Multiband Gate plugin series.
    * Improved text rendering in hosts that provide their own implementation
    of FreeType library (like Ardour) by loading the system version of FreeType
    library if it is available and has greater version number.
    * Some costmetic changes in text lables of the UI for several plugins.
    * Re-numbered plugins' parameter labels to start counting parameters with
    1 for the following plugins:
    * Artistic Delay;
    * Crossover;
    * Dynamics Processor;
    * Impulse Responses;
    * Impulse Reverb;
    * Multiband Compressor;
    * Multiband Dynamics Processor;
    * Multiband Expander;
    * Multiband Gate;
    * Multiband RingMod Sidechain;
    * Room Builder;
    * Slap-Back Delay;
    * Spectrum Analyzer.
    * The auto-play and auto-load features in file navigator have been
    moved into separate 'UI Behavior' options for Impulse Responses
    and Impulse Reverb Plugin series.
    * The ComboBox and ComboGroup widgets now properly react on the 'ESC'
    key pressure and hide the dropdown list when it is open.
    * Fixed Drag & Drop issue under X11 (contributed by Justin Frankel).
    * Fixed endless vertical flip of the image on MacOS (contributed by Hoshino Lina).
    * Fixed some bugs in the AudioEnvelope controller that did not allow
    to fully reset the envelope to defaults.
    * Fixed out-of-sync event handling for CLAP and VST2 extra UI run loop
    under Linux when hiding and showing plugin window.
    * Fixed generic UI failure for CLAP: removed normalization for discrete parameters.
    * Fixed improper handling of plugin factory initialization/finalization
    for CLAP plugin format (added support of series of initializations and
    finalizations as it is allowed by CLAP standard).

++++ coredns:

  - Update to version 1.14.4:
    * plugin/proxyproto: Prevent nil pointer dereference when dropping malformed
    PROXY packets
    * Bump dependencies
    * plugin/cache: allow cache TTLs above default 3600s
    * plugin/dnssec: sign each RRset with the zone that owns its name, not the
    query zone
    * dnsserver: use http.LocalAddrContextKey for DoH local address
    * build: add loong64 arch support
    * core: bound HTTP/3 request header size for DoH3
    * fix: reject invalid any and local config
    * plugin/forward: add hostname resolution support for TO endpoints
    * fix(kubernetes): remove debug fmt.Println from multicluster zone validation
    * feat(core): expose TLS ConnectionState (SNI) for DoQ
    * fix: use descriptive error for unknown block options in health and log
    plugins
    * plugin/forward: Forward NODATA responses to Next handler
    * fix: reject unknown chaos block options
    * fix: reject unknown trace and dnstap block options
    * fix: reject unknown ready plugin properties
    * pkg/tls: remove duplicate cipher suites
    * fix(azure): apply `access` mode to every zone in the same block
    * feat(secondary): add fallthrough support
    * fix(cache): prefer positive cache over SERVFAIL in ncache
    * plugin/file: trigger reload of zones based on mtime
    * plugin/dnstap: feature: added incoming connection support
    * plugin/file: canonicalize escape form in owner names
    * feat(cache): add optional verify timeout to serve_stale

++++ fresh-editor:

  - Update to version v0.4.0:
    * see https://github.com/sinelaw/fresh/releases/tag/v0.4.0

++++ gemini-cli:

  - update to 0.46.0:
    * fix(core): harden PTY resize against native crashes
    * Changelog for v0.45.0-preview.0
    * Changelog for v0.44.0
    * fix(cli): prevent spam loop when preferredEditor is invalid
    * Adding quote
    * Transition to flash GA model when experiment flag is present.
    * chore(ci): add optimized PR size labeler and batch workflows
    * fix(ci): use pull_request_target trigger to grant write
    access on fork PRs
    * fix(patch): cherry-pick e4315b3 to
    release/v0.46.0-preview.0-pr-27645 to patch version
    v0.46.0-preview.0 and create version 0.46.0-preview.1
    * fix(patch): cherry-pick f40498d to
    release/v0.46.0-preview.1-pr-27676 to patch version
    v0.46.0-preview.1 and create version 0.46.0-preview.2
    * fix(patch): cherry-pick f08b4af to
    release/v0.46.0-preview.2-pr-27749 to patch version
    v0.46.0-preview.2 and create version 0.46.0-preview.3
    * **Full Changelog**: https://github.com/google-gemini/gemini-
    cli/compare/v0.45.3...v0.46.0
  - update to 0.45.3:
    * fix(patch): cherry-pick f08b4af to release/v0.45.2-pr-27749
    to patch version v0.45.2 and create version 0.45.3
    * **Full Changelog**: https://github.com/google-gemini/gemini-
    cli/compare/v0.45.2...v0.45.3

++++ ghc-encoding:

  - Update encoding to version 0.10.3.
    Changes from 0.10.2 to 0.10.3
  - --------------------------
    * Do not depend on `ghc-prim`, `extensible-exceptions`.
    * Allow Cabal-3.16, binary-0.10 and containers-0.8.

++++ gnome-commander:

  - Update to version 2.0.3:
    + This release fixes the following bugs:
  - JPEG images marked as rotated in metadata weren’t displayed
    rotated
  - Search dialog: “Case sensitive” button for content search had
    reversed effect
  - Size of the Search dialog wasn’t restored after restarting
    application
  - Bogus keyboard input focus after clicking toolbar buttons
  - File list theme wasn’t applied in the Search dialog
  - Overlong contents in file list cells were cut off, not
    ellipsized
  - Internal viewer: incorrect handling of the file start when
    searching for a single character backwards

++++ golang-github-prometheus-alertmanager:

  - update to 0.33.0:
    * [CHANGE] The '--enable-feature=auto-gomaxprocs' option has been
    removed. This flag had no effect since v0.29 and was deprecated
    in v0.32. It can be safely removed from any startup scripts.
    [#5090], #5251
    * [CHANGE] Add group-key-in-metrics feature flag. #5047
    * [CHANGE] Move AlertMarker, GroupMarker to marker package. #5047
    * [CHANGE] Remove alertmanager_marked_alerts. #5047
    * [CHANGE] Remove the following from types package: MemMarker,
    AlertState*, AlertStatus. #5047
    * [FEATURE] Introduce per aggregation group AlertMarkers and drop
    Global Alert Marker. #5047
    * [FEATURE] ui: Add support for silence annotations. #5017
    * [FEATURE] api: Add receiver labels and receiver_matchers filter
    to /api/v2/receivers, /api/v2/alerts, and
    /api/v2/alerts/groups. #5152
    * [FEATURE] eventrecorder: Add structured event recorder behind
  - -enable-feature=event-recorder, with file, webhook, and kafka
    outputs. #5072, #5246
    * [ENHANCEMENT] Add the use_aws_http_client config option to the
    sns notifier. #5178
    * [ENHANCEMENT] template: Add now function to get current time.
    [#5188]
    * [ENHANCEMENT] docs: Clarify YAML quoting vs matcher token
    quoting in UTF-8 matchers section. #5264
    * [BUGFIX] jira: Allow disabling the resolve transition when
    resolve_transition is not set. #4821
    * [BUGFIX] jira: Include unresolved issues in wont_fix_resolution
    JQL to prevent duplicate issue creation. #5185
    * [BUGFIX] sns: Support the AWS_CA_BUNDLE env variable for the
    sns notifier. #5178
  - revert go_modules replace for golang.org/x/net as this is
    upstream now

++++ helm:

  - update to 4.2.1 (bsc#1270127, CVE-2026-48978):
    * Fixed data race detected by -race flag when concurrent
    goroutines (upgrade + rollback, install + uninstall) both call
    GetWaiterWithOptions on the same FailingKubeClient instance
    [#31925]
    * Fixed helm command success messages writing to stderr instead
    of stdout. Now correctly outputing to stdout #32056
    * Fixed Helm 4 emitting "unable to find exact version" when using
    version range constraints #31757
    * Fixed a race condition in WaitForDelete where the status
    observer canceled the watch too early, causing intermittent
    failures when running a full test suite #32081
    * Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026
    [#32153]
    * Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1,
    controller-runtime 0.24.1 and k8s 1.36.1 #32128
    * Dependency updates
  - removed go_modules replace for golang.org/x/net as the fix is now
    upstream

++++ helm3:

  - Update to version 3.21.1 (bsc#1270127, CVE-2026-48978):
    * Fixed nil pointer panic that could happen with helm template in
    ClientOnly flows. Now correctly returns a template error #31920
    * Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026
    [#32152]
    * Bumped Go from 1.25 to 1.26 #32168
    * Dependency version updates
  - chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
  - chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
  - chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
  - chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
  - chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
  - chore(deps): bump github.com/distribution/distribution/v3
  - chore(deps): bump github.com/containerd/containerd from
    1.7.30 to 1.7.32
  - chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0
    to 3.5.0
  - chore(deps): bump github.com/mattn/go-shellwords from 1.0.12
    to 1.0.13
  - chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
  - chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0
  - chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0

++++ iosevka-fonts:

  - Update to v34.6.2
    * Changes of version 34.6.2
    = Add Characters:
    ~ LATIN SMALL LETTER R WITH CROSSED-TAIL (U+AB49).
    = Refine shape of the following characters:
    ~ LATIN LETTER REVERSED ESH LOOP (U+01AA).
    ~ LATIN CAPITAL LETTER OU (U+0222).
    ~ LATIN SMALL LETTER OU (U+0223).
    ~ LATIN SMALL LETTER L WITH CURL (U+0234).
    ~ LATIN SMALL LETTER R WITH FISHHOOK (U+027E).
    ~ LATIN SMALL LETTER J WITH CROSSED-TAIL (U+029D).
    ~ COMBINING ASTERISK BELOW (U+0359).
    ~ GREEK SMALL LETTER XI (U+03BE) (#3110).
    ~ CYRILLIC CAPITAL LETTER LJE (U+0409).
    ~ CYRILLIC CAPITAL LETTER DE (U+0414).
    ~ CYRILLIC CAPITAL LETTER EL (U+041B).
    ~ CYRILLIC SMALL LETTER DE (U+0434).
    ~ CYRILLIC SMALL LETTER EL (U+043B).
    ~ CYRILLIC SMALL LETTER LJE (U+0459).
    ~ CYRILLIC CAPITAL LETTER EL WITH TAIL (U+04C5).
    ~ CYRILLIC SMALL LETTER EL WITH TAIL (U+04C6).
    ~ CYRILLIC CAPITAL LETTER KOMI LJE (U+0508).
    ~ CYRILLIC SMALL LETTER KOMI LJE (U+0509).
    ~ CYRILLIC CAPITAL LETTER EL WITH HOOK (U+0512) ... CYRILLIC
    SMALL LETTER LHA (U+0515).
    ~ CYRILLIC CAPITAL LETTER EL WITH MIDDLE HOOK (U+0520).
    ~ CYRILLIC SMALL LETTER EL WITH MIDDLE HOOK (U+0521).
    ~ CYRILLIC CAPITAL LETTER DZZHE (U+052A) ... CYRILLIC SMALL
    LETTER EL WITH DESCENDER (U+052F).
    ~ CYRILLIC SMALL LETTER LONG-LEGGED DE (U+1C81).
    ~ LATIN LETTER SMALL CAPITAL OU (U+1D15).
    ~ CYRILLIC LETTER SMALL CAPITAL EL (U+1D2B).
    ~ LATIN SMALL LETTER R WITH FISHHOOK AND MIDDLE TILDE
    (U+1D73).
    ~ MODIFIER LETTER SMALL J WITH CROSSED-TAIL (U+1DA8).
    ~ COMBINING ASTERISK ABOVE (U+20F0).
    ~ MERCURY (U+263F).
    ~ COMBINING CYRILLIC LETTER DE (U+2DE3).
    ~ COMBINING CYRILLIC LETTER EL (U+2DE7).
    ~ CYRILLIC CAPITAL LETTER SOFT DE (U+A662) ... CYRILLIC SMALL
    LETTER SOFT EL (U+A665).
    ~ CYRILLIC CAPITAL LETTER DWE (U+A680).
    ~ CYRILLIC SMALL LETTER DWE (U+A681).
    ~ CYRILLIC CAPITAL LETTER DZZE (U+A688).
    ~ CYRILLIC SMALL LETTER DZZE (U+A689).
    ~ LATIN SMALL LETTER R WITHOUT HANDLE (U+AB47).
    ~ MODIFIER LETTER SMALL LETTER R WITH FISHHOOK (U+107A9).
    ~ LATIN SMALL LETTER R WITH FISHHOOK AND PALATAL HOOK
    (U+1DF16).
    ~ MODIFIER LETTER CYRILLIC SMALL DE (U+1E034).
    ~ MODIFIER LETTER CYRILLIC SMALL EL (U+1E03A).
    ~ MODIFIER LETTER CYRILLIC SMALL DZZE (U+1E04A).
    ~ CYRILLIC SUBSCRIPT SMALL LETTER DE (U+1E055).
    ~ CYRILLIC SUBSCRIPT SMALL LETTER EL (U+1E05B).
    = Make certain characters slightly wider under
    Quasi-Proportional. Affected characters:
    ~ CYRILLIC CAPITAL LETTER YN (U+A65E).
    ~ CYRILLIC SMALL LETTER YN (U+A65F).

++++ kargo-cli:

  - update to 1.10.7:
    no CLI-related changes or dependency updates

++++ kubectl-switch:

  - Update to version 2.4.21:
    * Bug Fixes
  - 83cb33a: fix(go): update charm.land/lipgloss/v2 ( v2.0.3 →
    v2.0.4 ) (@mr-borboto[bot])
  - 1ec87ef: fix(go): update kubernetes monorepo ( v0.36.1 →
    v0.36.2 ) (@mr-borboto[bot])
    * Chores
  - 247d061: chore(mise): update go ( 1.26.3 → 1.26.4 )
    (@mr-borboto[bot])

++++ kumactl:

  - Update to version 2.14.0:
    Large update:
    https://github.com/kumahq/kuma/releases/tag/v2.14.0
    kumactl-related changes
    * feat(kumactl): deprecate install observability (#15706)
    * feat(kumactl): allow applying entire directories (#15813)
    Dependencies
    * chore(deps): bump kumahq/kuma-gui to
    690f712dd74394a66e0f542d6d5601b90909b495 (#16942)
    * chore(deps): bump kumahq/kuma-gui to
    877e64dba8245cf6b5473db155eb8612dba8a322 (#16938)
    * chore(deps): bump kumahq/kuma-gui to
    bcde297fe1db29ff9fc0b1c1678f0875727cb3f6 (#16931)
    * chore(deps): bump envoy from 1.38.1 to 1.38.2 (#16927)
    * chore(deps): bump kumahq/ci-tools from v1.4.5 to v1.4.6
    (#16928)
    * chore(deps): bump kumahq/kuma-gui to
    39f7bde0c666ce36689a554019370dc5e176010f (#16922)
    * chore(deps): bump kumahq/kuma-gui to
    97128e9534b883d302b289b537c23ec7842a26fe (#16918)
    * chore(deps): bump kumahq/kuma-gui to
    067d5e5ff5afde5a0ffad5e31936cdea41c671d8 (#16905)
    * chore(deps): bump kumahq/kuma-gui to
    5a21d2dbb1372ee97ccac094d57f52d855a9beed (#16872)
    * chore(deps): bump envoy from 1.38.0 to 1.38.1 (#16900)
    * chore(deps): security update (#16865)
    * chore(deps): bump kumahq/kuma-gui to
    5a21d2dbb1372ee97ccac094d57f52d855a9beed (#16863)
    * chore(deps): bump kumahq/kuma-gui to
    7a7a37b2d514ba23dc194d9d6358f9d860c9dc05 (#16862)
    * chore(deps): bump kumahq/kuma-gui to
    24122c5510d638e044aa34f8f134f4ff8e0e390b (#16855)
    * chore(deps): bump kumahq/kuma-gui to
    bc3a2c694f0eca4e6a501c8028235f068b3c66e1 (#16854)
    * chore(deps): bump kumahq/kuma-gui to
    9479dd8e626cac5a74827f3a79c7a453827ec7e0 (#16853)
    * chore(deps): bump kumahq/kuma-gui to
    5da77e3c6421a33b710c117157dc92adb81de373 (#16851)
    * chore(deps): bump kumahq/kuma-gui to
    5ef17e6018658a2e0fb3514094143c8048878b73 (#16845)
    * chore(deps/dev): bump grafana/dashboard-linter from 5e22d6d to
    0.1.1 (#16822)
    * chore(deps): bump kumahq/kuma-gui to
    af96b95cd2e4dedf0d7f70a5768f110a0b6b98dd (#16825)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    487f66a to 5a7b674 (#16811)
    * chore(deps): bump google.golang.org/genproto/googleapis/api
    from 0a33c5d to 3dc84a4 (#16813)
    * chore(deps): bump opentelemetry-go monorepo (#16819)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.15.0 to
    1.15.1 (#16814)
    * chore(deps): bump golang.org/x/exp from 74f9aab to c761662
    (#16812)
    * chore(deps): bump kumactl install demo|observability images
    (#16818)
    * chore(deps): bump opentelemetry-go-contrib monorepo from 0.68.0
    to 0.69.0 (#16820)
    * chore(deps): bump metallb from 0.16.0 to 0.16.1 (#16816)
    * chore(deps): bump github.com/prometheus/common from 0.67.5 to
    0.68.0 (#16817)
    * chore(deps/dev): bump buf from 1.69.0 to 1.70.0 (#16821)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.15.0 to
    1.15.1 (#16815)
    * chore(deps/dev): bump npm:@redocly/cli from 2.30.6 to 2.31.2
    (#16823)
    * chore(deps): bump kumahq/kuma-gui to
    2f5635997e58f99ccadff235a7fe631e27d982c7 (#16780)
    * ci(deps): skip deps with unpublished fix ver (#16770)
    * chore(deps/dev): bump npm:@redocly/cli from 2.30.5 to 2.30.6
    (#16769)
    * chore(deps): bump kumahq/kuma-gui to
    d7c8157c0faa0efb8d2c1ba9b9d4a9127c6e1ee2 (#16767)
    * chore(deps): bump kumahq/kuma-gui to
    971dda7ac22ef3219e12990cc492e849452dca11 (#16761)
    * chore(deps/dev): bump protoc from 34.1 to 35.0 (#16756)
    * chore(deps): bump metallb from 0.15.3 to 0.16.0 (#16753)
    * chore(deps): bump debian from 13.4 to 13.5 (#16747)
    * chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0
    (#16738)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.14.6 to
    1.15.0 (#16748)
    * chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
    (#16727)
    * chore(deps/dev): bump npm:@redocly/cli from 2.30.3 to 2.30.5
    (#16746)
    * chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0
    (#16752)
    * chore(deps): bump github.com/exaring/otelpgx from 0.10.0 to
    0.11.1 (#16750)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.14.6 to
    1.15.0 (#16749)
    * chore(deps): bump golangci/golangci-lint-action from 9.2.0 to
    9.2.1 (#16745)
    * chore(deps): bump postgres:latest from f7ce845 to 8ff36f3
    (#16744)
    * chore(deps): bump k8s.io/kube-openapi from ef417d0 to aa012df
    (#16742)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    3700d41 to 0a33c5d (#16741)
    * chore(deps): bump kumactl install demo|observability images
    (#16743)
    * chore(deps/dev): bump skaffold from 2.20.0 to 2.21.0 (#16755)
    * chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0
    (#16751)
    * chore(deps): bump kumahq/kuma-gui to
    ebbe48a1dae12800473c9841db4887cadbfbdcfe (#16712)
    * chore(deps): bump kumahq/kuma-gui to
    6c7935431a127655e35469ea8aec636ec22e4adf (#16708)
    * chore(deps): bump kumahq/kuma-gui to
    04e1def90efd172e3ff58942064b53be4757fde9 (#16704)
    * chore(deps): bump kumahq/kuma-gui to
    932edeab5826c8f7403216837ba89fc000f83c90 (#16691)
    * chore(deps): bump github.com/invopop/jsonschema from 0.13.0 to
    0.14.0 (#16666)
    * chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1
    (#16656)
    * chore(deps): bump ginkgo from 2.28.3 to 2.29.0 (#16665)
    * chore(deps): bump kumahq/kuma-gui to
    24dc5d43dd0e763841d421e002463743f6390a0e (#16678)
    * chore(deps): bump kubernetes monorepo from 0.36.0 to 0.36.1
    (#16658)
    * chore(deps/dev): bump grpc-go/protoc-gen-go-grpc from 1.6.1 to
    1.6.2 (#16662)
    * chore(deps): bump kumahq/kuma-gui to
    a70161d5f42ad12d8402bc2f13beac8d15fba136 (#16674)
    * chore(deps): bump github.com/gruntwork-io/terratest from 0.56.0
    to 1.0.0 (#16670)
    * chore(deps/dev): bump controller-runtime/setup-envtest from
    0.24.0 to 0.24.1 (#16661)
    * chore(deps/dev): bump skaffold from 2.19.0 to 2.20.0 (#16669)
    * chore(deps): bump k8s.io/kube-openapi from b540ad9 to ef417d0
    (#16652)
    * chore(deps): bump postgres:latest from 7e32e98 to f7ce845
    (#16653)
    * chore(deps): bump
    gcr.io/distroless/static-debian12:debug-nonroot from afead12 to
    f414196 (#16650)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    60b97b3 to 3700d41 (#16651)
    * chore(deps): bump
    gcr.io/distroless/base-nossl-debian12:debug-nonroot from
    6cca41b to 6cec643 (#16649)
    * chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug
    from eacaa3a to 35a3865 (#16648)
    * chore(deps): bump kubectl from 1.36.0 to 1.36.1 (#16657)
    * chore(deps): bump kumactl install demo|observability images
    (#16659)
    * chore(deps): bump
    gcr.io/k8s-staging-build-image/distroless-iptables from 0.9.1
    to 0.9.2 (#16654)
    * chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to
    0.24.1 (#16660)
    * chore(deps/dev): bump npm:@redocly/cli from 2.30.2 to 2.30.3
    (#16663)
    * chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.41.0
    (#16667)
    * chore(deps): bump helm from 4.1.4 to 4.2.0 (#16668)
    * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5
    (#16655)
    * chore(deps): bump actions/create-github-app-token from 3.1.1 to
    3.2.0 (#16664)
    * chore(deps): bump kumahq/kuma-gui to
    373511f850f7836136e0f4c4f08a9174d41023d1 (#16598)
    * chore(deps): bump kumahq/kuma-gui to
    4ad878a066146e15e33b150ac14e69ecc91c442e (#16585)
    * chore(deps/dev): bump controller-tools/cmd/controller-gen from
    0.20.1 to 0.21.0 (#16530)
    * chore(deps): bump kumahq/kuma-gui to
    108456eb92f55cdaa6b0aa31ff03f3ee2ec4c40c (#16561)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    7cedc36 to 60b97b3 (#16515)
    * chore(deps): bump golang.org/x/exp from 746e56f to 74f9aab
    (#16514)
    * chore(deps): bump k8s.io/utils from 28399d8 to ff6756f (#16517)
    * chore(deps): bump kumahq/kuma-gui to
    fca9a4d0b4d59b5b2828e4685db88255ee75ed9d (#16504)
    * chore(deps): bump k8s.io/kube-openapi from b7f5293 to b540ad9
    (#16516)
    * chore(deps): bump postgres:latest from 7848165 to 7e32e98
    (#16518)
    * chore(deps): bump redis: from 832d778 to 0c34149 (#16519)
    * chore(deps): bump sigs.k8s.io/controller-tools from 0.20.1 to
    0.21.0 (#16529)
    * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0
    (#16528)
    * chore(deps/dev): bump npm:@redocly/cli from 2.29.2 to 2.30.2
    (#16532)
    * chore(deps): bump debian:13.4 from 35b8ff7 to e2d08da (#16513)
    * chore(deps): bump golangci-lint from 2.12.1 to 2.12.2 (#16522)
    * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4
    (#16521)
    * chore(deps): bump cloudsmith-io/cloudsmith-cli-action from
    2.0.2 to 2.0.3 (#16520)
    * chore(deps/dev): bump go from 1.26.2 to 1.26.3 (#16523)
    * chore(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0
    (#16527)
    * chore(deps): security update (#16506)
    * chore(deps): bump kumahq/kuma-gui to
    41384303f5470f8faa05303d333a7fd4145c5308 (#16500)
    * chore(deps/dev): bump
    oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen from 2.6.0 to
    2.7.0 (#16482)
    * chore(deps): bump kumahq/kuma-gui to
    852e2da42c7cef225945f1333dcadf932375d7a5 (#16495)
    * chore(deps): bump kumahq/kuma-gui to
    5bc3b6c402f55180a04f20363c2fe3dc3084642d (#16491)
    * chore(deps): bump kubernetes monorepo from 0.35.4 to 0.36.0
    (#16401)
    * chore(deps): bump ginkgo from 2.28.2 to 2.28.3 (#16470)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.14.5 to
    1.14.6 (#16468)
    * chore(deps/dev): bump buf from 1.68.4 to 1.69.0 (#16480)
    * chore(deps): bump k8s.io/kube-openapi from ec9c827 to b7f5293
    (#16467)
    * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0
    to 3.5.0 (#16474)
    * chore(deps): bump prom/prometheus from 3.11.2 to 3.11.3
    (#16472)
    * chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0
    (#16475)
    * chore(deps): bump projectcalico/tigera-operator from 3.31.5 to
    3.32.0 (#16478)
    * chore(deps): bump golangci-lint from 2.11.4 to 2.12.1 (#16477)
    * chore(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0
    (#16476)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.14.5 to
    1.14.6 (#16469)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from c8b4b9d to 0.24.0 (#16481)
    * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#16471)
    * chore(deps): bump kumahq/kuma-gui to
    fd302e55640b31b68b9e2b890e2c7f76fbbcff1d (#16453)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    e10c466 to 7cedc36 (#16444)
    * chore(deps): bump envoy from 1.37.2 to 1.38.0 (#16446)
    * chore(deps): bump ginkgo from 2.28.1 to 2.28.2 (#16445)
    * chore(deps): bump kumahq/kuma-gui to
    8ec80744a696871597230f39d022c80ef5c52229 (#16372)
    * chore(deps): bump debian:13.4 from 3352c2e to 35b8ff7 (#16393)
    * chore(deps): bump postgres:latest from 52e6ffd to 7848165
    (#16395)
    * chore(deps): bump kubectl from 1.35.4 to 1.36.0 (#16400)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    afd174a to e10c466 (#16394)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from e4a998c to c8b4b9d (#16398)
    * chore(deps/dev): bump skaffold from 2.18.3 to 2.19.0 (#16403)
    * chore(deps): bump redis: from 1f07381 to 832d778 (#16396)
    * chore(deps/dev): bump buf from 1.68.2 to 1.68.4 (#16397)
    * chore(deps/dev): bump npm:@redocly/cli from 2.28.0 to 2.29.2
    (#16402)
    * chore(deps): bump kumahq/kuma-gui to
    5b81cc0a65d82af32b980b700efc10c5a2909310 (#16370)
    * chore(deps): bump kumahq/kuma-gui to
    68d4387d0eb5a990f98b327cfab41451a59b58fa (#16352)
    * chore(deps): bump kumahq/kuma-gui to
    35f17bc2d7fd7352103953a31ca931a960453719 (#16344)
    * chore(deps): bump grafana/grafana from 12.4.3 to 13.0.1
    (#16315)
    * chore(deps): bump kumahq/kuma-gui to
    8cb5e34c7be353928695efa9e3a5076309c387c9 (#16317)
    * chore(deps): bump kubernetes monorepo from 0.35.3 to 0.35.4
    (#16308)
    * chore(deps): bump kumahq/kuma-gui to
    1d0f6978fd33c3f6577deb2c396c233e25160be7 (#16316)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 6210f84 to e4a998c (#16310)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    6f92a3b to afd174a (#16301)
    * chore(deps): bump k8s.io/kube-openapi from 16be699 to ec9c827
    (#16302)
    * chore(deps): bump kumactl install demo|observability images
    (#16303)
    * chore(deps): bump actions/cache from 5.0.4 to 5.0.5 (#16304)
    * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#16306)
    * chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2
    (#16305)
    * chore(deps): bump kubectl from 1.35.3 to 1.35.4 (#16307)
    * chore(deps): bump projectcalico/tigera-operator from 3.31.4 to
    3.31.5 (#16309)
    * chore(deps/dev): bump npm:@redocly/cli from 2.26.0 to 2.28.0
    (#16313)
    * chore(deps/dev): bump skaffold from 2.18.2 to 2.18.3 (#16311)
    * chore(deps/dev): bump buf from 1.67.0 to 1.68.2 (#16312)
    * chore(deps/dev): bump yq from 4.52.5 to 4.53.2 (#16314)
    * chore(deps): bump kumahq/kuma-gui to
    79cbae61c7534316734c52b9552289ec36dfd3db (#16295)
    * chore(deps): bump kumahq/kuma-gui to
    0d604a1e261fe43cbca5651c736c254ece23541d (#16292)
    * chore(deps): bump github.com/moby/spdystream from 0.5.0 to
    0.5.1 (#16291)
    * chore(deps): bump kumahq/kuma-gui to
    f99142bbeab86ff9cd464db4be02eb76198320db (#16259)
    * chore(deps): bump kumactl install demo|observability images
    (#16244)
    * chore(deps): bump golang.org/x/exp from 7ab1446 to 746e56f
    (#16237)
    * chore(deps): bump opentelemetry-go-contrib monorepo from 0.67.0
    to 0.68.0 (#16255)
    * chore(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0
    (#16254)
    * chore(deps): bump envoy from 1.37.1 to 1.37.2 (#16262)
    * chore(deps): bump github.com/testcontainers/testcontainers-go
    from 0.41.0 to 0.42.0 (#16250)
    * chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0
    (#16253)
    * chore(deps): bump debian:13.4 from 55a15a1 to 3352c2e (#16235)
    * chore(deps/dev): bump go from 1.26.1 to 1.26.2 (#16247)
    * chore(deps): bump kumahq/kuma-gui to
    2c87cb7da7c7ab57c044dc83b8aa438d28d1e584 (#16211)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.14.4 to
    1.14.5 (#16243)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    9d38bb4 to 6f92a3b (#16238)
    * chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
    (#16240)
    * chore(deps): bump marocchino/sticky-pull-request-comment from
    3.0.3 to 3.0.4 (#16245)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    450ba7a to 487f66a (#16236)
    * chore(deps): bump
    gcr.io/k8s-staging-build-image/distroless-iptables from 0.9.0
    to 0.9.1 (#16241)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.14.4 to
    1.14.5 (#16242)
    * chore(deps): bump actions/create-github-app-token from 3.0.0 to
    3.1.1 (#16249)
    * chore(deps): bump peter-evans/create-pull-request from 8.1.0 to
    8.1.1 (#16246)
    * chore(deps/dev): bump helm from 4.1.3 to 4.1.4 (#16248)
    * chore(deps): bump postgres:latest from a9abf42 to 52e6ffd
    (#16239)
    * chore(deps): bump actions/github-script from 8.0.0 to 9.0.0
    (#16257)
    * chore(deps/dev): bump npm:@redocly/cli from 2.25.4 to 2.26.0
    (#16256)
    * chore(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0
    (#16252)
    * chore(deps): bump helm.sh/helm/v4 from 4.1.3 to 4.1.4 (#16216)
    * chore(deps): bump kumahq/kuma-gui to
    2808fc3ad45716fa6a486e16b98267cd5f818318 (#16181)
    * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.88.1 to 1.97.3 (#16148)
    * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
    from 1.77.4 to 1.88.5 (#16147)
    * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.58.0
    to 1.65.0 (#16145)
    * chore(deps): bump kumahq/kuma-gui to
    39e776acb6254da28d97a70c41999fb965097b23 (#16125)
    * chore(deps): bump kumactl install demo|observability images
    (#16115)
    * chore(deps): bump registry.k8s.io/pause to ee6521f (#16110)
    * chore(deps): bump opentelemetry-go monorepo (#16121)
    * chore(deps/dev): bump actionlint from 1.7.11 to 1.7.12 (#16117)
    * chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0
    (#16120)
    * chore(deps): bump regclient/actions: from 7c7e6f0 to f07124f
    (#16114)
    * chore(deps): bump reviewdog/action-actionlint from 1.71.0 to
    1.72.0 (#16122)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    462ad14 to 450ba7a (#16111)
    * chore(deps): bump marocchino/sticky-pull-request-comment from
    3.0.2 to 3.0.3 (#16116)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from bce0ec7 to 6210f84 (#16118)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    d00831a to 9d38bb4 (#16112)
    * chore(deps): bump k8s.io/kube-openapi from 5883c5e to 16be699
    (#16113)
    * chore(deps/dev): bump buf from 1.66.1 to 1.67.0 (#16123)
    * chore(deps/dev): bump npm:@redocly/cli from 2.25.1 to 2.25.4
    (#16119)
    * chore(deps): bump kumahq/kuma-gui to
    d220980407b84e4d21f8555db5b229eeeb9623d2 (#16103)
    * chore(deps): bump kumahq/.github: from 30a74b0 to d266a51
    (#16100)
    * chore(deps): bump kumahq/kuma-gui to
    ad8ab1a80c71b6c6d31f17aae10de3b9c738b614 (#16079)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 6c9615a to bce0ec7 (#16037)
    * chore(deps): bump kumahq/kuma-gui to
    ff30c6993c8ddd7d794c5e47fb483f9c29212721 (#16045)
    * chore(deps): bump kumactl install demo|observability images
    (#16036)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    bd6c598 to 462ad14 (#16035)
    * chore(deps/dev): bump yq from 4.52.4 to 4.52.5 (#16039)
    * chore(deps/dev): bump skaffold from 2.18.1 to 2.18.2 (#16038)
    * chore(deps/dev): bump npm:@redocly/cli from 2.24.0 to 2.25.1
    (#16040)
    * chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1
    (#16031)
    * chore(deps): bump kumahq/kuma-gui to
    7a863ee88de7b59b5259a9f73dd697defae2a4f7 (#16026)
    * chore(deps): bump kumahq/.github: from cef9faf to 30a74b0
    (#16013)
    * chore(deps): bump sigs.k8s.io/gateway-api from 1.5.0 to 1.5.1
    (#15948)
    * chore(deps): bump kumahq/kuma-gui to
    5ecb52407568153b5bd68d2ac59b216117b6ce71 (#15992)
    * chore(deps): bump kumahq/kuma-gui to
    26ccc5ce20287bda6359cbde400d883cbb8adaec (#15971)
    * chore(deps): bump coredns to v1.14.2 (#15975)
    * chore(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.1
    (#15965)
    * chore(deps): bump kubernetes monorepo from 0.35.2 to 0.35.3
    (#15947)
    * chore(deps/dev): bump kube-linter from 0.8.1 to 0.8.3 (#15968)
    * chore(deps): bump jdx/mise-action from 4.0.0 to 4.0.1 (#15967)
    * chore(deps): bump golangci-lint from 2.11.3 to 2.11.4 (#15966)
    * chore(deps): bump regclient/actions: from 9f6c88d to 7c7e6f0
    (#15964)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.14.2 to
    1.14.4 (#15943)
    * chore(deps): bump kubectl from 1.35.2 to 1.35.3 (#15946)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 37c380b to 6c9615a (#15949)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.14.2 to
    1.14.4 (#15944)
    * chore(deps): bump github.com/containernetworking/plugins from
    1.9.0 to 1.9.1 (#15945)
    * chore(deps): bump redis: from 1c054d5 to 315270d (#15941)
    * chore(deps): bump k8s.io/utils from b8788ab to 28399d8 (#15939)
    * chore(deps): bump kindest/node from 1.31.14 to 1.35.1 (#15954)
    * chore(deps): bump k8s.io/kube-openapi from 5b3e3fd to 5883c5e
    (#15938)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    89d4405 to bd6c598 (#15936)
    * chore(deps/dev): bump skaffold from 2.18.0 to 2.18.1 (#15950)
    * chore(deps): bump debian from 13.3 to 13.4 (#15951)
    * chore(deps/dev): bump protoc from 34.0 to 34.1 (#15956)
    * chore(deps/dev): bump npm:@redocly/cli from 2.21.1 to 2.24.0
    (#15955)
    * chore(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0
    (#15952)
    * chore(deps): bump postgres:latest from 69e8582 to a9abf42
    (#15940)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    84a4fc4 to d00831a (#15937)
    * chore(deps): bump nick-fields/retry from 3.0.2 to 4.0.0
    (#15957)
    * chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1
    (#15953)
    * chore(deps): bump actions/cache from 5.0.3 to 5.0.4 (#15942)
    * chore(deps): bump sigs.k8s.io/gateway-api from 1.4.1 to 1.5.0
    (#15734)
    * chore(deps): bump github.com/envoyproxy/go-control-plane*
    (#15930)
    * chore(deps): bump kumahq/kuma-gui to
    acd661ce7b66d311fed347369860f7a12fa4f1ba (#15925)
    * chore(deps): bump kumahq/kuma-gui to
    080fabd4be1017ecf6a7532b0c20e876e3d2070c (#15886)
    * chore(deps): upgrade envoy from v1.37.0 to 1.37.1 (#15905)
    * chore(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#15904)
    * chore(deps): bump opentelemetry-go monorepo (#15893)
    * chore(deps): bump kumahq/kuma-gui to
    f0b1dc4325062fe5872587e840aa2ebc0ef1f555 (#15871)
    * chore(deps): security update (#15874)
    * chore(deps): bump kumahq/kuma-gui to
    a28d4f23848a961ee273e9d72f68ca4d89c35ebd (#15869)
    * chore(deps): bump helm from 4.1.1 to 4.1.3 (#15822)
    * chore(deps): bump opentelemetry-go monorepo (#15257)
    * chore(deps): bump kumahq/kuma-gui to
    414459278b0974be03f40a290238fc18504d93ad (#15842)
    * chore(deps): bump go.opentelemetry.io/proto/otlp from 1.9.0 to
    1.10.0 (#15827)
    * chore(deps): bump golangci-lint from 2.11.2 to 2.11.3 (#15820)
    * chore(deps): bump golang.org/x/exp from 3dfff04 to 7ab1446
    (#15814)
    * chore(deps/dev): bump npm:@redocly/cli from 2.20.4 to 2.21.1
    (#15831)
    * chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1
    (#15818)
    * chore(deps): bump github.com/testcontainers/testcontainers-go
    from 0.40.0 to 0.41.0 (#15826)
    * chore(deps): bump kumahq/kuma-gui to
    e34eb696942b0847822731a236405af5b179e2fd (#15810)
    * chore(deps): bump grafana/grafana from 12.4.0 to 12.4.1
    (#15821)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from ea483b9 to 37c380b (#15824)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    a57be14 to 84a4fc4 (#15815)
    * chore(deps): bump regclient/actions: from c1f0aeb to 9f6c88d
    (#15816)
    * chore(deps/dev): bump buf from 1.66.0 to 1.66.1 (#15823)
    * chore(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0
    (#15830)
    * chore(deps/dev): bump skaffold from 2.17.3 to 2.18.0 (#15832)
    * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#15833)
    * chore(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1
    (#15834)
    * chore(deps): bump jdx/mise-action from 3.6.3 to 4.0.0 (#15835)
    * chore(deps): bump marocchino/sticky-pull-request-comment from
    2.9.4 to 3.0.2 (#15836)
    * chore(deps/dev): bump kube-linter from 0.7.6 to 0.8.2 (#15331)
    * chore(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#15778)
    * chore(deps): bump kumahq/kuma-gui to
    7e4339976bbc68058ce5d89821ffb63e6657866c (#15804)
    * chore(deps): bump k8s.io/kube-openapi from a19766b to 5b3e3fd
    (#15764)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.14.1 to
    1.14.2 (#15767)
    * chore(deps): bump kumahq/kuma-gui to
    f6a2b1ca8e8986353233db97a56efcedbfed169f (#15792)
    * chore(deps/dev): bump go from 1.26.0 to 1.26.1 (#15773)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from e4c1c38 to ea483b9 (#15772)
    * chore(deps): bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
    (#15777)
    * chore(deps/dev): bump skaffold from 2.17.2 to 2.17.3 (#15775)
    * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to
    0.23.3 (#15771)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.14.1 to
    1.14.2 (#15766)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    51500d9 to 89d4405 (#15763)
    * chore(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0
    (#15779)
    * chore(deps): bump opentelemetry-go-contrib monorepo from 0.65.0
    to 0.67.0 (#15783)
    * chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0
    (#15781)
    * chore(deps): bump regclient/actions: from da9319d to c1f0aeb
    (#15765)
    * chore(deps): bump jdx/mise-action from 3.6.1 to 3.6.3 (#15770)
    * chore(deps): bump endersonmenezes/free-disk-space from 3.1.0 to
    3.2.2 (#15776)
    * chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6
    (#15768)
    * chore(deps): bump golangci-lint from 2.10.1 to 2.11.2 (#15780)
    * chore(deps/dev): bump npm:@redocly/cli from 2.20.2 to 2.20.4
    (#15774)
    * chore(deps): security update (#15788)
    * chore(deps): bump
    Kong/public-shared-actions/security-actions/scan-docker-image
    from 6.0.1 to 6.1.0 (#15782)
    * chore(deps): bump kumahq/kuma-gui to
    41874f3a787a8efd27fede9d6feb824be4d51afd (#15749)
    * chore(deps): bump kumahq/ci-tools from v1.4.4 to v1.4.5
    (#15754)
    * chore(deps): bump kumahq/kuma-gui to
    a346f129dcd5b19e33083a7a5ce573ca8920632c (#15747)
    * chore(deps): bump kumahq/kuma-gui to
    1ad97df01e4c3be26bb32729c54f1a4fbe5e14a4 (#15746)
    * chore(deps/dev): bump protoc-gen-validate from 1.3.0 to 1.3.3
    (#15669)
    * chore(deps/dev): bump npm:@redocly/cli from 2.20.0 to 2.20.2
    (#15744)
    * chore(deps): bump github.com/envoyproxy/protoc-gen-validate
    from 1.3.0 to 1.3.3 (#15664)
    * chore(deps/dev): bump protoc from 33.5 to 34.0 (#15738)
    * chore(deps): bump kumahq/kuma-gui to
    55bd4dc28422ed8272099d7fc740f3313d9961e5 (#15742)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 80d56e7 to e4c1c38 (#15668)
    * chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#15740)
    * chore(deps): bump kumahq/kuma-gui to
    a31919b87cf6dd6a9cae4590351f10c69d2d2065 (#15739)
    * chore(deps): bump debian:13.3 from 2c91e48 to 3615a74 (#15725)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    cd5119e to 51500d9 (#15726)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    2f722ef to a57be14 (#15727)
    * chore(deps): bump redis: from 5cb00b0 to 1c054d5 (#15729)
    * chore(deps): bump postgres:latest from b6b4d0b to 69e8582
    (#15728)
    * chore(deps): bump kubernetes packages from 0.35.1 to 0.35.2
    (#15731)
    * chore(deps/dev): bump
    oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen from 2.5.1 to
    2.6.0 (#15736)
    * chore(deps): bump GitHub Artifact Actions (#15737)
    * chore(deps/dev): bump npm:@redocly/cli from 2.19.1 to 2.20.0
    (#15732)
    * chore(deps): bump github.com/josephburnett/jd/v2 from 2.4.0 to
    2.5.0 (#15733)
    * chore(deps/dev): bump buf from 1.65.0 to 1.66.0 (#15735)
    * chore(deps): bump kubectl from 1.35.1 to 1.35.2 (#15730)
    * chore(deps): bump kumahq/kuma-gui to
    17fc659a5309d20e4dd29f04ccbbf068c4e2e380 (#15721)
    * chore(deps): bump github.com/gruntwork-io/terratest from 0.55.0
    to 0.56.0 (#15610)
    * chore(deps): bump kumahq/kuma-gui to
    d7d205a513f1029201e62d8183013ab82d858858 (#15707)
    * chore(deps): bump kumahq/kuma-gui to
    094d2d6695ef002b94134571fffec31f0a778367 (#15705)
    * chore(deps): bump kumactl install demo|observability images
    (#15666)
    * chore(deps): bump kumahq/kuma-gui to
    31f4376ac415afd6df94b803778bb87654ef30a8 (#15702)
    * chore(deps): bump golang.org/x/exp from 81e46e3 to 3dfff04
    (#15661)
    * chore(deps): bump golangci-lint from 2.9.0 to 2.10.1 (#15670)
    * chore(deps): bump regclient/actions: from 6c6b758 to da9319d
    (#15663)
    * chore(deps): bump kumahq/kuma-gui to
    4f08552a701e49edffc7a311ac5f200b80086f40 (#15658)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    4cfbd41 to 2f722ef (#15662)
    * chore(deps): bump reviewdog/action-actionlint from 1.70.0 to
    1.71.0 (#15671)
    * chore(deps): bump projectcalico/tigera-operator from 3.31.3 to
    3.31.4 (#15667)
    * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#15665)
    * chore(deps): bump kumahq/ci-tools from v1.4.3 to v1.4.4
    (#15686)
    * chore(deps): bump npm:@redocly/cli from 2.18.1 to 2.19.1
    (#15647)
    * chore(deps): bump kumahq/kuma-gui to
    3876096bcc4d956d16e5b7eb2ce1915d43b96ad2 (#15645)
    * chore(deps): bump kumahq/kuma-gui to
    2f3283caa15e9ae79d0194ba710f5cccff40499b (#15636)
    * chore(deps): security update (#15638)
    * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#15643)
    * chore(deps): bump kumahq/kuma-gui to
    d6fded5e7e501e3f09c4098dd78b994fa3ca96c9 (#15630)
    * chore(deps): bump
    gcr.io/k8s-staging-build-image/distroless-iptables from 0.8.8
    to 0.9.0 (#15633)
    * chore(deps): bump kumahq/kuma-gui to
    4baaf7c7344673f3279e783a249082a6787d244f (#15626)
    * chore(deps): bump kumahq/kuma-gui to
    503caf28ec13985ad4249b523577c49f13086952 (#15624)
    * chore(deps/dev): bump go from 1.25.7 to 1.26.0 (#15621)
    * chore(deps): bump kumahq/kuma-gui to
    4b4cabfa63ae68c8791bbcd0c54fb4692e18e697 (#15622)
    * chore(deps): bump golang.org/x/exp from 716be56 to 81e46e3
    (#15593)
    * chore(deps/dev): bump controller-tools/cmd/controller-gen from
    0.20.0 to 0.20.1 (#15607)
    * chore(deps): bump helm from 4.1.0 to 4.1.1 (#15600)
    * chore(deps/dev): bump skaffold from 2.17.1 to 2.17.2 (#15608)
    * chore(deps): bump
    gcr.io/distroless/base-nossl-debian12:debug-nonroot from
    b9a1ed9 to 6cca41b (#15589)
    * chore(deps): bump golang.org/x/tools from 0.41.0 to 0.42.0
    (#15613)
    * chore(deps): bump k8s.io/utils from 914a6e7 to b8788ab (#15595)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    546029d to 4cfbd41 (#15594)
    * chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug
    from 9e9eb25 to eacaa3a (#15588)
    * chore(deps/dev): bump npm:@redocly/cli from 2.16.0 to 2.18.1
    (#15617)
    * chore(deps): bump kumahq/kuma-gui to
    75f718cf53aaf08713acf31a3dccd5394714e65b (#15618)
    * chore(deps): bump kumahq/.github: from a7fab21 to cef9faf
    (#15582)
    * chore(deps): bump postgres:latest from 1090bc3 to b6b4d0b
    (#15596)
    * chore(deps): bump kubectl from 1.35.0 to 1.35.1 (#15601)
    * chore(deps): bump
    gcr.io/k8s-staging-build-image/distroless-iptables from 0.8.7
    to 0.8.8 (#15598)
    * chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#15599)
    * chore(deps): bump
    gcr.io/distroless/static-debian12:debug-nonroot from eb35063 to
    afead12 (#15590)
    * chore(deps): bump kumactl install demo|observability images
    (#15603)
    * chore(deps/dev): bump actionlint from 1.7.10 to 1.7.11 (#15605)
    * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1
    (#15615)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    d3d4d8e to cd5119e (#15592)
    * chore(deps): bump sigs.k8s.io/controller-tools from 0.20.0 to
    0.20.1 (#15604)
    * chore(deps/dev): bump yq from 4.52.2 to 4.52.4 (#15609)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 8ebd0ff to 80d56e7 (#15606)
    * chore(deps): bump kubernetes packages from 0.35.0 to 0.35.1
    (#15602)
    * chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0
    (#15611)
    * chore(deps): bump golangci-lint from 2.8.0 to 2.9.0 (#15614)
    * chore(deps): bump regclient/actions: from 148669f to 6c6b758
    (#15597)
    * chore(deps): bump kumahq/kuma-gui to
    5ad081ef001844f55cf8dcf5e8fec0dae10930f2 (#15536)
    * chore(deps/dev): bump grpc-go/protoc-gen-go-grpc from 1.6.0 to
    1.6.1 (#15558)
    * chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0
    (#15559)
    * chore(deps): bump postgres:latest from 5773fe7 to 1090bc3
    (#15554)
    * chore(deps/dev): bump buf from 1.64.0 to 1.65.0 (#15561)
    * chore(deps): bump opentelemetry-go-contrib monorepo from 0.64.0
    to 0.65.0 (#15560)
    * chore(deps): bump kumactl install demo|observability images
    (#15556)
    * chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2
    (#15555)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    ce8ad4c to 546029d (#15553)
    * chore(deps): bump github.com/cncf/xds/go from a486691 to
    dba9d58 (#15552)
    * chore(deps/dev): bump go from 1.25.6 to 1.25.7 (#15557)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    b7460c2 to d3d4d8e (#15551)
    * chore(deps): bump debian:13.3 from 5cf544f to 2c91e48 (#15550)
    * chore(deps): security update (#15546)
    * chore(deps): upgrade kumahq/ci-tools from v1.4.2 to v1.4.3
    (#15539)
    * chore(deps): bump kumahq/kuma-gui to
    04e4a449cfe6c0d28841b9b901b6b32fd0b8653f (#15533)
    * chore(deps): bump kumahq/kuma-gui to
    f1d27c85fe713f42ca34918f77e541a073b82fe4 (#15531)
    * chore(deps): bump kumahq/kuma-gui to
    d5f083ee6b77b8562ec29853f6e57f56d4722a08 (#15521)
    * chore(deps): bump kumahq/kuma-gui to
    2e770c5a3096b3fd33a47a9c4216352dc38e2d66 (#15514)
    * chore(deps): bump kumahq/kuma-gui to
    9184c5d56e4288d065c32a186907a873e0709ad0 (#15509)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    8e98ce8 to ce8ad4c (#15486)
    * chore(deps/dev): bump protoc from 33.4 to 33.5 (#15497)
    * chore(deps): bump ginkgo (#15494)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 82cc073 to 8ebd0ff (#15493)
    * chore(deps): bump reviewdog/action-actionlint from 1.69.1 to
    1.70.0 (#15496)
    * chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#15495)
    * chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to
    5.3.1 (#15490)
    * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to
    0.23.1 (#15492)
    * chore(deps): bump actions/cache from 5.0.2 to 5.0.3 (#15489)
    * chore(deps): bump k8s.io/kube-openapi from 4e65d59 to a19766b
    (#15487)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    ccc0f37 to b7460c2 (#15485)
    * chore(deps): bump github.com/onsi/gomega from 1.39.0 to 1.39.1
    (#15491)
    * chore(deps): bump kumactl install demo|observability images
    (#15488)
    * chore(deps/dev): bump yq from 4.50.1 to 4.52.2 (#15498)
    * chore(deps): upgrade coredns version from v1.13.1 to 1.14.1
    (#15483)
    * chore(deps): security update (#15480)
    * chore(deps): bump debian from 13.2 to 13.3 (#15393)
    * chore(deps): bump envoy from 1.36.4 to 1.37.0 (#15446)
    * chore(deps): bump kumahq/kuma-gui to
    643bfaedafc237aafd17f5c7e1e8d2f52b19c192 (#15459)
    * chore(deps): bump kumahq/kuma-gui to
    07b75bcd5dbbabc7f90e0f12c965c7916a6eb0ab (#15444)
    * chore(deps): bump postgres:latest from bfe50b2 to 5773fe7
    (#15384)
    * chore(deps/dev): bump buf from 1.63.0 to 1.64.0 (#15428)
    * chore(deps): bump kumahq/kuma-gui to
    17635fb4675d087e120a8e526b72bdd48385c10b (#15375)
    * chore(deps): bump
    gcr.io/k8s-staging-build-image/distroless-iptables from 0.8.6
    to 0.8.7 (#15421)
    * chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to
    0.23.0 (#15427)
    * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#15426)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from aebc15d to 82cc073 (#15425)
    * chore(deps): bump jdx/mise-action from 3.6.0 to 3.6.1 (#15424)
    * chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11
    (#15423)
    * chore(deps): bump github.com/miekg/dns from 1.1.70 to 1.1.72
    (#15422)
    * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#15420)
    * chore(deps): bump github.com/cncf/xds/go from ee656c7 to
    a486691 (#15419)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.14.0 to
    1.14.1 (#15387)
    * chore(deps): bump golang.org/x/exp from 944ab1f to 716be56
    (#15381)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    0a764e5 to 8e98ce8 (#15382)
    * chore(deps): bump kumactl install demo|observability images
    (#15383)
    * chore(deps): bump regclient/actions: from 109c465 to 148669f
    (#15385)
    * chore(deps): bump actions/cache from 5.0.1 to 5.0.2 (#15386)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.14.0 to
    1.14.1 (#15388)
    * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#15389)
    * chore(deps): bump helm from 4.0.4 to 4.1.0 (#15390)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 0c3a910 to aebc15d (#15391)
    * chore(deps/dev): bump go from 1.25.5 to 1.25.6 (#15392)
    * chore(deps): bump github.com/exaring/otelpgx from 0.9.4 to
    0.10.0 (#15394)
    * chore(deps): bump github.com/gruntwork-io/terratest from 0.54.0
    to 0.55.0 (#15395)
    * chore(deps): bump github.com/josephburnett/jd/v2 from 2.3.1 to
    2.4.0 (#15396)
    * chore(deps): bump golang.org/x/tools from 0.40.0 to 0.41.0
    (#15398)
    * chore(deps): bump jdx/mise-action from 3.5.1 to 3.6.0 (#15399)
    * chore(deps): bump kumahq/kuma-gui to
    bd08e50692ee7b3376b9d4026446d90345ff74f1 (#15374)
    * chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0
    (#15368)
    * chore(deps/dev): bump protoc from 33.2 to 33.4 (#15372)
    * chore(deps): bump github.com/onsi/gomega from 1.38.3 to 1.39.0
    (#15366)
    * chore(deps/dev): bump skaffold from 2.17.0 to 2.17.1 (#15365)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from adb6465 to 0c3a910 (#15364)
    * chore(deps): bump kumactl install demo|observability images
    (#15363)
    * chore(deps): bump github.com/prometheus/common from 0.67.4 to
    0.67.5 (#15362)
    * chore(deps): bump github.com/miekg/dns from 1.1.69 to 1.1.70
    (#15361)
    * chore(deps): bump regclient/actions: from 1b705e3 to 109c465
    (#15359)
    * chore(deps): bump k8s.io/utils from 718f0e5 to 914a6e7 (#15358)
    * chore(deps): bump
    gcr.io/k8s-staging-build-image/distroless-iptables:v0.8.6 from
    4e0a77d to 8366c73 (#15357)
    * chore(deps): bump
    gcr.io/distroless/static-debian12:debug-nonroot from 53ced32 to
    eb35063 (#15356)
    * chore(deps): bump
    gcr.io/distroless/base-nossl-debian12:debug-nonroot from
    ef70836 to b9a1ed9 (#15355)
    * chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug
    from 1321f45 to 9e9eb25 (#15354)
    * chore(deps): bump kubectl from 1.34.3 to 1.35.0 (#15371)
    * chore(deps): bump gonum.org/v1/gonum from 0.16.0 to 0.17.0
    (#15370)
    * chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0
    (#15367)
    * chore(deps): bump golangci-lint from 2.7.2 to 2.8.0 (#15369)
    * chore(deps): bump ginkgo from 2.27.3 to 2.27.5 (#15360)
    * chore(deps): bump sigs.k8s.io/controller-tools from 0.19.0 to
    0.20.0 (#15328)
    * chore(deps): bump kumahq/kuma-gui to
    ea998e6c7921e2562684164206eb2301b64d3900 (#15373)
    * chore(deps): bump kumahq/kuma-gui to
    9730c6f3706bb804b32eb877ca52a04583d39e6e (#15351)
    * chore(deps): bump kumahq/kuma-gui to
    3bd00a324d469cf3e1aec298c48c4bb871e37fc4 (#15349)
    * chore(deps): bump ghcr.io/spiffe/spire-agent from 1.13.3 to
    1.14.0 (#15286)
    * chore(deps): bump regclient/actions: from 73d0a55 to 1b705e3
    (#15343)
    * chore(deps/dev): bump controller-tools/cmd/controller-gen from
    0.19.0 to 0.20.0 (#15329)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    97cd9d5 to 0a764e5 (#15335)
    * chore(deps): bump kubernetes packages from 0.34.3 to 0.35.0
    (#15327)
    * chore(deps): bump github.com/josephburnett/jd/v2 from 2.3.0 to
    2.3.1 (#15336)
    * chore(deps/dev): bump kubectl from 1.34.3 to 1.35.0 (#15326)
    * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#15337)
    * chore(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0
    (#15338)
    * chore(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0
    (#15339)
    * chore(deps): bump debian:13.2 from 0d01188 to c71b05e (#15340)
    * chore(deps): bump kumactl install demo|observability images
    (#15342)
    * chore(deps/dev): bump actionlint from 1.7.9 to 1.7.10 (#15344)
    * chore(deps): bump kumahq/.github: from 717d2c4 to a7fab21
    (#15347)
    * chore(deps): bump postgres:latest from 38d5c9d to bfe50b2
    (#15341)
    * chore(deps/dev): bump buf from 1.61.0 to 1.63.0 (#15345)
    * chore(deps): bump kumahq/kuma-gui to
    e60fe3fe6781be4ee928cf22c6f448bb930c4dcb (#15346)
    * chore(deps/dev): bump controller-runtime/tools/setup-envtest
    from 607e772 to adb6465 (#15324)
    * chore(deps/dev): bump container-structure-test from 1.22.0 to
    1.22.1 (#15323)
    * chore(deps): bump projectcalico/tigera-operator from 3.31.2 to
    3.31.3 (#15322)
    * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#15321)
    * chore(deps): bump regclient/actions: from 3bf6918 to 73d0a55
    (#15320)
    * chore(deps): bump kumactl install demo|observability images
    (#15319)
    * chore(deps): bump k8s.io/utils from bc988d5 to 718f0e5 (#15318)
    * chore(deps): bump kumahq/kuma-gui to
    dc2b501c22a6d0d5cbaa73b0f35777849388f833 (#15313)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    9c4e99b to ccc0f37 (#15316)
    * chore(deps): bump golang.org/x/exp from 8475f28 to 944ab1f
    (#15317)
    * chore(deps/dev): bump kind from 0.30.0 to 0.31.0 (#15330)
    * chore(deps): bump kumahq/kuma-gui to
    8091d9adbde195aefcff4427179c59ee2fe69ffa (#15312)
    * chore(deps): bump kumahq/kuma-gui to
    bc578f9169c0804febab9bf476942d48930cbc31 (#15311)
    * chore(deps): bump kumahq/kuma-gui to
    f0fb258910711dfba36c9fe3b8647a69095c0e0e (#15263)
    * chore(deps): bump ci-tools/release-tool from 1.4.1 to 1.4.2
    (#15332)
    * chore(deps): bump ci-tools/release-tool from 1.4.0 to 1.4.1
    (#15315)
    * chore(deps): bump ci-tools/release-tool from 1.3.1 to 1.4.0
    (#15314)
    * chore(deps): bump kumahq/kuma-gui to
    1847a769eab6295a2a710929ccdc0b26643b67e3 (#15310)
    * chore(deps): bump kumahq/kuma-gui to
    de10208ce61b47a6a5db5cb6ab2d675056f2417c (#15306)
    * chore(deps): bump github.com/cncf/xds/go from 8bfbf64 to
    ee656c7 (#15273)
    * chore(deps/dev): bump yq from 4.49.2 to 4.50.1 (#15289)
    * chore(deps/dev): bump protobuf-go/protoc-gen-go from 1.36.10 to
    1.36.11 (#15284)
    * chore(deps): bump kumahq/kuma-gui to
    a97f64cda3b51067c699afa345a0a4504ee68743 (#15305)
    * chore(deps): bump ginkgo from 2.27.2 to 2.27.3 (#15276)
    * chore(deps): bump google.golang.org/genproto/googleapis/* from
    ff82c1b to 97cd9d5 (#15274)
    * chore(deps): bump google.golang.org/protobuf from 1.36.10 to
    1.36.11 (#15281)
    * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#15292)
    * chore(deps): bump kumactl install demo|observability images
    (#15283)
    * chore(deps): bump github.com/onsi/gomega from 1.38.2 to 1.38.3
    (#15279)
    * chore(deps): bump github.com/exaring/otelpgx from 0.9.3 to
    0.9.4 (#15277)
    * chore(deps): bump github.com/miekg/dns from 1.1.68 to 1.1.69
    (#15278)
    * chore(deps): bump kumahq/kuma-gui to
    a596526e45ac18efbf8e99c3cad42bff285aa2e8 (#15264)
    * chore(deps): bump GitHub Artifact Actions (#15291)
    * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#15290)
    * chore(deps): bump endersonmenezes/free-disk-space from 3.0.0 to
    3.1.0 (#15285)
    * chore(deps): bump helm from 4.0.2 to 4.0.4 (#15282)
    * chore(deps): bump regclient/actions: from 1ea6cfd to 3bf6918
    (#15275)
    * chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from
    5413786 to 9c4e99b (#15272)
    * chore(deps): bump debian:13.2 from 8f6a88f to 0d01188 (#15271)
    * chore(deps): bump ghcr.io/spiffe/spire-server from 1.13.3 to
    1.14.0 (#15287)
    * chore(deps): bump github/codeql-action from 4.31.5 to 4.31.6
    (#15280)
    * chore(deps): bump dependencies (#15270)

++++ postgresql18:

  - Require clang/llvm-devel metapackages instead of directly
    requiring the latest version. With clang migrating away from
    update-alternatives, the versioned packages no longer provide the
    /usr/bin/clang symlink, which will now be contained in the
    metapackage only. If older LLVM versions are required, the
    compiler binary has to be provided via CLANG=clang-<N>.

++++ liblouis:

  - Update to version 3.38.0:
    + This release is highlighted by a new Norwegian grade 3
    contraction table, the result of Lars Bjørndal's work
    implementing the revised Braille Authority rules. The Swedish
    tables have been thoroughly renewed and now also cover
    Sami and Elfdalian. Malayalam has been updated to comply
    with the new Bharati Braille 2026 rules. Several security
    vulnerabilities were fixed, and the documentation was improved.

++++ udisks2:

  - Update to 2.11.1:
    + This is a bugfix release, fixing ATA USB device detection
    regression, leaking systemd inhibitors and missing polkit
    checks (CVE-2026-26103, CVE-2026-26104).
    + Changes:
  - lvm2: Prevent a segfault on discarded probe output
  - udiskslinuxdevice: Fix ATA USB detection
  - udiskslinuxnvmecontroller: Fix sanitize job start
  - udiskslinuxpartition: Fix missing job completion in
    handle_set_name
  - udiskslinuxpartitiontable: Fix missing job completion on
    overlapping partition error
  - udiskslinuxmanagernvme: Fix UINT64 variant handling in
    fabrics extra options
  - udiskslinuxblock: Add missing polkit check for
    RestoreEncryptedHeader()
  - udiskslinuxencrypted: Add missing polkit check for
    HeaderBackup()
  - docs: Update links to documentation on storaged.org
  - udiskslinuxmdraid: Fix getting bitmap location on latest
    kernels
  - udisksobjectinfo: Fix compiler warning with C23
  - tests: Do not mount the loop device for SetAutoclear test
  - Drop patches fixed upstream:
    + 0001-udiskslinuxencrypted-Add-missing-polkit-check-for-He.patch
    + 0001-udiskslinuxblock-Add-missing-polkit-check-for-Restor.patch

++++ neovim:

  - Update to version 0.12.3:
    + diagnostic: deprecate `format` as a table
    + :restart: v:starttime, v:exitreason
    + eval: treat Lua string as "blob" in writefile()
    + treesitter: provide select()
    + vim.pos: accept buf=0 for current buf
    + vim.pos: pos:to_offset(), pos.offset()
    + `opts.scope` in `vim.ui.input`
    + vim.pos: use numeric index internally
    + e230ff0 vim._with may silence all cmdline-errors
    + api: adjust Visual position after nvim_buf_set_text
    + api: don't update 'title' when renaming non-curbuf
    + api: `LuaRef` leak in `nvim_set_keymap` on LHS too long (>=66 bytes)
    + api: leak `preview` callback `LuaRef` in `nvim_create_user_command`
    + channel: stack-buffer-overflow with exit during connection
    + ci: generate more data to stress output throttling test
    + difftool: handle filenames containing spaces
    + eval: writestring() handling of null
    + excmd: use realtime for v:starttime, :uptime
    + fold: virtual lines duplicate foldopen
    + health: set 'tags' for help filetype
    + help: fix CTRL character issue for :help {subject}
    + lsp: calc correct screen_width when opts.relative == 'editor'
    + lsp: callHierarchy/outgoingCalls ranges are relative to caller, not callee
    + lsp: check window is still valid after async request
    + lsp: dynamic registration for off-spec method
    + lsp: filter code_action diagnostics to the cursor
    + lsp: handle null id in JSON-RPC responses
    + lsp: handle self-mapped methods in supports_method
    + lsp: malformed edit if apply_text_edits() is called twice
    + lsp: show meaningful error on invalid completion response
    + lsp: util.lua attempt to concatenate userdata
    + lua: avoid `__index` when deciding if a table is a list
    + lua: don't strip debuginfo in precompile module
    + lua: fields of `nvim.spellfile.Opts` are optional
    + marks: don't use spell decorations from other lines
    + marks: read from the correct variable in conceal_lines mark collection
    + messages: avoid recursive rtp build due to msg_show
    + messages: reset redirection message column after :echon
    + mouse: mouse=n should not adjust visual selection
    + net: `:edit <uri>` should set buftype=nofile
    + pack: only use tags that strictly comply with semver spec
    + path: `nvim_get_runtime_file` fails on DOS 8.3 filename
    + prompt: handle multi-element lists in prompt_appendbuf
    + shada: bdelete'd buffers not stored in oldfiles
    + shada: set correct buffer number for local marks on read
    + shell: preserve CR when `:!` outputs to binary-mode buffer
    + startup: emitting useless OptionSet
    + statusline: no cmdline ruler for autocommand window
    + terminal: memory leak in pending TermRequest StringBuilder
    + terminal: memory leak when pasting '=' register
    + test: only test for unibilium if a valid compilation string exists
    + treesitter: crash in ts_parser_delete after gc
    + treesitter: get_node_text() inconsistent trailing newline
    + trust: hash unchanged empty buffers as empty files
    + ui2: entering the pager fails if `<ESC>` is remapped to `:fclose`
    + ui2: error E518 when typing "vim:" in cmdline
    + unittest: preprocess failure when __typeof declarations present
    + vim.fs: fs.dir() may return nil "type" on some filesystems
    + vim.hl: range(0,…) highlight not cleared after buffer-switch
    + vim.range: empty ranges semantics vs regular ranges
    + vim.range: validate arguments on all cases
    + vim.secure: read() command injection vulnerability

++++ opentofu:

  - Update to version 1.12.2:
    * SECURITY ADVISORIES:
  - Previous releases in the v1.12 series could be affected by
    several vulnerabilities:
  - If for state encryption, OpenBao key provider is used with
    wrapping algorithms, it could generate panics or hangs on
    compromised systems where the JWE is specifically crafted.
    This is fixed now by (#4177)
  - Previous releases in the v1.12 series could be affected by
    several vulnerabilities:
  - When using SSH connections through OpenTofu, the errors
    that were returned from attempting a connection could
    include unescaped input bytes.
  - If using an attacker-controlled server to run tofu against,
    it might end up in high CPU consumption.
    These are now fixed by (#4247)
    * BUG FIXES:
  - Properly handle EDEADLK during provider installation. On Unix
    systems, the kernel may erroneously detect a deadlock between
    tofu processes using the global plugin cache. (#4166)
  - Fix race condition while handling closing signals during tofu
    login, both when the signal is sent by the user and when the
    browser fails to successfully connect. (4016)
  - Prevent panic when using ephemeral resources during tofu
    test`. (#4254)
    * Dependencies
  - [Govulncheck][v1.12] Upgrade go version 1.26.4 (#4247)
  - [GO-2026-4945][main] Bump go-jose to the latest patched
    version (#4203)

++++ postgresql14:

  - Require clang/llvm-devel metapackages instead of directly
    requiring the latest version. With clang migrating away from
    update-alternatives, the versioned packages no longer provide the
    /usr/bin/clang symlink, which will now be contained in the
    metapackage only. If older LLVM versions are required, the
    compiler binary has to be provided via CLANG=clang-<N>.

++++ postgresql15:

  - Require clang/llvm-devel metapackages instead of directly
    requiring the latest version. With clang migrating away from
    update-alternatives, the versioned packages no longer provide the
    /usr/bin/clang symlink, which will now be contained in the
    metapackage only. If older LLVM versions are required, the
    compiler binary has to be provided via CLANG=clang-<N>.

++++ postgresql16:

  - Require clang/llvm-devel metapackages instead of directly
    requiring the latest version. With clang migrating away from
    update-alternatives, the versioned packages no longer provide the
    /usr/bin/clang symlink, which will now be contained in the
    metapackage only. If older LLVM versions are required, the
    compiler binary has to be provided via CLANG=clang-<N>.

++++ postgresql17:

  - Require clang/llvm-devel metapackages instead of directly
    requiring the latest version. With clang migrating away from
    update-alternatives, the versioned packages no longer provide the
    /usr/bin/clang symlink, which will now be contained in the
    metapackage only. If older LLVM versions are required, the
    compiler binary has to be provided via CLANG=clang-<N>.

++++ postgresql18-mini:

  - Require clang/llvm-devel metapackages instead of directly
    requiring the latest version. With clang migrating away from
    update-alternatives, the versioned packages no longer provide the
    /usr/bin/clang symlink, which will now be contained in the
    metapackage only. If older LLVM versions are required, the
    compiler binary has to be provided via CLANG=clang-<N>.

++++ rocksndiamonds:

  - Update to version 4.4.2.1
    * fixed animation of BD style rocket.
    * fixed animation when collecting BD style clock.
    * fixed animation when releasing BD diamond from wall with BD
    jackhammer.
    * changed pause button to behave like pause key for tape recorder

++++ rumdl:

  - Update to version 0.2.16:
    * Added
  - config: expand environment variables in extends paths
    (ee98810)
  - Update to version 0.2.15:
    * Fixed
  - md038: keep whitespace-only code spans verbatim (afe5b43)

++++ sqlmap:

  - update to 1.10.6:
    * Fix WebSocket request traffic logging

++++ telegram-desktop:

  - Updated td to git20260613.
    * No changes provides.
  - Updated telegram-desktop to 6.9.3
    * https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.3

++++ tsctp:

  - Update to version 0.8.6
    * Bugfix: return error if socket creation fails.
    * Improved CMakeLists.txt.
    * Improved manpage.

++++ uwsm:

  - Update to version 0.26.5:
    * fix(app): fall back to local file if exists on invalid entry ID, fixes #214
    * fix(app): split explicitly by ".desktop:", abs path for SourcePath value

++++ wine:

  - updated to 11.11 release
  - Bundled SymCrypt library, to replace TomCrypt.
  - More USER32 window information moved to shared memory.
  - Layered windows in the Wayland driver.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.11 release

++++ wine-staging:

  - updated to 11.11 release
  - Bundled SymCrypt library, to replace TomCrypt.
  - More USER32 window information moved to shared memory.
  - Layered windows in the Wayland driver.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.11 release

++++ wine-staging-wow64:

  - updated to 11.11 release
  - Bundled SymCrypt library, to replace TomCrypt.
  - More USER32 window information moved to shared memory.
  - Layered windows in the Wayland driver.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.11 release

++++ wine-wow64:

  - updated to 11.11 release
  - Bundled SymCrypt library, to replace TomCrypt.
  - More USER32 window information moved to shared memory.
  - Layered windows in the Wayland driver.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.11 release

------------------------------------------------------------------
------------------  2026-6-12  -  Jun 12 2026  -------------------
------------------------------------------------------------------

++++ GraphicsMagick:

  - fixed off by one [bsc#1265048]
  - modified patches
    * GraphicsMagick-CVE-2026-42050.patch

++++ PrusaSlicer:

  - Update to version 2.9.5
    * Configurable toolchange ordering
    * SLA Updates
    * See https://github.com/prusa3d/PrusaSlicer/releases/tag/version_2.9.5
  - Added PrusaSlicer-2.9.5-pr15462-catch-include.patch

++++ wpewebkit:

  - Update to version 2.52.4:
    + Add support for half-width fonts.
    + Add initial pointer shape support to the WPE Qt API bindings.
    + Improve content filter compilation by avoiding file copies.
    + Improve handling of out of disk space conditions when the
    NetworkProcess tried to write data in caches.
    + Improve how the CMake build system checks whether libatomic is
    required.
    + Fix wheel input event handling in the WPE Qt API bindings for
    devices that do not report precise deltas.
    + Fix toplevel state handling in the WPE Qt API bindings.
    + Fix painting scrollbars when their width changes.
    + Fix cancellation of touch input events when touch devices are
    no longer available.
    + Fix playback of certain YouTube videos with low frame rates.
    + Fix webkit://gpu not working in systems where neither
    libGL.so.1 nor libOpenGL.so.0 are available.
    + Fix the build with librice 0.4 or newer when the GStreamer
    WebRTC backend is enabled at build configuration time.
    + Fix the build with USE_GBM=OFF.
    + Fix several crashes and rendering issues.

++++ agama:

  - The list of products only contains the products and modes
    descriptions for the current language
    (gh#agama-project/agama#3619).
  - Adapt storate schemas to allow configuring filesystem options
    (gh#agama-project/agama#3620).
  - Use the same format to display the result on "validate" and
    "validate --local" (gh#agama-project/agama#3616).
  - Reduce the validation attempts on "agama config load".
  - Print the status after running the "monitor", "config load",
    "config edit" and "install" commands (gh#agama-project/agama#3615).
  - Add to `agama monitor` ability to answer questions
    (gh#agama-project/agama#3606)
  - Implement the RFC9457 for error reporting (gh#agama-project/agama#3611).

++++ agama-web-ui:

  - Redesing storage forms (format disk, partition and logical
    volume) and migrate them to TanStack Form
    (gh#agama-project/agama#3610).

++++ agama-yast:

  - Extend storage model to allow configuring filesystem options
    (gh#agama-project/agama#3620).

++++ audacity:

  - Update to 3.7.8
    * #10688 Fixed an exception thrown when pasting into a newly-created
    track (Thanks, David Bailes (@DavidBailes)!)
    * #10870, #10884, #10775, #10629 Fixed tone generation, waveform-scale
    setting, SetClip Name parameter,
    * and clip-boundary command names for scripting and macros (Thank you,
    David Bailes (@DavidBailes)!)
    * #11106 Fixed the loading of presets for the Distortion effect (A
    million thanks, David Bailes (@DavidBailes)!)
    * #10947 Fixed paste into an empty audio track not preserving the
    source sample rate (Thanks, Juan Gabriel Colonna (@juancolonna)!)
    * #10776 Allowed AltGr modifier in label and clip name editing (Thanks,
    Davide Peressoni (@DPDmancul)!)
    * #9938 Added options to choose where silence is truncated (start/middle/end)
    (Thanks, Noah Rosenfield (@nosenfield)!)
    * #9935 Added Podcast 2.0 chapters JSON export for label tracks (Thanks,
    Noah Rosenfield (@nosenfield)!)
    * #10103 Improve UI on HiDPI displays on Linux/wxGTK (Thanks,
    Ivan A. Melnikov (@iv-m)!)
    * #10099 Fixed MixerBoard Mute and Solo button display (Thanks,
    Ivan A. Melnikov (@iv-m)!)
    * #10681 Fixed multichannel FLAC import
    * #10999 Fixed envelope being broken after joining clips

++++ aurorae6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Refresh decoration geometry when maximized state changes without resizing

++++ bcc:

  - Backport upstream patch clang-Add-microsoft-extensions-build-flags
    (gh#iovisor/bcc#5488)
    * add 0001-clang-Add-microsoft-extensions-build-flags.patch

++++ bluedevil6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ breeze6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Fix crash in WindowManager::registerQuickItem (kde#491000)
    * BreezeStyle: Fix ViewItemDecoration/Indicator adjustment on RTL style (kde#518835,kde#518837)
    * BreezeHelper: Use brush instead of color for renderFocusRect

++++ c-toxcore:

  - Update to version 0.2.23:
    * chore: Release v0.2.23
    * fix(DHT): refactor memory handling of loaded dht state Previous code could double-free if more than one dht states per tox-file and a following allocation fails.
    * chore: Release v0.2.23-rc.2
    * docs: remove todo about checksum which was resolved in 06ccdb5b91eb2f2dfc444da60db76476a9882fa8 (over 12 years ago)
    * docs: restore old comment lost in 55621e9ceaeb1585f3b69feb65e0e1ebf8836de7
    * fix(gca): announce max sizes where 32bytes too large
    * fix(onion): Size GCA announce response buffer to actual content length.
    * cleanup: Add a Tox_Pass_Salt type for the pass-key salt.
    * fix: limit number of saved group peers when loading from disk And add unpack_gc_saved_peers bounds test.
    * docs: Document fixed-size buffer parameters in toxencryptsave.
    * fix: wrong comment in group code
    * test: Fix CI build and test failures.
    * chore: Release v0.2.23-rc.1
    * fix(dht): Suppress the warning about IPv6 nodes when IPv6 is turned off
    * chore(ci): The gold linker has been deprecated/removed. LTO should work fine by default on modern distros.
    * fix(test): fix mypy failure
    * docs: Add tool and service acknowledgment and sponsor lists
    * cleanup: Generalise byte-array logging functions.
    * chore: update apt repos before installing deps for sonar
    * chore: ci restyled
    * chore: update github actions actions/checkout -> v6 actions/github-script -> v8 actions/setup-python -> v6 actions/cache -> v5 actions/upload-artifact -> v6 actions/download-artifact -> v7
    * cleanup: Add nullability to more function params and return types.
    * cleanup: Remove redundant nullability annotations.
    * fix(av): Fix Use-After-Free when peer goes offline.
    * feat: Add `Tox_Iterate_Options` for granular control over `tox_iterate`.
    * feat: Add a function to get the list of valid group chat numbers.
    * test: Fix VideoTest failures via codec fallbacks and add better logging.
    * test: Improve simulation determinism and reliability.
    * cleanup: Use `std::size_t` in C++ to fix compilation errors.
  - Update to version 0.2.22:
    * chore: Release v0.2.22
    * chore: update bootstrap docker hash
    * test: Fix flakiness in group_moderation_test
    * chore: Update changelog removing past RCs.
    * cleanup: Ensure callbacks to `qsort` cast their params.
    * chore: Release v0.2.22-rc.1
    * chore: Update bootstrap daemon hash for release.
    * chore: Fix tokstyle CI check.
    * chore: Update bootstrap node sha256 hash.
    * chore: Happy new year 2026!

++++ rust1.92:

  - Re-add support for SLE-12-SP2
  - Move build stage to reduce check stage time consumption

++++ chirp:

  - Update to version 20260612:
    * Add test image for Bajeton BJ7800
    * Update RT-920 test image for FM,AM & HF memories
    * Add new model Bajeton BJ7800 as a sub-class of  RT-920

++++ chromium:

  - Chromium 149.0.7827.114 (boo#1268158):
    * CVE-2026-12007: Use after free  Core
    * CVE-2026-12008: Use after free  DigitalCredentials
    * CVE-2026-12009: Insufficient validation of untrusted input  Accessibility
    * CVE-2026-12010: Heap buffer overflow  GPU
    * CVE-2026-12011: Use after free  WebMIDI
    * CVE-2026-12012: Use after free  Network
    * CVE-2026-12013: Use after free  Media
    * CVE-2026-12014: Use after free  Cast
    * CVE-2026-12015: Use after free  Autofill
    * CVE-2026-12016: Insufficient validation of untrusted input  DevTools
    * CVE-2026-12017: Insufficient validation of untrusted input  Extensions
    * CVE-2026-12018: Inappropriate implementation  Mojo
    * CVE-2026-12019: Out of bounds write  Codecs
    * CVE-2026-12020: Use after free  Autofill
    * CVE-2026-12022: Race  Safe Browsing
    * CVE-2026-12023: Use after free  GPU
    * CVE-2026-12024: Insufficient policy enforcement  DevTools
    * CVE-2026-12025: Insufficient validation of untrusted input  Network
    * CVE-2026-12026: Out of bounds read  Video
    * CVE-2026-12027: Insufficient policy enforcement  Headless
    * CVE-2026-12028: Use after free  GPU
    * CVE-2026-12029: Use after free  Video
    * CVE-2026-12030: Heap buffer overflow  GPU
    * CVE-2026-12031: Inappropriate implementation  Views
    * CVE-2026-12032: Inappropriate implementation  Passwords
    * CVE-2026-12033: Out of bounds read  VideoCapture
    * CVE-2026-12034: Insufficient validation of untrusted input  Linux Toolkit Theming
    * CVE-2026-12035: Use after free  Views

++++ llvm:

  - Have clang-devel require clang to ensure the chains are correct
    (so consumers of clang-devel get /usr/bin/clang installed). Same
    for llvm-devel, lldb-devel.

++++ openblas_openmp:

  - Added compatlib packages (compatlibopenblas_serial0, compatlibopenblas_openmp0,
    compatlibopenblas_pthreads0) that provide update-alternatives support for
    backward compatibility (bsc#1268086) (bsc#1268086)
  - Compatlib packages are automatically installed via Supplements when upgrading
    from OpenBLAS >= 0.3.30 to maintain existing update-alternatives configurations
  - The main library packages no longer require update-alternatives, making them
    suitable for transactional systems. Users who need update-alternatives support
    can explicitly install the compatlib packages
  - Fixed pkgconfig and cmake symlinks to point directly to flavor-specific
    directories (e.g., /usr/lib64/openblas-openmp/) instead of through
    update-alternatives, ensuring consistent library resolution
  - Updated README.SUSE to document the new packaging structure and compatlib usage
  - Update to version 0.3.33
    general:
    * fixed incorrect cast in SBGEMM test case causing spurious failures
    * fixed invalid memory access in converted C CBLAS tests
    * made BIGNUMA setting automatic when cores exceed 256
    * imported recent Reference-LAPACK 3.13.0 updates including:
  - implemented LARF1F and ORM2R functions
  - changed loop order in GETC2 for better performance
  - added NaN checks for input matrix A in GEEV
  - fixed support for jobu/v in LAPACKE_GESVDQ_WORK
  - fixed workspace size calculation in TGSEN
  - optimized looping in LACPY/LASCL/LANTR with fat matrix and UPLO=L
    arm64:
    * worked around serious GCC15 miscompilation of DDOT kernel affecting most non-SVE targets
    * fixed accuracy issue in GEMV kernel for Neoverse V1 and SVE targets
    * fixed broken STRMM and SSYMM in DYNAMIC_ARCH builds on non-SME hardware
    * added optimized SHGEMM kernel for Neoverse N2
    * added autodetection of Cortex A75/A76 and Neoverse V3
    loongarch64:
    * fixed build failure from missing half-precision float type support
    * fixed long-standing bug in asserting 64bit capability in c_check helper
    x86_64:
    * added workaround for LLVM miscompilation of AVX512 GEMM kernels
    * fixed CMake compilation with NVIDIA HPC compiler
  - Update to version 0.3.32
    general:
    * fixed LAPACK GESV reimplementation to compute LU factorization even when NRHS is zero
    * improved error message when compile-time buffer allocation exceeded
    * fixed non-serialized access problem in parallelized SYRK by concurrent callers
    * fixed ABI mismatch in internal CDOT/ZDOT version used by C fallback LAPACK
    * improved f_check script for detecting Fortran compiler with embedded dashes in paths
    * fixed memory access issues in utests detected by Address Sanitizer
    * fixed Makefile errors when only subset of precision types selected
    * fixed OpenMP compiler option for Intel Ifx compiler
    arm64:
    * fixed potential miscompilation of SDOT/DDOT/DSDOT kernels
    * improved BGEMM and SBGEMM kernel performance for Neoverse V2
    * added optimized SSUM and DSUM kernels for Neoverse N1
    * added preliminary Neoverse V3 support as NEOVERSEV2
    * added cpu autodetection for Cortex A725 and X925
    * fixed compilation of GEMM kernels for VORTEXM4/ARMV9SME without multithreading
    loongarch64:
    * fixed POTRF returning wrong results on LA464 from incorrect parameter setting
    power:
    * fixed compilation problems from missing half-precision float support
    * fixed potential POWER10 DGEMV kernel miscompilation by limiting optimization level
    * fixed SCAL issue on PPCG4/PPC970 running Linux
    riscv64:
    * optimized CROT/ZROT kernel for vector length 128 in non-unit stride path
    * improved SBGEMM/SHGEMM and related type conversion helper functions
    * fixed probing for BFLOAT16 support in DYNAMIC_ARCH cpu detection
    x86_64:
    * fixed potential gcc 15.x miscompilation of AVX512 SGEMM kernel for small sizes
    * fixed SROT and DROT kernels for Haswell to have consistent FMA rounding
    * added automatic detection of Intel Arrow Lake H/U, Panther Lake, and Jasper Lake
    * added detection of Intel Emerald Rapids and upcoming models
    * updated cache size translation table in cpu model autodetection
    * improved cpu detection fallback to include Nehalem as non-AVX option
    * fixed Makefile build issue with clang and SkylakeX SGEMM kernel
  - Update to version 0.3.31
    general:
    * reverted matrix partitioning optimization from 0.3.30 that could cause race conditions in GEMM
    * added bfloat16 extensions BGEMM and BGEMV
    * added BLAS interface for GEMM_BATCH extensions
    * added GEMM_BATCH_STRIDED extensions and CBLAS interface
    * added basic infrastructure for half-precision float (FP16) format using SH prefix
    * reimplemented LAPACK SLAED3/DLAED3 using multithreading, improving SSYEVD/DSYEVD performance
    * limited memory allocation retries to avoid infinite hanging on low-memory systems
    * fixed thread lockup with python 3.9 or older and numpy
    * introduced problem size thresholds for multithreading in STRMV/DTRMV, CHER/ZHER functions, and SGER/DGER
    * improved autodetection of Fortran compiler
    * fixed INTERFACE64=1 option passing to flang-new compiler
    * fixed potential deadlock after fork() in multithreaded code
    * fixed CMake builds on FreeBSD and from Cygwin
    * fixed cross-compilation to RISCV targets via CMake
    * fixed installation of cblas.h when NO_CBLAS=0
    * fixed missing user-defined pre/postfixes on functions in lapack.h and lapacke.h
    arm64:
    * building BFLOAT16 kernels now enabled by default
    * improved overall GEMM, SYMM and HEMM performance on A64FX
    * improved SDOT/DDOT performance on A64FX
    * improved multithreading performance of SDOT/DDOT on A64FX via throttling table
    * improved SGER/DGER performance on A64FX and NEOVERSEV1
    * improved multithreading GEMM performance on A64FX and NEOVERSEV1
    * improved GEMV kernel for SVE-capable targets
    * improved multithreading SGEMM on NEOVERSEV1 and V2
    * added optimized SAXPY/DAXPY SVE kernels for A64FX and NEOVERSEV1
    * added optimized BGEMM and BGEMV kernels for NEOVERSEV1
    * added optimized BGEMM kernel for NEOVERSEN2
    * added support for NEOVERSEV2 cpu
    * added dedicated Apple M4 support as VORTEXM4
    * added optimized SGEMM/SSYMM/STRMM/SSYRK/SSYR2K for SME-capable targets
    * improved SNRM2 kernel precision
    * added cpu autodetection and compiler settings for Ampere One processors
    loongarch64:
    * fixed warnings and inaccuracies from incorrect register saving
    * fixed logical core enumeration on big NUMA servers
    * fixed building with LLVM and INTERFACE64=1 option
    power:
    * added initial POWER11 architecture support
    * improved DGEMM and DGEMV performance on POWER10
    * fixed default compiler flags to use "-O3" instead of unsafe "-Ofast"
    * fixed potential gcc15.1 miscompilation of DGEMV and assembly kernels
    * fixed compilation with recent flang versions
    riscv64:
    * added optimized SBGEMM kernels for ZVL128B and ZVL256B targets
    * added optimized SHGEMM kernels for ZVL128B and ZVL256B
    * added optimized SBGEMV and SHGEMV kernels
    * improved GEMV kernel performance for ZVL256B
    * improved CROT and ZROT kernel performance for ZVL128B and x280
    * improved RVV1.0 capability detection
    * improved matrix packing helper functions for ZVL128B and ZVL256B
    * improved OMATCOPY performance
    x86_64:
    * added cpu autodetection for Intel Lunar Lake (Core Ultra 200V)
    * changed all MIN and MAX assembly kernels to use unaligned operations
    zarch:
    * added support for building with CMake

++++ openblas_pthreads:

  - Added compatlib packages (compatlibopenblas_serial0, compatlibopenblas_openmp0,
    compatlibopenblas_pthreads0) that provide update-alternatives support for
    backward compatibility (bsc#1268086) (bsc#1268086)
  - Compatlib packages are automatically installed via Supplements when upgrading
    from OpenBLAS >= 0.3.30 to maintain existing update-alternatives configurations
  - The main library packages no longer require update-alternatives, making them
    suitable for transactional systems. Users who need update-alternatives support
    can explicitly install the compatlib packages
  - Fixed pkgconfig and cmake symlinks to point directly to flavor-specific
    directories (e.g., /usr/lib64/openblas-openmp/) instead of through
    update-alternatives, ensuring consistent library resolution
  - Updated README.SUSE to document the new packaging structure and compatlib usage
  - Update to version 0.3.33
    general:
    * fixed incorrect cast in SBGEMM test case causing spurious failures
    * fixed invalid memory access in converted C CBLAS tests
    * made BIGNUMA setting automatic when cores exceed 256
    * imported recent Reference-LAPACK 3.13.0 updates including:
  - implemented LARF1F and ORM2R functions
  - changed loop order in GETC2 for better performance
  - added NaN checks for input matrix A in GEEV
  - fixed support for jobu/v in LAPACKE_GESVDQ_WORK
  - fixed workspace size calculation in TGSEN
  - optimized looping in LACPY/LASCL/LANTR with fat matrix and UPLO=L
    arm64:
    * worked around serious GCC15 miscompilation of DDOT kernel affecting most non-SVE targets
    * fixed accuracy issue in GEMV kernel for Neoverse V1 and SVE targets
    * fixed broken STRMM and SSYMM in DYNAMIC_ARCH builds on non-SME hardware
    * added optimized SHGEMM kernel for Neoverse N2
    * added autodetection of Cortex A75/A76 and Neoverse V3
    loongarch64:
    * fixed build failure from missing half-precision float type support
    * fixed long-standing bug in asserting 64bit capability in c_check helper
    x86_64:
    * added workaround for LLVM miscompilation of AVX512 GEMM kernels
    * fixed CMake compilation with NVIDIA HPC compiler
  - Update to version 0.3.32
    general:
    * fixed LAPACK GESV reimplementation to compute LU factorization even when NRHS is zero
    * improved error message when compile-time buffer allocation exceeded
    * fixed non-serialized access problem in parallelized SYRK by concurrent callers
    * fixed ABI mismatch in internal CDOT/ZDOT version used by C fallback LAPACK
    * improved f_check script for detecting Fortran compiler with embedded dashes in paths
    * fixed memory access issues in utests detected by Address Sanitizer
    * fixed Makefile errors when only subset of precision types selected
    * fixed OpenMP compiler option for Intel Ifx compiler
    arm64:
    * fixed potential miscompilation of SDOT/DDOT/DSDOT kernels
    * improved BGEMM and SBGEMM kernel performance for Neoverse V2
    * added optimized SSUM and DSUM kernels for Neoverse N1
    * added preliminary Neoverse V3 support as NEOVERSEV2
    * added cpu autodetection for Cortex A725 and X925
    * fixed compilation of GEMM kernels for VORTEXM4/ARMV9SME without multithreading
    loongarch64:
    * fixed POTRF returning wrong results on LA464 from incorrect parameter setting
    power:
    * fixed compilation problems from missing half-precision float support
    * fixed potential POWER10 DGEMV kernel miscompilation by limiting optimization level
    * fixed SCAL issue on PPCG4/PPC970 running Linux
    riscv64:
    * optimized CROT/ZROT kernel for vector length 128 in non-unit stride path
    * improved SBGEMM/SHGEMM and related type conversion helper functions
    * fixed probing for BFLOAT16 support in DYNAMIC_ARCH cpu detection
    x86_64:
    * fixed potential gcc 15.x miscompilation of AVX512 SGEMM kernel for small sizes
    * fixed SROT and DROT kernels for Haswell to have consistent FMA rounding
    * added automatic detection of Intel Arrow Lake H/U, Panther Lake, and Jasper Lake
    * added detection of Intel Emerald Rapids and upcoming models
    * updated cache size translation table in cpu model autodetection
    * improved cpu detection fallback to include Nehalem as non-AVX option
    * fixed Makefile build issue with clang and SkylakeX SGEMM kernel
  - Update to version 0.3.31
    general:
    * reverted matrix partitioning optimization from 0.3.30 that could cause race conditions in GEMM
    * added bfloat16 extensions BGEMM and BGEMV
    * added BLAS interface for GEMM_BATCH extensions
    * added GEMM_BATCH_STRIDED extensions and CBLAS interface
    * added basic infrastructure for half-precision float (FP16) format using SH prefix
    * reimplemented LAPACK SLAED3/DLAED3 using multithreading, improving SSYEVD/DSYEVD performance
    * limited memory allocation retries to avoid infinite hanging on low-memory systems
    * fixed thread lockup with python 3.9 or older and numpy
    * introduced problem size thresholds for multithreading in STRMV/DTRMV, CHER/ZHER functions, and SGER/DGER
    * improved autodetection of Fortran compiler
    * fixed INTERFACE64=1 option passing to flang-new compiler
    * fixed potential deadlock after fork() in multithreaded code
    * fixed CMake builds on FreeBSD and from Cygwin
    * fixed cross-compilation to RISCV targets via CMake
    * fixed installation of cblas.h when NO_CBLAS=0
    * fixed missing user-defined pre/postfixes on functions in lapack.h and lapacke.h
    arm64:
    * building BFLOAT16 kernels now enabled by default
    * improved overall GEMM, SYMM and HEMM performance on A64FX
    * improved SDOT/DDOT performance on A64FX
    * improved multithreading performance of SDOT/DDOT on A64FX via throttling table
    * improved SGER/DGER performance on A64FX and NEOVERSEV1
    * improved multithreading GEMM performance on A64FX and NEOVERSEV1
    * improved GEMV kernel for SVE-capable targets
    * improved multithreading SGEMM on NEOVERSEV1 and V2
    * added optimized SAXPY/DAXPY SVE kernels for A64FX and NEOVERSEV1
    * added optimized BGEMM and BGEMV kernels for NEOVERSEV1
    * added optimized BGEMM kernel for NEOVERSEN2
    * added support for NEOVERSEV2 cpu
    * added dedicated Apple M4 support as VORTEXM4
    * added optimized SGEMM/SSYMM/STRMM/SSYRK/SSYR2K for SME-capable targets
    * improved SNRM2 kernel precision
    * added cpu autodetection and compiler settings for Ampere One processors
    loongarch64:
    * fixed warnings and inaccuracies from incorrect register saving
    * fixed logical core enumeration on big NUMA servers
    * fixed building with LLVM and INTERFACE64=1 option
    power:
    * added initial POWER11 architecture support
    * improved DGEMM and DGEMV performance on POWER10
    * fixed default compiler flags to use "-O3" instead of unsafe "-Ofast"
    * fixed potential gcc15.1 miscompilation of DGEMV and assembly kernels
    * fixed compilation with recent flang versions
    riscv64:
    * added optimized SBGEMM kernels for ZVL128B and ZVL256B targets
    * added optimized SHGEMM kernels for ZVL128B and ZVL256B
    * added optimized SBGEMV and SHGEMV kernels
    * improved GEMV kernel performance for ZVL256B
    * improved CROT and ZROT kernel performance for ZVL128B and x280
    * improved RVV1.0 capability detection
    * improved matrix packing helper functions for ZVL128B and ZVL256B
    * improved OMATCOPY performance
    x86_64:
    * added cpu autodetection for Intel Lunar Lake (Core Ultra 200V)
    * changed all MIN and MAX assembly kernels to use unaligned operations
    zarch:
    * added support for building with CMake

++++ openblas_serial:

  - Added compatlib packages (compatlibopenblas_serial0, compatlibopenblas_openmp0,
    compatlibopenblas_pthreads0) that provide update-alternatives support for
    backward compatibility (bsc#1268086) (bsc#1268086)
  - Compatlib packages are automatically installed via Supplements when upgrading
    from OpenBLAS >= 0.3.30 to maintain existing update-alternatives configurations
  - The main library packages no longer require update-alternatives, making them
    suitable for transactional systems. Users who need update-alternatives support
    can explicitly install the compatlib packages
  - Fixed pkgconfig and cmake symlinks to point directly to flavor-specific
    directories (e.g., /usr/lib64/openblas-openmp/) instead of through
    update-alternatives, ensuring consistent library resolution
  - Updated README.SUSE to document the new packaging structure and compatlib usage
  - Update to version 0.3.33
    general:
    * fixed incorrect cast in SBGEMM test case causing spurious failures
    * fixed invalid memory access in converted C CBLAS tests
    * made BIGNUMA setting automatic when cores exceed 256
    * imported recent Reference-LAPACK 3.13.0 updates including:
  - implemented LARF1F and ORM2R functions
  - changed loop order in GETC2 for better performance
  - added NaN checks for input matrix A in GEEV
  - fixed support for jobu/v in LAPACKE_GESVDQ_WORK
  - fixed workspace size calculation in TGSEN
  - optimized looping in LACPY/LASCL/LANTR with fat matrix and UPLO=L
    arm64:
    * worked around serious GCC15 miscompilation of DDOT kernel affecting most non-SVE targets
    * fixed accuracy issue in GEMV kernel for Neoverse V1 and SVE targets
    * fixed broken STRMM and SSYMM in DYNAMIC_ARCH builds on non-SME hardware
    * added optimized SHGEMM kernel for Neoverse N2
    * added autodetection of Cortex A75/A76 and Neoverse V3
    loongarch64:
    * fixed build failure from missing half-precision float type support
    * fixed long-standing bug in asserting 64bit capability in c_check helper
    x86_64:
    * added workaround for LLVM miscompilation of AVX512 GEMM kernels
    * fixed CMake compilation with NVIDIA HPC compiler
  - Update to version 0.3.32
    general:
    * fixed LAPACK GESV reimplementation to compute LU factorization even when NRHS is zero
    * improved error message when compile-time buffer allocation exceeded
    * fixed non-serialized access problem in parallelized SYRK by concurrent callers
    * fixed ABI mismatch in internal CDOT/ZDOT version used by C fallback LAPACK
    * improved f_check script for detecting Fortran compiler with embedded dashes in paths
    * fixed memory access issues in utests detected by Address Sanitizer
    * fixed Makefile errors when only subset of precision types selected
    * fixed OpenMP compiler option for Intel Ifx compiler
    arm64:
    * fixed potential miscompilation of SDOT/DDOT/DSDOT kernels
    * improved BGEMM and SBGEMM kernel performance for Neoverse V2
    * added optimized SSUM and DSUM kernels for Neoverse N1
    * added preliminary Neoverse V3 support as NEOVERSEV2
    * added cpu autodetection for Cortex A725 and X925
    * fixed compilation of GEMM kernels for VORTEXM4/ARMV9SME without multithreading
    loongarch64:
    * fixed POTRF returning wrong results on LA464 from incorrect parameter setting
    power:
    * fixed compilation problems from missing half-precision float support
    * fixed potential POWER10 DGEMV kernel miscompilation by limiting optimization level
    * fixed SCAL issue on PPCG4/PPC970 running Linux
    riscv64:
    * optimized CROT/ZROT kernel for vector length 128 in non-unit stride path
    * improved SBGEMM/SHGEMM and related type conversion helper functions
    * fixed probing for BFLOAT16 support in DYNAMIC_ARCH cpu detection
    x86_64:
    * fixed potential gcc 15.x miscompilation of AVX512 SGEMM kernel for small sizes
    * fixed SROT and DROT kernels for Haswell to have consistent FMA rounding
    * added automatic detection of Intel Arrow Lake H/U, Panther Lake, and Jasper Lake
    * added detection of Intel Emerald Rapids and upcoming models
    * updated cache size translation table in cpu model autodetection
    * improved cpu detection fallback to include Nehalem as non-AVX option
    * fixed Makefile build issue with clang and SkylakeX SGEMM kernel
  - Update to version 0.3.31
    general:
    * reverted matrix partitioning optimization from 0.3.30 that could cause race conditions in GEMM
    * added bfloat16 extensions BGEMM and BGEMV
    * added BLAS interface for GEMM_BATCH extensions
    * added GEMM_BATCH_STRIDED extensions and CBLAS interface
    * added basic infrastructure for half-precision float (FP16) format using SH prefix
    * reimplemented LAPACK SLAED3/DLAED3 using multithreading, improving SSYEVD/DSYEVD performance
    * limited memory allocation retries to avoid infinite hanging on low-memory systems
    * fixed thread lockup with python 3.9 or older and numpy
    * introduced problem size thresholds for multithreading in STRMV/DTRMV, CHER/ZHER functions, and SGER/DGER
    * improved autodetection of Fortran compiler
    * fixed INTERFACE64=1 option passing to flang-new compiler
    * fixed potential deadlock after fork() in multithreaded code
    * fixed CMake builds on FreeBSD and from Cygwin
    * fixed cross-compilation to RISCV targets via CMake
    * fixed installation of cblas.h when NO_CBLAS=0
    * fixed missing user-defined pre/postfixes on functions in lapack.h and lapacke.h
    arm64:
    * building BFLOAT16 kernels now enabled by default
    * improved overall GEMM, SYMM and HEMM performance on A64FX
    * improved SDOT/DDOT performance on A64FX
    * improved multithreading performance of SDOT/DDOT on A64FX via throttling table
    * improved SGER/DGER performance on A64FX and NEOVERSEV1
    * improved multithreading GEMM performance on A64FX and NEOVERSEV1
    * improved GEMV kernel for SVE-capable targets
    * improved multithreading SGEMM on NEOVERSEV1 and V2
    * added optimized SAXPY/DAXPY SVE kernels for A64FX and NEOVERSEV1
    * added optimized BGEMM and BGEMV kernels for NEOVERSEV1
    * added optimized BGEMM kernel for NEOVERSEN2
    * added support for NEOVERSEV2 cpu
    * added dedicated Apple M4 support as VORTEXM4
    * added optimized SGEMM/SSYMM/STRMM/SSYRK/SSYR2K for SME-capable targets
    * improved SNRM2 kernel precision
    * added cpu autodetection and compiler settings for Ampere One processors
    loongarch64:
    * fixed warnings and inaccuracies from incorrect register saving
    * fixed logical core enumeration on big NUMA servers
    * fixed building with LLVM and INTERFACE64=1 option
    power:
    * added initial POWER11 architecture support
    * improved DGEMM and DGEMV performance on POWER10
    * fixed default compiler flags to use "-O3" instead of unsafe "-Ofast"
    * fixed potential gcc15.1 miscompilation of DGEMV and assembly kernels
    * fixed compilation with recent flang versions
    riscv64:
    * added optimized SBGEMM kernels for ZVL128B and ZVL256B targets
    * added optimized SHGEMM kernels for ZVL128B and ZVL256B
    * added optimized SBGEMV and SHGEMV kernels
    * improved GEMV kernel performance for ZVL256B
    * improved CROT and ZROT kernel performance for ZVL128B and x280
    * improved RVV1.0 capability detection
    * improved matrix packing helper functions for ZVL128B and ZVL256B
    * improved OMATCOPY performance
    x86_64:
    * added cpu autodetection for Intel Lunar Lake (Core Ultra 200V)
    * changed all MIN and MAX assembly kernels to use unaligned operations
    zarch:
    * added support for building with CMake

++++ gcc15:

  - Update to GCC 15.3 release

++++ cross-aarch64-gcc15:

  - Update to GCC 15.3 release

++++ cross-aarch64-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-amdgcn-gcc15:

  - Update to GCC 15.3 release

++++ cross-arm-gcc15:

  - Update to GCC 15.3 release

++++ cross-arm-none-gcc15:

  - Update to GCC 15.3 release

++++ cross-arm-none-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-avr-gcc15:

  - Update to GCC 15.3 release

++++ cross-avr-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-bpf-gcc15:

  - Update to GCC 15.3 release

++++ cross-hppa-gcc15:

  - Update to GCC 15.3 release

++++ cross-hppa-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-loongarch64-gcc15:

  - Update to GCC 15.3 release

++++ cross-loongarch64-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-nvptx-gcc15:

  - Update to GCC 15.3 release

++++ cross-ppc64-gcc15:

  - Update to GCC 15.3 release

++++ cross-ppc64le-gcc15:

  - Update to GCC 15.3 release

++++ cross-ppc64le-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-pru-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-riscv64-elf-gcc15:

  - Update to GCC 15.3 release

++++ cross-riscv64-elf-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-riscv64-gcc15:

  - Update to GCC 15.3 release

++++ cross-riscv64-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-rx-gcc15:

  - Update to GCC 15.3 release

++++ cross-rx-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ cross-s390x-gcc15:

  - Update to GCC 15.3 release

++++ cross-s390x-gcc15-bootstrap:

  - Update to GCC 15.3 release

++++ crun:

  - Update to version 1.28:
    * NEWS: tag 1.28
    * Do not follow rootfs /dev symlinks (bsc#1268302, CVE-2026-47766)
    * krun: request enabling DHCP client
    * krun: check krun_add_net_unixstream dlsym
    * tests: add libzstd-devel to fuzzing Dockerfile
    * tests, system-blake3: drop libyajl-dev

++++ discover6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include
    * updates: Do not treat the initial state as "up-to-date"

++++ drkonqi6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ fast_float:

  - Update to release 8.2.9
    * Reject non-digit wide code units in uint8/uint16 integer
    fast path.

++++ filezilla:

  - Update to 3.70.6
    * New features:
  - SFTP: Added compatibility flag to Site Manager to ignore
    invalid bits in file attributes flags received from
    non-compliant servers
    * Bugfixes and minor changes:
  - SFTP: Updated to fzssh 1.3.0
  - Updated to libfilezilla 0.56.1
  - Removed autodetection of FTP server type governing the remote
    path syntax. Exotic server types now need to be set
    explicitly on the advanced page in the Site Manager

++++ flatpak-kcm6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - No code changes since 6.6.91

++++ fluidsynth:

  - Update to version 2.5.5
    * Fix a build issue on BigEndian architectures.
    * Adjust the log level for unimplemented OSAL functions in
    release builds (#1795).

++++ fractal:

  - Update to version 14:
    + Call rooms are identified with a camera icon in the sidebar and
    show a banner to warn that other users might not read messages
    in these rooms
    + Calls are rendered in the timeline and incoming calls trigger a
    notification. We still don’t support calls, but at least now you
    know when someone is calling and can open another client to
    answer
    + While we still support signing in via SSO, we have dropped
    support for identity providers, to simplify our code and a
    have a closer experience to signing in with OAuth 2.0
    + The sidebar room filter has been improved: Enter goes to first
    room result, and there’s an empty state when no results match
    the term
    + The performance of the room list has also been improved, it
    should be mostly noticeable for accounts that have joined a lot
    of rooms
    + Informative events (Unable to decrypt, server notices…) are now
    styled differently to reflect their special nature and
    differentiate them from regular text messages that anyone can
    send
    + Sending files & location is properly disabled while
    editing/replying, as it doesn’t work anyway
  - Remove the is_beta build option, as for some reason, the build
    system built the package in beta mode anyway (and we never used
    it to build beta tarballs
  - Update the minimum BuildRequires versions, as fractal targets now
    GNOME 50 (and add the glycin dependency)

++++ gap-4ti2interface:

  - Update to release 2026.05.01
    * Version bump only

++++ gap-alnuth:

  - Update to release 4.0.0
    * Added support for using OSCAR as external CAS (in addition to
    PARI/GP). By default, OSCAR support is automatically activated
    when Alnuth is loaded in GAP running inside OSCAR. In all other
    situations, PARI/GP remains the default.
    * Renamed `FactorsPolynomialPari` to `FactorsPolynomialAlnuth` to
    better reflect that it uses the active external CAS, not just
    PARI/GP (the old name is still supported as a synonym for now).
    * Replaced the old `AL_*` configuration globals by GAP's user
    preference system; the old variables are still used a fallback,
    but user preferences are preferred if set.

++++ gap-automgrp:

  - Update to release 1.3.3
    * Change how Projection is implemented, to avoid causing warnings
    in other packages that provide `Projection` methods if those
    packages get loaded after automgrp.

++++ gap-cap:

  - Update to release 2026.05.08
    * No changelog was provided

++++ gap-caratinterface:

  - Update to release 2.3.9
    * Skip over empty lines at the beginning of CARAT input files

++++ gap-cddinterface:

  - Update to release 2026.03.02
    * No changelog was provided

++++ gap-toolsforhomalg:

  - Update to release 2026.04.01
    * No changelog was provided

++++ gcc15-testresults:

  - Update to GCC 15.3 release

++++ ghc-req:

  - Update req to version 3.13.4 revision 10.
    Upstream has revised the Cabal build instructions on Hackage.

++++ golang-github-prometheus-alertmanager:

  - CVE-2026-39821: Fix validation bypass and privilege escalation by
    updating golang.org/x/net to version 0.55.0 (bsc#1266615)

++++ google-osconfig-agent:

  - Update to version 20260611.00
    * Add unit tests for policies/policies.go PART 5 (#998)
  - from version 20260610.00
    * Add unit tests for policies/policies.go PART 4 (#997)
  - from version 20260609.02
    * squash commits (#936)
  - from version 20260609.01
    * Add unit tests for policies/policies.go PART 3 (#996)
  - from version 20260609.00
    * Add unit tests for policies/policies.go PART 2 (#991)
  - from version 20260602.01
    * Align format of dates and timestamp collected across Windows packages (#973)
  - from version 20260602.00
    * Add unit tests for config/config,go (#979)
  - from version 20260528.00
    * Bump github.com/containerd/containerd (#990)
  - from version 20260521.00
    * Cover agentconfig functionality by unit tests (#925)
  - from version 20260520.04
    * Add unit tests for policies/googet.go (#961)
    * Bump github.com/go-git/go-git/v5 (#987)
  - from version 20260520.02
    * Add unit tests for policies/yum.go (#952)
    * Add unit tests for policies/apt.go PART 3 (#951)
  - from version 20260520.00
    * Add unit tests for policies/zypper.go (#953)
  - from version 20260519.00
    * Add unit tests for policies/policies.go PART 1 (#949)
  - from version 20260513.01
    * Bump github.com/go-git/go-git/v5 (#981), this also updates
    golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
  - from version 20260513.00
    * upgrade a few packages (#980)
  - from version 20260512.02
    * Add/improve unit tests for agentendpoint/exec_task.go (#933)
  - from version 20260512.01
    * Cover google_update.go by unit tests (#941)
  - from version 20260512.00
    * Change zone for arm64 builds because of stockout (#978)

++++ grub2:

  - Fix the potential crash when enabling hardware acceleration for
    libgcrypt
    * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch

++++ gstreamer:

  - Update to version 1.28.4:
    + Highlighted bugfixes:
  - Various security fixes and playback fixes
  - audioaggregator: fixes for conversion of in-progress buffers
    when input caps change
  - audioresample: more armv7 fixes
  - camerabin: Fix caps negotiation failure when starting video
    capture
  - Debug logging performance improvements
  - fmp4mux: Fix draining in chunk mode after partial GOPs were
    drained
  - gldownload: fix handling of directly imported dmabufs from
    glupload
  - matroskamux: Write ReferenceBlock for non-keyframe video in
    BlockGroups
  - rtp2: session: add "stats" property
  - rtspsrc2: handle parse errors with TCP interleaved more
    gracefully where the server just drops data
  - rtspsrc2: implement support for SRTP, authentication, HTTP
    tunnelling, keep alive, stream selection, TLS validation,
    latency configuration
  - st2038combiner: only forward video pad segment, fixing issues
    for cases where the ST2038 segment differs
  - Wavpack audio: Various channel and channel-mask related fixes
  - webrtc, sdp: set level in negotiated caps only if level
    asymmetry not allowed, fixing an H.264 negotiation regression
    with higher resolutions
  - androidmedia: add various new codec mime / profile mappings
    (WMV, VC1, AC3/EAC3/AC4, AAC, H265) and support decoding FLAC
  - d3d12decoder: Fix decoding on Qualcomm GPUs on ARM64 Windows
  - wasapi2src: fix hang when using loopback-target-pid
    (regression from 1.26)
  - cerbero: update to Rust 1.96, plus glib-networking OpenSSL
    backend fixes
  - Various bug fixes, build fixes, memory leak fixes, and other
    stability and reliability improvements
    + gstreamer:
  - bufferpool: avoid leaking partially preallocated buffers
  - caps: fix multiple caps leaks
  - datetime: Improve correctness of ISO-8601 string parsing
  - info: Don't use fwrite() on Windows for debug logging
  - info: Use stack allocation for messages smaller than 1kB
  - task: Fix racy tests by making unref deterministic
  - value: fix crash when converting NULL G_TYPE_VALUE_ARRAY to
    G_TYPE_STRING
  - registry: detect libgstreamer load from Android container
    and skip canonicalization
  - tests: Fix build with glib <= 2.67.2

++++ gstreamer-devtools:

  - Update to version 1.28.4:
    + Update Rust dependencies

++++ gstreamer-docs:

  - Update to version 1.28.4:
    + No changes, stable bump only

++++ gstreamer-editing-services:

  - Update to version 1.28.4:
    + meson: Fix libxml2 not building due to wrong option type

++++ python-gst:

  - Update to version 1.28.4:
    + No changes, stable bump only.
  - Update to version 1.28.3:
    + No changes, stable bump only.

++++ gstreamer-plugins-bad:

  - Update to version 1.28.4 (boo#1268394, boo#1268401,
    CVE-2026-52718, CVE-2026-52719):
    + ahcsrc: Register exposure-mode property for GstPhotography
    interface
    + amc: Don't try printing NULL caps
    + amcvideodec: Don't keep crop-rectangle uninitialized if not
    specified
    + androidmedia: Add various new codec mime / profile mappings
    + androidmedia: Don't print error logs if downstream returns
    flushing / EOS
    + androidmedia: Fix typo in error message
    + androidmedia: support decoding flac
    + av1parser: Fix bytes/bits confusion when parsing tile data size
    + camerabin: Fix caps negotiation when starting video capture
    + d3d12decoder: Fix decoding on Qualcomm GPUs
    + mpegtspacketizer: Do not seek before the first PCR
    + mxfdemux: Use unsigned integers in more places and don't
    truncate 64 bit integers
    + svtav1enc: Scale MDCV and CLL to SVT-AV1's expected units
    + va: drm: Fix fd leak and return type in create_va_display
    + vajpegdecoder: Validate that enough data is available for the
    current JPEG segment
    + vulkanupload: Don't reallocate the pool when the framerate
    changes
    + wasapi2: Don't reset process loopback capture client
    + wasapi2src hangs when using loopback-target-pid in
    GStreamer 1.28 (regression from 1.26)
    + tests: Fix build with glib <= 2.67.2
    + meson: fix building -bad tests with disabled mse

++++ gstreamer-plugins-base:

  - Update to version 1.28.4:
    + audio-resampler-neon: fix accumulated stride
    + audio-resampler-neon: re-increment address
    + audioaggregator: Remove brittle conversion of in-progress
    buffers
    + discoverer: Lock the DISCO_LOCK whenever accessing the streams
    list
    + gl: egl: Set TRANSFER_NEED_DOWNLOAD flag
    + gldownload: Can't handle directly imported dmabufs from
    glupload
    + glupload: fix memleak on failure path
    + glwindow: Allow setting a NULL window handle
    + id3v2: Don't modify const data and check for enough data when
    reading RVA2 tags
    + id3v2: Don't unnecessarily assert on size==0 when unsyncing
    data
    + pbutils: Add NULL check for tmpcaps parsing
    + pbutils: Fix possible null dereference when empty string is
    provided
    + rtcpbuffer: Add some missing bounds checks when parsing SDES
    + sdp: keep level-asymmetry-allowed in the caps
    + subparse: Avoid zero and extreme fps when parsing mdvdsub
    subtitles
    + uridecodebin3: Use PLAY_ITEMS_LOCK for URI-related getter
    + uridecodebin: Protect missing_plugin_errors list from
    concurrent access
    + videodmabufpool: Fix debug category
    + xmptag: Correctly initialize pointer to the end of the input
    array

++++ gstreamer-plugins-good:

  - Update to version 1.28.4:
    + matroska-mux: Write ReferenceBlock for non-keyframe video in
    BlockGroups
    + osxaudio: Fix stack overflow with >64ch audio devices
    + qtdemux: parse mastering luminance as u32 instead of u16
    + qt6: remove an unneeded QOpenGLContext->makeCurrent()
    + rtph265depay: fix memory leak
    + sbcparse: Add bounds checking to header parsing
    + tests: mpegaudioparse: Fix raciness in the state change
    handling
    + v4l2: Fix buffer leak on qbuf failure
    + wavpack: Various channel / channel-mask related fixes
    + wavpackdec: Avoid integer overflow when calculating output
    buffer size and related fixes
    + wavpackenc fails for channels > 2

++++ gstreamer-plugins-libav:

  - Update to version 1.28.4:
    + avdemux: Always free AVIOContext and open failure and don't
    dereference NULL AVFormatContext
    + avprotocol: Don't free GstFFMpegPipe when closing the
    AVIOContext
  - Update to version 1.28.3:
    + No changes, stable bump only

++++ gstreamer-plugins-rs:

  - Update to version 1.28.4:
    + fmp4mux: Fix draining in chunk mode after partial GOPs were
    drained
    + Rtp2Session: add ParamSpec for property stats
    + rtspsrc2: Add support for SET_PARAMETER and GET_PARAMETER
    using signals
    + rtspsrc2: Add support for SRTP
    + rtspsrc2: Add TLS support
    + rtspsrc2: handle parse errors with tcp interleaved rtsp
    more gracefully
    + rtspsrc2: Implement authentication support
    + rtspsrc2: Implement support for HTTP tunnelling
    + rtspsrc2: Implement support for keep alive
    + rtspsrc2: Implement support for streams
    + rtspsrc2: Include user-agent property in HTTP tunnel requests
    + rtspsrc2: Support TLS validation flags for server certificate
    + rtspsrc2: Support latency configuration property
    + rtspsrc2: Update README with implemented features
    + st2038combiner: only forward video pad segment
    + webrtc: set level in negotiated caps only if level asymmetry
    not allowed
    + webrtcsink: handle payloader timestamp-offset prop type
    variants
    + webrtcsrc, webrtcsink: Fix SDP renegotiation bugs
    + Added script to convert git sourced dependencies to crates.io
    packages
    + gst-plugin-version-helper: Relax version requirements and
    update to 0.8.4

++++ gstreamer-plugins-ugly:

  - Update to version 1.28.4:
    + realmedia: Fixes for various out-of-bounds reads
  - Update to version 1.28.3:
    + No changes, stable version bump only.

++++ gstreamer-rtsp-server:

  - Update to version 1.28.4:
    + RTSPMediaFactory: make create_pipeline virtual method
    introspectable
  - Update to version 1.28.3:
    + No changes, stable bump only

++++ breeze6-gtk:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ gtkmm3:

  - Update to version 3.24.11:
    + Gdk:
  - Pixbuf: Ignore deprecation of gdk_pixbuf_new_from_xpm_data()
  - Ignore deprecation of GdkPixbufAnimation and
    GdkPixbufAnimationIter. They are deprecated since gdk-pixbuf
    2.44.
    + Documentation:
  - Remove obsolete FSF (Free Software Foundation) address
  - Gtk::GestureSingle: Update class description
  - README.win32.md: Mention Visual Studio 2026
  - MSVC_NMake/info-msvc.mak, README.win32.md: Update build info
  - Gtk::GestureMultiPress: Improve the class description
    + Build:
  - NMake, gendef.cc: Filter out Avx2WmemEnabledWeakValue
  - Meson and NMake builds: Distinguish Visual Studio 2026 builds
    from Visual Studio 2022 builds
  - NMake Makefiles: Consolidate items and add flexibility
  - NMake Makefiles: Make build process more robust
  - Meson build: Don't require the 'dot' command to build the
    documentation
  - Fix build with build-deprecated-api=false.

++++ gtranslator:

  - Update to version 50.0+157:
    + Fix all type_styles with gobject-linter
    + meson: Run format
    + Include gdk.h instead of gdkkeysyms
    + Updated translations.

++++ hostapd:

  - bsc#1268083 - hostapd segmentation fault during fast restart cycles.
    [+ nl80211_NULL_pointer_check_for_link.patch]

++++ icinga-php-thirdparty:

  - Update to 0.15.3
  - No changelog from upstream.

++++ kactivitymanagerd6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Activities: Jump to next activity if it's the current before removing one (kde#521124)

++++ kde-cli-tools6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Force file extensions to be LtR (kde#518909)

++++ kde-gtk-config6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ kdecoration6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ kdeplasma6-addons:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Ensure that color picker applet is not bigger than its container (kde#517052)
    * applets/weather: reset busy state when offline update is queued (kde#517280)
    * Webbrowser: Use rtl symbolic icons if needed (kde#518935)
    * Fix comic applet button icons in RtL (kde#518932)
    * Fix removing items from a grouping applet (kde#517043)

++++ kf6-oxygen-icons:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0

++++ kgamma6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ kglobalacceld6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ kinfocenter6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ kitty:

  - Update to 0.47.3:
    * macOS: Show a key symbol on the active tab if the macOS Secure Input
    feature is enabled
    * Fix regression that broke unserialization of splits layout in previous
    release (#10124)
    * Fix `focus_follows_mouse switching` the active window when returning to a
    desktop/space, even though the mouse did not move. Now the window under a
    stationary cursor is left alone, while moving the mouse across windows
    still switches focus as before.
  - https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.focus_follows_mouse
    * Sanitise responses to color control escape codes to avoid command
    injection for shells that do not use the kitty keyboard protocol
    (CVE 2026-54057)
  - https://www.cve.org/CVERecord?id=CVE-2026-54057
    * choose fonts kitten: Fix a rare timing based race causing kitten to crash
    at startup (#10128)
    * Wayland: Fix mouse input getting broken when starting a tab drag and
    releasing the mouse button before the drag is actually registered (#10136)

++++ kmenuedit6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * treeview: don't create desktop file names with invalid characters

++++ knighttime6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ kpipewire6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * DMABufhandler: Use a private implementation (kde#520258)

++++ krdp6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * videostream: apply the node id even when there is no PipeWire fd
    * Set NoNewPrivileges on the krdpserver systemd service
    * Ignore non-text mimetypes (kde#520175)

++++ kscreen6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ kscreenlocker6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * settings: fix translation for shortcut "Session Management -> Lock Session" (kde#521293)

++++ ksshaskpass6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ libksysguard6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * processcore: Do not return unformatted data for formatted data in ProcessSensor
    * Fix precision for doubles passed as strings (kde#521041)

++++ ksystemstats6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ ktls-utils:

  - Update to version 1.4.0+5.gddea5b0:
    * tlshd/handshake: handle the UNKNOWN_PSK_IDENTITY alert
    * tlshd: fix keyring cert retrieval
    * tlshd: Add runtime check for ML-DSA support in gnutls
    * tlshd: Update the "Handshake timed out" warning

++++ kwayland-integration6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Drop FreeBSD CI

++++ kwayland6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ kwin6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Too many changes to list here
  - Add patch to fix cursor plane use with virtio-gpu (kde#520650):
    * 0001-core-drmdevice-correct-the-virtio-driver-name.patch

++++ kwin6-x11:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ layer-shell-qt6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ libkscreen6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma5support6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Replace declaration with include

++++ libplasma6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * AppletPopup: Don't assert on AppletPopup::updateSize() (kde#510477)
    * Update version for new release 6.7.0
    * plasma/packagestructure: don't require mainscript (kde#521247)
    * Close Applet deletion notification after one minute (kde#520890)
    * Ensure that grouping applet is visible after removing and restoring it (kde#517044)

++++ plasma6-activities:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-activities-stats:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ libcdata:

  - Update to release 20260612
    * Testsuite updates

++++ libcdatetime:

  - Update to release 20260612
    * Testsuite updates

++++ libcdirectory:

  - Update to release 20260612
    * Plug some memory leaks in the
    libcdirectory_directory_entry_get_name{,_wide} functions
    * Testsuite updates

++++ libcerror:

  - Update to release 20260612
    * Testsuite updates

++++ libcfile:

  - Update to release 20260612
    * Testsuite updates

++++ libclocale:

  - Update to release 20260612
    * Testsuite updates

++++ libcnotify:

  - Update to release 20260612
    * Testsuite updates

++++ libcpath:

  - Update to release 20260612
    * Testsuite updates

++++ libcsplit:

  - Update to release 20260612
    * Testsuite updates

++++ libcthreads:

  - Update to release 20260612
    * Testsuite updates

++++ libfilezilla:

  - Update to 0.56.1
    * Bugfixes and minor changes:
  - macOS: Fix fz::socket::connect() failing after bind()
  - Creation flag validation and normalization for fz::file

++++ mozilla-nss:

  - update to NSS 3.124
    * bmo#2032562 - Add test for PKCS7 digest array alignment.
    * bmo#2030093 - Add test for rejection of excessively large ASN.1
    SEQUENCE OF in quickder.
    * bmo#2030994 - Add test for CMS content size validation.
    * bmo#2030995 - Add regression tests for DSAU signature decoding.
    * bmo#2031030 - Add test for S/MIME profile lookup on temp certs.
    * bmo#2031343 - Test case for post-handshake auth and many certificate
    requests.
    * bmo#2019233 - Add test for intra-arena ASan redzones.
    * bmo#2033058 - update nss_status flags one at a time.
    * bmo#2029803 - add defensive info->len check in PK11_HPKE_SetupS and
    PK11_HPKE_SetupR.
    * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
    * bmo#2020596 - add runtime check on decoded resumption token session id.
    * bmo#2035882 - improve mach try error handling.
    * bmo#2030798 - clang format.
    * bmo#2030798 - add comprehensive SECItem and SECItemArray tests.
    * bmo#2033058 - add bugzilla_cf_status_nss.py script.
    * bmo#2033057 - regenerate some recent release notes.
    * bmo#2033057 - fix bug list output by release note and email scripts.
    * bmo#2031190 - test removal from trust domain email cache.
    * bmo#2033208 - fix "testing if key corruption is detected in attribute"
    failures with sqlite-3.53.0.
    * bmo#2035348 - build sqlite3 shell for Windows CI runners.
    * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI
    * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
    * bmo#2034258 - add CLAUDE.md and .mcp.json.
    * bmo#2034244 - add a mach try command.
    * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length
    * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes
    * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf
    * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache
    error path [@ nssToken_Destroy].
    * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading
    * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes
    * bmo#2030570 - use correct data for ID comparison in
    transfer_uri_certs_to_collection
    * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
    * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping
    ss->vrange.max.
    * bmo#2034157 - set previous-nss-release for abicheck.
    * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
    `ssl3_SendApplicationData`.
    * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock
    * bmo#2030985 - Remove CRMF from testing and manifests.
    * bmo#2026711 - Remove unused RSA blind signature implementation from freebl
  - add explicit sqlite3 BuildRequires to fix tests

++++ libfwevt:

  - Update to release 20260602
    * No changelog was provided

++++ libkrun:

  - Update to version 1.19.0:
    * Bump minor version to 1.19.0
    * libkrun: expose init-blob in krun_has_feature()
    * Makefile: support INIT_BLOB=0 to disable bundled init binary
    * libkrun: add "init-blob" cargo feature to gate bundled init binary
    * init_blob: align crate with the workspace
    * fs/macos: on readdir, refresh directory on rewind
    * tests/virtiofs-misc: add rename-overwrite fchmod subtest
    * fs/macos: preserve the inode a rename overwrites
    * init: loosen perms on /dev/kvm if it exists
    * virtio/fs: report actual bytes written in used ring len
    * tests/virtiofs-misc: add mid-iteration duplicate detection subtest
    * tests/virtiofs-misc: add DirStream cache coherence subtests
    * tests/virtiofs-misc: run subtests with catch_unwind
    * balloon: use MADV_FREE to reclaim memory on macOS
    * init/dhcp: only overwrite resolv.conf with DNS
    * virtio/net: fix ENAMETOOLONG on long gvproxy socket paths
    * init: replace dummy IP address
    * virtio/fs: inline do_lookup() into lookup()
    * CI: enable BLK=1 and install e2fsprogs in integration tests
    * tests: add root-disk-remount integration test
    * tests: add augmentfs integration test
    * virtio/fs: move EXIT_CODE ioctl to AugmentFs
    * virtio/fs: remove REMOVE_ROOT_DIR ioctl and allow_root_dir_delete
    * lib: rewrite krun_set_root_disk_remount to use NullFs
    * virtio/fs: add NullFs, a minimal empty-root FileSystem
    * libkrun.h: document that implicit resource creation will become opt-in
    * lib: add krun_get_default_init()
    * lib: add krun_fs_add_overlay_file(), krun_fs_add_overlay_dir() APIs
    * lib: add krun_disable_implicit_init()
    * virtio/fs: introduce generic AugmentFs overlay for files like init.krun
    * virtio/fs: introduce InodeAllocator for shared inode numbering
    * virtio/fs: extract init binary blob into its own crate
    * tests: add virtiofs-misc test for fallocate operations
    * tests: pass TestSetup to check() for host-side verification
    * tests: introduce pjdfstest POSIX filesystem conformance tests
    * Bump patch version to 1.18.1
    * devices/vsock: support multi-descriptor TX chains
    * rutabaga_gfx/cross_domain: fix audio glitches by dropping write lock
    * add musl cfg flag musl_v1_2_3 to enable statx
    * init: fix unescape_string() not advancing past escape characters
    * rutabaga_gfx/cross_domain: handle CMD_WRITE on Eventfd items
    * vsock/tsi_dgram: Make sendto_addr bind to correct socket adress structs
    * virtio/vsock: use device's peer_buf_alloc
    * Bump libspa to v0.9
    * init: Set up a dummy network interface with TSI
  - Patches removed:
    * devices-vsock-support-multi-descriptor-TX-chains.patch (included upstream)
    * fix-libspa-pipewire-1.4-opaque-builder.patch (no longer necessary)

++++ libkrunfw:

  - Update to 5.5.0
    * Rebase on a 6.12.91 kernel and sync main config files
    * config: add MQUEUE, BRIDGE, NETFILTER support
  - Update to 5.4.1
    * vsock: backport SIOCINQ support
  - Update to 5.4.0
    * config-libkrunfw_x86_64: Enable virtio-snd driver support
    * Enable CONFIG_DUMMY
    * libkrunfw: Add virtio-CAN driver support
    * config-libkrunfw: Enable virtio-input driver support
    * config: enable EROFS xattr and security support on x86_64
    * libkrunfw: Add virtio-rtc driver support
    * add Windows (WHP) cross-compilation support
    * Rebase on a 6.12.87 kernel
    * config: enable KVM in embedded kernel
  - Update to 5.3.0
    * Rebase to 6.12.76 and fix various vsock issues

++++ polkit:

  - remove memory limits in systemd service, this causes performance loss (bsc#1266994)
    0001-Revert-memory-limits-in-systemd-unit-to-mitigate-mem.patch

++++ sg3_utils:

  - Update to version 1.48+34.3c93ead5
  - sg_inq: --export output conformance for SCSI name string and ATA fields (github: PR #83)
    (bsc#1267823, gh#doug-gilbert/sg3_utils#83)
  - Upstream fixes backported (bsc#1268201):
    * sg_logs: correct tape Device statisitics lpage [0x14] serial number parameters [0x40 and 0x41] per https://github.com/doug-gilbert/sg3_utils/issues/45
    * sg_wr_mode: fix --contents and --cfile= handling; https://github.com/doug-gilbert/sg3_utils/issues/40
    * rescan-scsi-bus.sh: github issue #76 a few shellcheck fixes; scsi_logging_level: add MIT license Xose Vazquez Perez; sg_ses: restore some help text, github PR #79 Paul Evans
    * sg_ses: re-add help description lost in v1.48 restructure
    * utils/hxascdmp: sprintf --> snprintf [From: orbisai0security <mediratta01.pally@gmail.com>]
    * rescan-scsi-bus.sh: fix broken command existence checks for dmsetup and multipath
    * rescan-scsi-bus.sh: quote $id_serial in findmultipath call
    * sg_copy_results: bound device-reported sense data length to buffer size
    * sg_xcopy: fix undefined behaviour and out-of-bounds read
    * sginfo: set MODE SENSE(10) response length to buffer size
    * sg_vpd_vendor: fix buffer overflows from device-controlled data
    * rescan-scsi-bus.sh: Immediately check removable in testonline()
    * rescan-scsi-bus.sh Replace 'which' with build in 'command -v'
    * rescan-scsi-bus.sh Correctly read RMB bit on enquiry
    * sg_ses: fixed AES EI validation when EIIOE=1
    * sg_logs: Fix parameter lengths in show_data_compression_page
    * configure.ac: Fix the getrandom() test
    * [PATCH 2/2] ci: Use the latest version of the Android NDK
    * [PATCH 1/2] Unbreak the Android build
    * sg_inq: fix indentation in std_inq_decode sgj_pr_hr strings (match main)

++++ snapper:

  - add dependencies to dbus in service files (see bsc#1265853)

++++ yelp:

  - Update to version 49.1+3:
    + build: Remove include of gdkkeysyms.h
    + Updated translations.

++++ liferea:

  - Update to version 1.16.11:
    + This is a security bugfix. Please urgently upgrade if you use
    Liferea with Reedah or TheOldReader sync!
    + If you use TinyTinyRSS sync please upgrade to fix a synching
    issue. Security Issue with Reedah + TheOldReader sync support.
    + Sadly there is a long-standing security bug causing unencrypted
    connections when fetching feed content for those two backends.
    When doing such requests via http:// your auth token got
    exposed and could allow malicious 3rd parties to manipulate
    your Reedah / TheOldReader accounts.
    + Note: the login request itself (including) your password was
    not affected, still I advise to upgrade to the newest Liferea
    release 1.16.11 or 2.0-RC3 verify your Reedah / TheOldReader
    subscriptions change your Reedah / TheOldReader password just
    to be safe.
    + Changes:
  - Fixes a long-standing security bug that caused unencrypted
    connection when fetching feed content from Reedah and
    TheOldReader. Please upgrade and change your Reedah /
    TheOldReader password afterwards!
  - Fixes: TinyTinyRSS not working anymore due to
    Content-Encoding header not indicating JSON
  - Fixes: replace outdated feedburner URL in default feed list
    OPML

++++ matomo:

  - Update to 5.11.1
  - #24626 Update CNIL retention period requirement to 759 days.

++++ matrix-synapse:

  - Fix patching of shebang lines and the service file to use the
    proper versioned python binary instead of python3
  - disable poetry mode on 16.x

++++ melange:

  - Update to version 0.53.1:
    * fix(qemu): skip empty QEMU_NET_CIDR instead of erroring (#2568)

++++ milou6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ mistral-vibe:

  - Update to 2.15.0:
  - Added
  - **[Experimental]** `before_tool` and `after_tool` hooks:
    shell scripts declared in `hooks.toml` that fire around
    every tool call; hooks can deny the call, rewrite tool
    inputs, or append context to the output — enable with
    `enable_experimental_hooks = true`
  - Message queue: messages typed while the agent or a `!bash`
    command is running are queued and shown above the input;
    Esc pauses the queue, Ctrl+C drops the last queued message
    (LIFO), Enter flushes the queue when paused
  - Tool result output is now collapsed by default to keep
    responses scannable
  - Common read-only shell commands (`ls`, `cat`, `pwd`, etc.)
    are allowed without approval by default
  - Session deletion available directly from the resume picker
  - `[mcp_servers.auth]` block in config for per-server MCP
    authentication
  - Collapsed web tool output now shows the URL and search
    query at a glance
  - `max_turns` support exposed over ACP via
    `set_config_option`
  - Changed
  - Compaction now re-injects prior user messages so the agent
    retains the original task goals across context resets
  - **[Breaking — experimental hooks]** `post_agent_turn`
    retries no longer use exit code `2`; hooks must now exit
    `0` and return `{"decision": "deny", "reason": "..."}` on
    stdout to trigger a retry — exit code `2` is treated as
    a failure
  - Model refusal stop reason is now surfaced to the user
    instead of stopping silently
  - Fixed
  - CLI UI no longer goes blank during app switches
  - User messages are preserved correctly across repeated
    compactions
  - Non-UTF-8 input is handled gracefully across all CLI
    surfaces
  - `--resume` now shows history when launched from a dangerous
    directory
  - Startup no longer crashes in unowned folders or when a git
    ancestor is unreadable
  - Plain-string answers from `web_search` are handled without
    crashing
  - NaN SGR mouse reports no longer leak into the chat input

++++ netbird:

  - Update to 0.72.4
  - [client] Index peer tunnel IPs for faster PeerStateByIP lookup
    by @mlsmaycon in #6412

++++ netty:

  - Upgrade to upstream version 4.1.135
    * Security fixes:
    + CVE-2026-48059, bsc#1268258: memory exhaustion in
    io.netty:netty-codec-haproxy
    + CVE-2026-47691, bsc#1268252: DNS cache poisoning in
    io.netty:netty-resolver-dns
    + CVE-2026-50560, bsc#1268262: DDoS in
    io.netty:netty-codec-http2
    + CVE-2026-50011, bsc#1268260: memory exhaustion in
    io.netty:netty-codec-redis
    + CVE-2026-44250, bsc#1268169: memory exhaustion in
    io.netty:netty-codec-redis
    + CVE-2026-44890, bsc#1268170: memory exhaustion in
    io.netty:netty-codec-redis
    + CVE-2026-44249, bsc#1268165: IPv6 subnet filter bypass in
    io.netty:netty-handler
    + CVE-2026-50020, bsc#1268261: request smuggling in
    io.netty:netty-codec-http
    + CVE-2026-44893, bsc#1268244: memory leak in
    io.netty:netty-codec-haproxy
    + CVE-2026-50010, bsc#1268259: TLS hostname verification
    accidentally disabled in io.netty:netty-handler
    + CVE-2026-45673, bsc#1268248: DNS cache poisoning in
    io.netty:netty-resolver-dns
    + CVE-2026-45416, bsc#1268246: excessive memory usage from
    SNIHandler in io.netty:netty-handler
    + CVE-2026-45536, bsc#1268247: file descriptor leak in
    io.netty:netty-transport-native-epoll and
    io.netty:netty-transport-native-kqueue
    + CVE-2026-45674, bsc#1268249: DNS cache poisoning in
    io.netty:netty-resolver-dns
    + CVE-2026-46340, bsc#1268250: memory exhaustion in
    io.netty:netty-transport-sctp
    + CVE-2026-47244, bsc#1268251: denial of service in
    io.netty:netty-codec-http2
    + CVE-2026-48006, bsc#1268255: memory exhaustion in
    io.netty:netty-codec-redis
    + CVE-2026-48043, bsc#1268257: memory exhaustion in
    io.netty:netty-codec-http2
    * Other significant changes:
    + MQTT: Allow MQTT 5 CONNECT with password only
    + ChannelInitializer: correct misleading comment on
    exceptionCaught route
    + HTTP/2: Parse request-target path like Vert.x (4.1 backport)
    + HttpObjectDecoder skips arbitrary initial control characters
    when only initial CRLF characters are permitted
    + IpSubnetFilter: Correctly handle ipv6
    + Configurable bound on RedisArrayAggregator
    + Redis: Limit decoded length
    + DNS: Ensure query id is not predictible
    + Wrapping plain trust manager silently disables hostname
    verification
    + MQTT: Reject malformed no-payload packets with non-zero
    Remaining Length
    + HAProxy: Reject HAProxyMessages with malformated TLV and not
    leak memory
    + SSL: Use sane defaults as limits for the client hello length
    and timeout
    + DNS: Only cache CNAME if part of the queried domain
    + HTTP/2: Enforce max concurrent streams for misbehaving clients
    + Dns: Insufficient Bailiwick Validation for NS Records
    + HTTP2: DelegatingDecompressorFrameListener must release memory
    in all cases
    + Pass maxAllocation to Brotli and Zstd decoders
    + HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
    + Add maxWindowLog parameter to ZstdDecoder to bound memory
    allocation
    + HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
    + Epoll / Kqueue: Correctly handle receive of FD
    + SCTP: Limit the number of inflight incomplete SCTP messages
    and the number of fragments
    + Redis: Correctly release incomplete message on removal when
    using RedisArrayAggregator
    + Redis: Limit the maximum number of nested arrays
    + HTTP: Re-add constructor to HttpProxyHandler that was removed
    by mistake
    + Marshalling: Explicit document security requirements
    + Pin HTTP/RTSP version + method normalization to Locale.US
    + Adaptive: Fix concurrency issue in adaptive allocator
    + Pin multipart Content-Type / Content-Transfer-Encoding case
    folding to Locale.US
    + Remove dead native declarations
    + Avoid re-parsing openssl key material with non-cached provider
    + IpFilter: Fix ClassCastException caused by IpSubnetFilter if
    only ipv6 rules are configured but remote peer is using ipv4
    + Resolve all localhost addresses without querying DNS servers
    + HTTP2: Use 100 as default max concurrent streams setting
    + Route synchronous onLookupComplete exceptions via
    fireExceptionCaught
    + Fix MQTT decoder size check after variable header replay
  - Modified patches:
    * 0001-Remove-optional-dep-Blockhound.patch
    * 0002-Remove-optional-dep-conscrypt.patch
    * 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
    * 0004-Disable-Brotli-and-ZStd-compression.patch
    + rediff

++++ netty-tcnative:

  - Upgrade to version 2.0.79 Fina
    * No formal changelog present

++++ ntpd-rs:

  - Update to version 1.9.0
    Added
    * Support for using openssl for cryptography, instead of
    aws-lc-sys and rust-crypto.
    Changed
    * Switched to IANA early-allocated codepoints for the KELB style
    NTS pool (experimental).
    * Updated dependencies.

++++ ocean-sound-theme6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ openSUSE-release-tools:

  - Update to version 20260612.e4dd77ac:
    * gocd: Fix pipeline name
    * Add FTBFS dashboard for openSUSE:Factory:Rebuild
  - Update to version 20260612.f6ea0660:
    * Implement pagination for Gitea API calls

++++ oxygen6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * kstyle: Work around bad looks of Dolphin's small statusbar
    * kdecoration: Fix missing windeco buttons (app menu & hide from screencast) (kde#384301)

++++ pam_kwallet6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ pascube:

  - Drop stale _scmsync.obsinfo: file comes from a request
    originating from a git managed source into a non-git-managed
    devel package.

++++ patterns-server:

  - Only require libvirt-daemon-qemu on supported architectures.

++++ pentobi:

  - Update to vesion 30.2
    * Fixed race condition in pentobi/help/ causing build failures.

++++ perl-Crypt-PBKDF2:

  - updated to 0.261630
    see /usr/share/doc/packages/perl-Crypt-PBKDF2/Changes
    Version 0.261630: 2026-06-11
    * Change the default hash algorithm to HMAC-SHA256, and increase the
    default number of iterations to 600,000, in line with current OWASP
    recommendations (CVE-2026-9641). bsc#1268234
    * Generate salts using Crypt::URandom (a strong system RNG) instead of
    perl's builtin `rand()`, which is not cryptographically secure
    (CVE-2026-9638). bsc#1268233
    * Use a constant-time comparison in `validate` to avoid timing attacks
    (CVE-2017-20240). bsc#1268232

++++ plasma-branding-Kalpa:

  - Version 20260612
    * Add cups.service.d drop-in to set SystemGroup in cups-files.conf,
    allowing wheel group members to administer CUPS

++++ plasma6-bigscreen:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Fix CI build
    * Fix licenses
    * Update version for new release 6.7.0
    * Add OnlyShowIn=KDE for .desktop files
    * Issue #39: Support Recent apps
    * Issue #39: Maximize app if already running
    * inputhandler: Properly attribute app id for xdg-remote-desktop-system
    * homescreen: Use smooth close animation when clicking out of home overlay
    * homescreen: Cleanup and simplify favorites manager
    * homescreen: Advertise org.kde.plasma.launchermenu
    * inputhandler: Fix CEC button event and add home action
    * kcms/input: Clarify states
    * kcms: Add input KCM
    * Add missing qqml.h include
    * cec: Ensure CECDestroy is called
    * Use libcec symbols directly
    * homescreen: Filter out blocklisted apps from recents model
    * bigscreenplugin: Don't load sounds if not enabled
  - Drop patches, now upstream:
    * 0001-Use-libcec-symbols-directly.patch

++++ plasma6-openSUSE:

  - Update to 6.7.0

++++ plasma6-browser-integration:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-desktop:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * applets/kicker: fix queued fast launching
    * Add missing KSharedConfig include
    * applets/kicker: set runner column currentIndex on becoming visible
    * CMake: Drop obsolete libxft feature info
    * applets/pager: Allow to build without X11-enabled KWindowSystem and PW
    * imports/activitymanager: Allow to build w/o X11-enabled KWindowSystem
    * ConfigureChecks.cmake: Cleanup unused Xrandr detection
    * Drop obsolete HAVE_XCURSOR
    * kcms: landingpage: Drop obsolete X11 link
    * applets/kickoff: don't use binding to center grid (kde#521068)
    * runners/keys: Don't show actions that are handled by other runners
    * applets/kicker: check activeFocus of list instead of column
    * applets/kicker: set margins for scrollview
    * Add missing qqml.h include
    * kcms/mouse: Fix incorrect divisor in pointer acceleration comparison
    * Add missing qqml.h include
    * applets/kicker: fix typo
    * applets/kicker: don't show icon on drag&drop placeholder
    * applets/kickoff: move highlight to delegate (kde#426015)
    * applets/taskmanager: fix move to current desktop for grouped tasks (kde#520777)
    * applets/kicker: fix placeholder
    * applets/kicker: use resultsPresent property
    * emojier: Fix i18n use (kde#520827)

++++ plasma6-disks:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ plasma6-firewall:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ plasma6-integration:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Message dialogs: Fix standard button codes for custom buttons
    * Fix wrong return code when exec'ing our implementation of QMessageDialog (kde#520747)

++++ plasma6-keyboard:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * fix: longpresstrigger: consistently use commit strings for printable characters
    * flatpak: Use libplasma from same branch
    * Add missing qqml.h include

++++ plasma6-mobile:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ plasma6-nano:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-nm:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Fix memory leaks
    * Mark Prison QML module as required
    * Add missing kirigami-addons dependency
    * Add smoke tests for KCMs
    * Enable LSAN in CI
    * ConnectionDetails: Make them work without a device
    * Add missing qqml.h include
    * Avoid use of references across a co_await (kde#519739)
    * Fix bridge disconnect icon and add OvsBridge support (kde#517384)
    * 802.1x: Allow "Not Required" for Private Key Passwords (kde#520449)

++++ plasma6-pa:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-print-manager:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * set selected: property on ItemDelegates's contentItem stuff
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ plasma6-sdk:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-workspace:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Too many changes to list here

++++ plasma6-systemmonitor:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Fix initial page from commandline

++++ plasma6-thunderbolt:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Add missing qqml.h include

++++ plasma6-vault:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-welcome:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plasma6-workspace-wallpapers:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ plymouth-theme-breeze6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ pnpm:

  - Update to 11.6.0:
    * pnpm install completes without re-resolving when pnpm-lock.
    yaml was deleted but node_modules is intact: the up-to-date
    check now treats the current lockfile (node_modules/.pnpm/lock.
    yaml) — the record of what the previous install materialized —
    as the wanted lockfile, verifies the manifests still match it,
    restores pnpm-lock.yaml from it, and reports "Already up to date".
    Previously this scenario triggered a full resolution and a re-
    verification of every locked package against the registry.
    * 615c669: Added support for configuring URL-scoped registry
    settings through npm_config_//… and pnpm_config_//…
    environment variables, for example:
    * Improved the warning printed when a project .npmrc uses an
    environment variable in a registry/proxy URL or in registry
    credentials. The message now explains why the setting was
    ignored and how to migrate it to a trusted source — for example
    by moving the line to the user-level ~/.npmrc or running pnpm
    config set "<key>" <value> — with a link to https://pnpm.io/npmrc.
    The pnpm config set example is only suggested when the key has
    no ${...} placeholder, so the snippet is always safe to copy-paste.
    * Print a "Lockfile passes supply-chain policies (verified 2h
    ago)" message when lockfile verification is skipped because a
    cached verdict for the same lockfile content and policy is reused.
    Previously the cached short-circuit was completely silent,
    which made it look like the policy gate never ran #12324.
    * Platform-specific optional dependencies are now skipped even
    when their os/cpu/libc fields are missing from the registry
    metadata or the lockfile. Some registries strip these fields
    from the package metadata, which made pnpm download and install
    the binaries of every platform regardless of
    supportedArchitectures. The missing platform fields of an
    optional dependency are now inferred from its name (e.g. @nx/nx-
    win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
    binaries are skipped without even downloading them #11702.

++++ polkit-kde-agent-6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ powerdevil6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include
    * core: Close battery notifications when percentage is higher again
    * core: Add helper function to cancel critical notification

++++ product-composer:

  - update to version 0.9.7
    * Support of unpack rpms to agama images
    * Support of removal of global build_options per flavor

++++ python-PyAudio:

  - Fix build error.

++++ python-PyJWT:

  - Update to 2.13.0
  - Security
    * CVE-2026-48526 (bsc#1266802) — JWK JSON accepted as HMAC secret
    (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM-
    and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw
    JSON string. In a verifier configured with both symmetric and asymmetric
    algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker
    could forge HS256 tokens using the JWK text as the HMAC secret. The guard
    has been extended to reject any JWK-shaped JSON.
    * CVE-2026-48523 (bsc#1266799) — Algorithm allow-list bypass with PyJWK /
    PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…]
    allow-list was checked against the token header alg as a string only;
    actual verification used the algorithm bound to the PyJWK. An attacker
    who controlled a registered JWKS key could sign with one algorithm and
    advertise another on the header. PyJWT now requires the token header alg
    to match the PyJWK's algorithm before verification.
    * CVE-2026-48525 (bsc#1266801) — DoS via base64 decode of unused payload
    segment when b64=false. For detached-payload JWS (b64=false), the
    compact-form payload segment was base64-decoded before being discarded in
    favor of the caller-supplied detached_payload. An attacker could inflate
    the unused segment to force CPU + memory cost without holding a valid
    signature. The segment is now required to be empty per RFC 7515
    Appendix F, and is no longer decoded.
    * CVE-2026-48522 (bsc#1266798) — PyJWKClient accepts non-HTTP(S) URIs.
    PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which
    by default also handles file://, ftp://, and data: schemes. An
    application that fed an attacker-influenced URI into PyJWKClient could be
    coerced into reading local files or reaching other unintended schemes.
    PyJWKClient now rejects any URI whose scheme isn't http or https.
    * CVE-2026-48524 (bsc#1266800) — PyJWKClient cache wiped on fetch error. A
    finally-block put(jwk_set=None) cleared the JWK Set cache whenever a
    fetch raised, turning a transient JWKS-endpoint outage into application-
    wide auth failure. The cache write was moved into the success path;
    transient errors no longer evict valid cached keys.
  - Fixed
    * Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with
    InvalidKeyError instead of accepting them with only a warning. Defends
    against the os.getenv("JWT_SECRET", "") footgun.
    * Forward per-call options (including enforce_minimum_key_length) from
    PyJWT.decode through to PyJWS._verify_signature. The option was
    previously silently dropped between the two layers, so it only took
    effect when set on the PyJWT instance.
    * RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to
    crit, and the decoder rejects tokens that set b64=false without listing
    it in crit
  - Changed
    * Migrate the dev, docs, and tests package extras to dependency groups

++++ python-pydash:

  - Update patch support-new-mypy.patch, once again with feeling.

++++ python-ruff:

  - update to 0.15.17
    * Preview features
    * Allow human-readable names in suppression comments
    * Fix handling of ignore comments within a disable/enable pair
    * Prioritize human-readable names in CLI output
    * Respect diagnostic start and parent ranges and trailing comments in ruff:ignore suppressions
    * [flake8-async] Add trio.as_safe_channel to safe decorators (ASYNC119)
    * [flake8-pytest-style] Also check pytest_asyncio fixtures
    * [ruff] Ban pytest autouse fixtures (RUF076)
    * [pyupgrade] Add from __future__ import annotations automatically (UP007, UP045)
    * Bug fixes
    * Fix diagnostic when ruff:enable or ruff:disable appears where ruff:ignore is expected
    * [pyupgrade] Preserve leading empty literals to avoid syntax errors (UP032)
    * Rule changes
    * [flake8-pytest-style] Clarify diagnostic message for single parameters (PT007)
    * [numpy] Drop autofix for np.in1d (NPY201)
    * [pylint] Exempt Python version comparisons (PLR2004)
    * Performance
    * Reserve AST Vecs with correct capacity for common cases
    * Formatter
    * Preserve whitespace for Quarto cell option comments
    * CLI
    * Allow rule names in ruff rule

++++ python-tornado6:

  - Update to 6.5.7:
    [#]# Security fixes
    * CurlAsyncHTTPClient now fully resets the curl object before reusing it.
    This prevents incorrectly reusing options from a previous request,
    specifically including client SSL and credentials used for accessing
    proxies.
    * SimpleAsyncHTTPClient now strips the Authorization and Cookie headers
    from the request when following a redirect to a different origin. This
    matches the default behavior of CurlAsyncHTTPClient. Applications that
    need different behavior here can set follow_redirects=False and handle
    redirects manually. CVE-2026-49853
    * SimpleAsyncHTTPClient now enforces max_body_size on the decompressed size
    of the response, rather than the compressed size. This prevents a
    denial-of-service attack via a very large compressed response.
    CVE-2026-49855
    * Fixed a bug in the C extension that could have read up to three bytes
    past the end of an input array. CVE-2026-49854
    * OpenIDMixin has improved parsing for the check_authentication response.
    [#]# Bug fixes
    * CurlAsyncHTTPClient has been updated to use non-deprecated APIs, avoiding
    deprecation warnings with recent versions of pycurl.
  - Refreshed patch ignore-resourcewarning-doctests.patch
  - Drop patch fix-tests-with-curl-8-19.patch, merged upstream.

++++ yt-dlp:

  - Update to version 2026.06.09
    * Fixed [CVE-2026-50019]: File Downloader cookie leak with curl
    * Fixed [CVE-2026-50023]: Dangerous file type creation via
    insufficient filename sanitization
    * Fixed [CVE-2026-50574]: Arbitrary code execution via manifest
    downloads with aria2c
    * Added lockfile and pinned extras
    * Removed url, desktop and webloc from safe extensions
    * Extract supplemental codecs from DASH manifests
    * abematv: Extract subtitles
    * ard: Support new ardsounds domain
    * monstercat: Support older URLs
    * pornhub: Support browser impersonation
    * reddit: Fix unauthenticated extraction
    * rtp: Support multi-part episodes and --no-playlist
    * s4c: Extract more metadata
    * soop: Adapt extractors to new domain
    * soundcloud: Support --extractor-retries for original formats
    * twitch: Remove dead rechat subtitles
    * twitter: Fix view_count extraction
    * external: aria2c: Remove support for m3u8/dash protocols
    * ffmpegmetadata: Avoid erroneous ISO 639 conversions

++++ qqc2-breeze-style6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ ruby-common:

  - Fix gem_packages template for the alts case. We were always using
    spec.name when it should have been the loop variable executable.

++++ rubygem-agama-yast:

  - Extend storage model to allow configuring filesystem options
    (gh#agama-project/agama#3620).

++++ sddm-kcm6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Add missing qqml.h include

++++ spectacle:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Don't automatically copy image to clipboard when performing OCR (kde#520758)

++++ systemsettings6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * Don't call activateWindow() from the constructor

++++ tryton:

  - Version 7.0.39 - Bugfix Release

++++ trytond:

  - Version 7.0.51 - Bugfix Release

++++ trytond_account:

  - Version 7.0.25 - Bugfix Release

++++ trytond_country:

  - Version 7.0.1 - Bugfix Release

++++ trytond_product:

  - Version 7.0.5 - Bugfix Release

++++ trytond_stock:

  - Version 7.0.19 - Bugfix Release

++++ trytond_stock_lot:

  - Version 7.0.6 - Bugfix Release

++++ union6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0
    * WordWrap: Fix enum parsing (kde#521210)
    * kirigami/Chip: Fix icon position, add Mnemonics, change color
    * popups: Add tooltip text color (kde#521024)
    * input/css/breeze: Match DialogButtonBox spacing to desktop style
    * input/css/breeze: Remove horizontal padding from checkbox/radio/switch (kde#520156)
    * output/quick: Use nearest filtering for Icon's texture (kde#520155)
    * text-wrap-mode: Use QTextOption enum (kde#520918,kde#520154)
    * WidgetStyle: Disable X-KDE-CustomElements (kde#520776)
    * Add themerc files
    * Don't install a .so link for internal libraries
  - Drop patches, now upstream:
    * 0001-Don-t-install-a-.so-link-for-internal-libraries.patch

++++ wacomtablet-kcm6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * Update version for new release 6.7.0

++++ xdg-desktop-portal-kde6:

  - Update to 6.7.0:
    * New bugfix release
    * For more details see https://kde.org/announcements/plasma/6/6.7.0
  - Changes since 6.6.91:
    * accessdialog: Fix body label
    * settings: Explicitely set delayed reply when sending errors
    * inputcapture: Send along id of barrier that activated the capture
    * Update version for new release 6.7.0
    * screencast: Always allow restoring full workspace (kde#519122)
    * remotedesktop: Show notification when app is pre-authorized
    * PortalDialog: Specify zero padding specifically
    * settings: Simplify implementation by returning result directly
    * RemoteDesktop: Fix signatures of touch methods
    * clipboard: Add missing version property

++++ zypper:

  - Transactional systems: Delegate rw-commands to
    transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
    On a transactional system where the root filesystem is mounted
    read-only, zypper commands that modify the system cannot be
    executed directly.
    If the system provides a transactional-wrapper utility, zypper
    will automatically attempt to invoke it. The wrapper
    transparently executes the zypper command within a new, writable
    snapshot and manages the lifecycle of that snapshot based on the
    command's exit status.
    On transactional systems lacking a transactional-wrapper, users
    must manually invoke specialized tools -such as
    transactional-update- to install, update, or remove software.
  - version 1.14.98

------------------------------------------------------------------
------------------  2026-6-11  -  Jun 11 2026  -------------------
------------------------------------------------------------------

++++ QMPlay2:

  - Change hard-dependency on deno to softer nodejs-based
    dependencies.
  - Adjust 0001-add-opensuse-customizations.patch to allow QMPlay2
    to use alternative javascript engines for yt-dlp

++++ Radicale:

  - Update to 3.7.4
    * Fix: sharing: PROPFIND returns now empty owner element in case of a mapped share as clients try PROPFIND on this not accessable href
    * Fix: WebUI hide copy button in insecure environments
    * Fix: sharing: bday conversion hrefs for vCard filenames ending in v/c/f
    * Improve: sharing: PROPFIND returns also privilege "write" in case "write-content" and "write-properties" is permitted
    * Improve: WebUI decode URL in text field for better readability
    * Extension: WebUI dark theme with automatic browser/OS color scheme detection
    * Add: [web] prefer_browser_login option
  - Update to 3.7.3
    * Fix: sharing: GET request on single item with bday conversion
    * Fix: sharing: PROPFIND response on single item with bday conversion
    * Fix: sharing: PROPFIND response related to C:supported-calendar-component-set
    * Fix: user/path validation related to 'unicode-letter'
    * Extension: expose RADICALE:version for authenticated users via PROPFIND
    * Feature: conditional log of request/response header/content by new options *_on_notice_condition

++++ agama-web-ui:

  - Standardize form Cancel actions across the application, add a
    link back to the installation summary in the form submission
    alerts, and fix empty toast containers blocking the header
    toolbar (gh#agama-project/agama#3613).

++++ bash:

  - Add upstream patches
    * Bash-5.3 Official patch 10 -- bash53-010
    Under some circumstances, a subshell or asynchronous job with an active
    EXIT trap that contains a call to `wait' can loop trying to wait for
    processes that are not its children. It usually inherits these jobs from
    its parent in the jobs list.
    * Bash-5.3 Official patch 11 -- bash53-011
    If a `mapfile' callback unsets the array variable `mapfile' is using to save
    the lines it reads, `mapfile' can try to reference freed memory, which can
    cause corruption or shell crashes.
    * Bash-5.3 Official patch 12 -- bash53-012
    If a subshell with an inherited EXIT trap receives a fatal signal before
    it clears the exit trap, and before it restores its original signal
    handlers, it's possible for it to inappropriately run the inherited EXIT
    trap.
    * Bash-5.3 Official patch 13 -- bash53-013
    Comparing the value of a pointer returned from realloc/xrealloc to the
    original pointer passed is technically undefined behavior, which matters
    under some circumstances.
    * Bash-5.3 Official patch 14 -- bash53-014
    Bash-5.3 patch 11 included an inadvertent extra line, which this patch
    removes. This also takes the opportunity to improve that patch, by looking
    up the variable each time through the line-reading loop only if there is
    a callback and it is invoked.
    * Bash-5.3 Official patch 15 -- bash53-015
    There are circumstances under which index -1 is used to reference into
    the input buffer used by the `read' builtin.

++++ crmsh:

  - Update to version 5.1.0+20260611.7998ffe4:
    * Dev: help: Refactor to encapsulate alias help logic in subclass
    * Dev: help: Give the correct level index to fuzzy search for topic help
    * Dev: help: Show alias command info
    * Dev: crm.8.adoc: Improve crm.8.adoc

++++ forgejo:

  - Update to 15.0.3:
    + fix: prevent stored XSS in user display name on Actions page
    + fix: LFS locks must belong to the intended repo, port from Gitea
    + fix: prevent unauthorized access to draft releases via API
    + fix: prevent writes to OpenID visibility which may affect other users
    + fix: prevent viewing private PRs that are linked to public issues on public projects
    + fix: do not migrate confidential issues and internal notes from Gitlab
    + fix: improve visibility of mismatched repository & package visibility
    + fix: display the actions trust management panel on merged and closed pull requests
    + fix(ui): improve contrast of checkboxes in markup
    + fix(ui): hide some disallowed actions that lead to 404 errors in archived repos
    + fix(ui): do not clip overflow in workflow dispatch menu
    + fix: show the actions trust management panel when runs from trusted users are pending approval
    + fix: always display the pull request merge box if there are actions pending approval
    + fix(ui): fix typo in issue sort dropdown; relevance was misnamed as relevency
    + fix: do not hide previous attempts without task for latest attempt
    + fix(ui): use URL query escaping for SSH key verification reload token link
    + fix(doctor): ensure the doctor runs with the same settings.AppPath as Forgejo
    + fix: make email token extraction case-insensitive
    + fix: cancel dependent jobs when rerunning jobs
    + fix: check quota in LFS uploads against the repository owner, not operating user
    + fix: load repo language for converting to api struct
    + fix: workflow with pull_request trigger and path filter not run when merging
    + fix: update statuses in phases to prevent out of order updates from stalling workflows
    + fix: return 404 instead of 500 for non-existing SHA in commit status endpoint
    + fix(issue-search): single exclude query was erroneosly considered as must
    + fix: remove link to artefacts that have expired
    + fix: wipe run artifacts before rerun

++++ forgejo-longterm:

  - Update to version 11.0.15:
    + fix: LFS locks must belong to the intended repo, port from Gitea
    + fix: prevent unauthorized access to draft releases via API
    + fix: prevent writes to OpenID visibility which may affect other users
    + fix: prevent viewing private PRs that are linked to public issues
    on public projects
  - apparmor profile: allow reading of credential files. This fixes
    migration of private repositories

++++ go1.21:

  - Use libalternatives only on suse_version >= 1610 and keep
    update-alternatives support for older distributions.
  - Drop the update-alternatives migration path for libalternatives builds.

++++ go1.22:

  - Use libalternatives only on suse_version >= 1610 and keep
    update-alternatives support for older distributions.
  - Drop the update-alternatives migration path for libalternatives builds.

++++ go1.23:

  - Use libalternatives only on suse_version >= 1610 and keep
    update-alternatives support for older distributions.
  - Drop the update-alternatives migration path for libalternatives builds.

++++ go1.24:

  - Use libalternatives only on suse_version >= 1610 and keep
    update-alternatives support for older distributions.
  - Drop the update-alternatives migration path for libalternatives builds.

++++ go1.25:

  - Use libalternatives only on suse_version >= 1610 and keep
    update-alternatives support for older distributions.
  - Drop the update-alternatives migration path for libalternatives builds.

++++ go1.26:

  - Use libalternatives only on suse_version >= 1610 and keep
    update-alternatives support for older distributions.
  - Drop the update-alternatives migration path for libalternatives builds.

++++ golang-github-prometheus-node_exporter:

  - CVE-2026-39821: Fix validation bypass and privilege escalation by
    updating golang.org/x/net to version 0.55.0 (bsc#1266608)

++++ golang-github-prometheus-promu:

  - update to 0.19.0:
    * [FEATURE] crossbuild: add --pull flag to control image pulling
    [#394]

++++ gpsd:

  - Rewrite the SPEC file to build, remove Python 2 building, and
    clean up.
  - Needs more work to support building via wheels.
  - Add update-desktop-files.patch and remove
    `%suse_update_desktop_file` and dependency on
    `update-desktop-files` package
    (https://en.opensuse.org/openSUSE:Update-desktop-files_deprecation).

++++ gtk-vnc:

  - bsc#1266272 - "virt-manager" is crashing.
    bsc#1266372 - virt-manager SIGSEGV after few minutes in
    on_primary_owner_change (.... at ../src/vncdisplay.c:1944
    009-let-GLib-manage-the-lifecycle-of-VncDisplay-GObject.patch

++++ guile-arguments:

  - Address factory-auto's comment about sources

++++ hawk2:

  - Update to version 2.7.0+git.1781190752.ede285d7 (bsc#1267908):
    * Dev: hide 'Add Resource' --> 'Multi-state' menu

++++ himmelblau:

  - Update to version 3.1.7+git0.f4e43ca0:
    * cargo vet
    * Version 3.1.7
    * sso: fix Chrome ExtensionInstallForcelist missing update URL
    * Continue the never-ending chase for SELinux support
    * Respect configured remote service deny list
    * Retry enrollment with MFA on strong auth errors
    * nss: reject non-directory names before GetCredentialType probe
    * Update libhimmelblau to latest version
    * deps(rust): bump the all-cargo-updates group across 1 directory with 10 updates
    * ci: automate OBS stable branch submissions

++++ hyprland:

  - Update to version 0.55.4:
    + Another small round of patches on top of 0.55.3.
    + Fixes backported:
  - config/lua: fix layout ctx checking the wrong argument (#15061)
  - desktop/popup: fix subsurface scaling (#14936)
  - gestures: fix live cursorZoom anchoring to a mid-animation
    value (#14996)
  - gestures: fix toggle cursorZoom sharing a single on/off flag
    (#14998)
  - groups: fix border color for locked groups (#15015)
  - protocols/foreignToplevel: fix class and title reporting on map
    and afterwards (#15037)
  - protocols/pointerWarp: fix crash when warp is on a non
    interactive surf (#15021)
  - renderer: fix SEGV on monitor disconnect (#15048)
  - gestures: clamp toggle cursorZoom like mult and live (#14997)
  - gestures: configure client to final size on fullscreen/float
    gesture completion (#14981)

++++ ibus-typing-booster:

  - Update to 2.30.10
  - Run doctests requiring `regex` only when `regex` is available
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/909)
  - Translation update from Weblate (fa 4.7%, lt 8.5%, or 34.1%, si 1%)

++++ inkscape:

  - Add fix_build_with_poppler_26.06.patch: Fix support for poppler
    >= 26.06 (https://gitlab.com/inkscape/inkscape/-/work_items/6210)

++++ jfrog-cli:

  - Update to version 2.108.0:
    * New Features
  - [build-info-go] Added pnpm package support to recognise 403
    Forbidden output #389 (@Phavya-jfrog)
  - [jfrog-cli] Add jf mcp command to configure the remote JFrog
    MCP server #3533 (@ehl-jf)
  - [jfrog-cli] Add AI context description to commands #3503
    (@ehl-jf)
  - [jfrog-cli] feat: add server id to login command #3394
    (@tim-goto)
  - [jfrog-cli] RTECO-1021 - Enhance metrics visibility by
    including package manager context #3534 (@fluxxBot)
  - [jfrog-cli] Make nix command visible #3539 (@reshmifrog)
  - [jfrog-cli] Added Post Failure Run support for pnpm and Yarn
    [#3509] (@Phavya-jfrog)
  - [jfrog-cli-artifactory] JGC-473 - Add AI-agent help text to
    artifactory commands #455 (@ehl-jf)
  - [jfrog-cli-artifactory] RTECO-1021 - Enhance metrics
    visibility by including package manager context #481
    (@fluxxBot)
  - [jfrog-cli-artifactory] RTECO-1400 - Add path validation to
    prevent traversal attacks in artifact handling #487
    (@fluxxBot)
  - [jfrog-cli-core] RTECO-1021 - Enhance metrics visibility by
    including package manager context #1569 (@fluxxBot)
  - [jfrog-cli-security] Support parsing SCA issues without
    components #758 (@attiasas)
  - [jfrog-cli-security] JGC-473 - Add AI-agent help text to
    security commands #760 (@ehl-jf)
  - [jfrog-cli-security] Feature/xray 138688 add yarn support for
    jf ca #759 (@gauriy-tech)
  - [jfrog-cli-security] XRAY-144809 - CA command [Maven]: Add
    option to consider plugin deps #771 (@gauriy-tech)
  - [jfrog-cli-security] Feature/xray 138688 add pnpm support for
    jf ca #769 (@gauriy-tech)
    * Bug Fixes
  - [build-info-go] RTECO-1287 jf poetry install --only main
    captures all dependency #391 (@reshmifrog)
  - [jfrog-cli] RTECO 1296 fix repeated 401 errors before
    fallback authentication #3537 (@reshmifrog)
  - [jfrog-cli] RTECO-1287 jf poetry install --only main captures
    all dependency #3530 (@reshmifrog)
  - [jfrog-cli-artifactory] Updated logic for extracting
    repository key in case of reverse proxy scenario #458
    (@naveenku-jfrog)
  - [jfrog-cli-core] Revert "Fix reference token privilege
    escalation" #1571 (@reshmifrog)
  - [jfrog-cli-security] XRAY-140212 - Updated gradle dep tree
    jar with the missing deps fix #751 (@gauriy-tech)
  - [jfrog-cli-security] fix: disable npm workspaces for native
    config reads #762 (@omribz156)
    * Other Changes
  - [build-info-go] RTECO-1365 Include e2e tests from jfrog cli
    to build-info-go #390 (@reshmifrog)
  - [jfrog-cli-artifactory] pnpm update error output handling
    [#465] (@Phavya-jfrog)
  - [jfrog-cli-security] Auto install Cocoapods when Podfile.lock
    not exist #723 (@attiasas)
  - [jfrog-client-go] Use Windows system certificate store for
    CLI TLS transport #1351 (@RemiBou)

++++ kawaii-player:

  - Removed BuildArch: noarch and updated file packaging targets to %{python3_sitearch} to compile separate native CPU packages on all target architectures. Required because now the package builds a native C extension module (mpv.cpython-*.so).
  - Used hardlinks instead of softlinks for the fdupes to fix mtime file issues.
  - Added some custom rpmlint filters to filter out two false positive errors.

++++ kernel-default:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-source:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-docs:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-kvmsmall:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-obs-build:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-obs-qa:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-syms:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ kernel-vanilla:

  - Update config files. Disable CAIF (bsc#1266716 CVE-2026-45866).
    The whole code is removed in 7.1 anyway by 6d5431555de0 ("caif: remove
    CAIF NETWORK LAYER"). Let's be proactive as there are holes.
  - commit 3512c44

++++ libcpuid:

  - Fix soversion to 18 [1001-fix-soversion.patch] (bsc#1268056)
  - Add autoreconf to regenerate configure script after patching

++++ sssd:

  - Update to release 2.13.1
    * Fixed an issue where SSSD fails to start when DNS is
    unresponsive.
    * SSSD no longer crashes if ``ldap_read_rootdse=never`` and
    ``enumerate=true`` is set.
  - Add jwk.patch

++++ ncurses:

  - Pre work for ABI 7

++++ openjph:

  - Update to 0.28.0:
    * AVX2 block coder optimizations #276

++++ rav1e:

  - Update cargo dependencies (bsc#1249016 CVE-2025-58160).

++++ snapper:

  - improved error handling when disconnected by dbus (see
    gh#openSUSE/snapper#223)

++++ subrandr:

  - Update to version 1.3.0:
    * Trim dead code and minimize item visibility in software rasterizer
    * Fix HarfBuzz glyph offset being applied in wrong coordinate space
    * Reuse single strip rasterizer within a `sw::Rasterizer`
    * Avoid hinting FreeType outline glyphs twice
    * Cache texture blurs in `sw::Rasterizer`
    * Get rid of generic `RenderTarget` and simplify `Rasterizer` trait API
    * Add some logging to `sw::Rasterizer` subscene handling
    * Cache subscenes in `sw::Rasterizer`
    * Don't recreate software rasterizer for each `Renderer::render`
    * Remove `DeferredBitmaps` scene node and render method `user_data`
    * Switch glyph rendering to rasterizer subscenes
    * Close unclosed contours when flattening `Outline`s
    * Allow specifying placeholder color in rasterizer scene
    * Add `FilledOutline` rasterizer scene node
    * Allow applying blur/extract_alpha filter to `Subscene`s
    * Add `ExternalSubscene` rasterizer subscene kind
    * Refactor rasterizer scene construction to compute final positions early
    * Remove `wgpu` rasterizer
    * Fix infinite recursion on missing RTL glyphs in some cases
    * Remove useless cloning in text shaper
    * Release v1.3.0
    * Update CHANGELOG.md
    * Fix clippy warnings in fontconfig weight mapping
    * Correctly refcount fontconfig config
    * Update dead spec link in comment
    * Fix WebVTT multi-element ruby base construction
    * Remove unused layout test snapshot file
    * Fix `InlineContentBuilder` inserting normal spans into ruby containers
    * Add a subtitle event iterator API
    * Move subtitle-related C API functions to a separate file
    * Move `sbr_library_close_font` to `sbr_wasm_close_font`
    * Remove unused `sbr_library_open_font_from_memory` from C API
    * Remove unused field from `COutputImage`
    * Fix missing `return`
    * Fix inconsistent tense in C API doc comments
    * Share common styles between layout test modules
    * Box `BlockContainer` field in `InlineBlock` item
    * Fix nightly clippy warnings
    * Switch `GlyphString` to logical glyph order
    * Add a layout test for reattempted shaping at the edges of a string
    * Simplify inline layout's `split_on_leaves`
    * Store `GlyphString` segments in a `Vec` instead of `LinkedList`
    * Simplify flow of shaping-related parameters in inline layout

++++ libvirt:

  - qemu: Fix invocation of numa-preplace when hugepages requested,
    but page size not specified
    bsc#1266364
  - spec: Disable building 32-bit QEMU support
    bsc#1263564

++++ melange:

  - Update to version 0.53.0:
    * feat(qemu): add QEMU_NET_CIDR to override SLIRP internal
    network (#2564)
    * ci: remove stale wolfi-presubmit package matrix entries (#2566)
    * chore(source): allow GitHub verified signatures (#2565)
    * fix(renovate): bump git-checkout regardless of tag if there is
    only one (#2562)

++++ mesheryctl:

  - update to 1.0.42:
    * General
  - fix(extensions): use filepath.Join for local provider package
    location @leecalcote (#19984)
  - [CI] Restore CodeQL uploads and add failure observability
    @copilot-swe-agent[bot] (#19972)
    * Maintenance
  - Upgrade CodeQL action versions to v4 @marblom007 (#19983)
  - Exclude old docs versions @leecalcote (#19981)
  - [CI] Make docs preview pruning resilient to concurrent
    gh-pages pushes @leecalcote (#19979)
  - Update codeql.yml @simihablo (#19980)
    * Documentation
  - docs(sidebar): animated caret toggle and emphasize parent nav
    items @hortison (#19977)
  - [Docs] Expand security vulnerabilities catalog with published
    CVEs @leecalcote (#19976)
  - Update security vulnerability reporting email address
    @simihablo (#19974)
  - [Docs] Render the documentation 404 page cleanly at any path
    @leecalcote (#19975)
  - [Docs] Meshery production deployment considerations
    @leecalcote (#19973)
    * Security
  - Exclude old docs versions @leecalcote (#19981)
  - update to 1.0.41:
    * General
  - [Server] Skip namespace creation for cluster-scoped resources
    in CreateK8sResource @shivv23 (#19959)
  - ci: fix secrets context used in if: condition in
    build-and-preview-docs workflow @copilot-swe-agent[bot]
    (#19952)
  - [CI] Use sparse checkout for docs preview builds
    @copilot-swe-agent[bot] (#19950)
    * Maintenance
  - Fix docs preview workflow @CodexRaunak (#19960)
  - enhance orgs section @hortison (#19949)
    * Documentation
  - docs: add Organizations logical concept; expand provider
    extensibility @leecalcote (#19951)
  - enhance orgs section @hortison (#19949)
  - [Docs] Restore "Exposing Meshery service(LoadBalancer)"
    section, fix dead GKE anchor @CodeAhmedJamil (#19946)
  - [Docs] Add Meshery installation guide for DigitalOcean
    @CodeAhmedJamil (#19944)

++++ openSUSE-release-tools:

  - Update to version 20260611.466e394c:
    * docker_publisher.py: Set opensuse/leap:16.0 as latest

++++ opensc:

  - added patches
    CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation [bsc#1267246]
    * opensc-CVE-2026-10275.patch

++++ opi:

  - Version 5.13.0
    * Add Tolaria plugin

++++ perl-Business-ISBN-Data:

  - updated to 20260611.1.0 (20260611.001)
    see /usr/share/doc/packages/perl-Business-ISBN-Data/Changes
    20260611.001 2026-06-11T15:19:31Z
    * data update for 2026-06-11

++++ perl-Config-IniFiles:

  - updated to 3.001000
    see /usr/share/doc/packages/perl-Config-IniFiles/Changes
    * Fix for CVE 2026-11527 . bsc#1268236
  - 2 args open() call
  - See t/38security-open.t
    * Add t/19utf8.t .
  - https://github.com/shlomif/perl-Config-IniFiles/issues/14
  - Thanks to @rdiez .

++++ perl-Net-DNS:

  - updated to 1.550.0 (1.55)
    see /usr/share/doc/packages/perl-Net-DNS/Changes

++++ pnpm:

  - Update to 11.5.3:
    * ⚠️ Security fix — environment variables in a project .npmrc
    * Stopped expanding environment variables in repository-
    controlled registry/proxy request destinations and registry
    credential values from .npmrc, and in workspace registry URLs
    from pnpm-workspace.yaml. Move dynamic registry URL and token
    configuration to trusted user, global, CLI, or environment config.
    * Resolve package-manager bootstrap dependencies with trusted
    user or CLI registry and network config, and reject package-
    manager env-lockfile records that do not use registry package
    paths with integrity-only resolutions before auto-switch execution.
    * Avoid writing packageManagerDependencies to pnpm-lock.yaml
    when package manager policy is set to onFail: ignore or
    pmOnFail: ignore #12228.
    * Avoid running dependency-status auto-install when the
    dependency status is unavailable without a project manifest.
    * Using the $ version reference syntax in overrides (e.g. "react": "$react")
    now prints a deprecation warning. The syntax still works, but
    catalogs are the recommended way to keep an overridden
    version in sync with the rest of the workspace. Reference a
    catalog entry with the catalog: protocol instead.
    * Fixed pnpm config get globalconfig to return the global config
    .yaml path again pnpm/pnpm#11962.
    * Fixed bare --color so it does not consume the following CLI
    flag, allowing command shorthands like --parallel to expand
    correctly and forms like pnpm --color with current <command>
    to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
    * Fix pnpm install ignoring enableGlobalVirtualStore toggle by
    including it in the workspace state settings check #12142.
    * Security: pnpm now verifies the npm registry signature of a
    package-manager binary before spawning it, so a cloned
    repository cannot make pnpm download and execute an arbitrary native binary.
    * Made peer-dependent deduplication deterministic. When a peer-
    suffixed package variant was a subset of two or more mutually
    incompatible larger variants, the variant it collapsed into
    depended on the order importers were resolved in, which
    varies between machines. This could resolve the same
    workspace to different lockfiles on different platforms and
    make pnpm dedupe --check alternate between passing and failing.
    * Reject invalid package names and versions from staged tarball
    manifests before deriving filenames for pnpm stage download.
    * Clarified in CLI help that the pnpm store is trusted shared
    state and store integrity checks are corruption detection,
    not a tamper boundary for untrusted store writers.
    * Reject reserved manifest bin names ("", ".", "..", and scoped
    forms such as @scope/..) when resolving a package's bins.
    These names previously passed the bin-name guard and, when
    joined to the global bin directory during global remove/update
    /add operations, could resolve to the global bin directory
    itself or its parent and have it recursively deleted.
    * Require trusted package identity before package-name
    allowBuilds entries can approve lifecycle scripts for git, git
  - hosted tarball, direct tarball, and local directory artifacts.
    To approve one of those artifacts explicitly, use its peer-
    suffix-free lockfile depPath as the allowBuilds key. Lockfile
    verification now rejects lockfiles where a registry-style
    dependency path (name@semver) is backed by a git, directory,
    or git-hosted tarball resolution (
    ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
    is a reliable artifact identity by the time scripts can run.
    * Security: pnpm now verifies the OpenPGP signature of a
    downloaded Node.js runtime's SHASUMS256.txt before trusting
    its integrity hashes.

++++ virt-scenario:

  - Use pyproject macros to build and install the module.

++++ python-kafka-python:

  - Update to 2.3.2 (bsc#1268081, CVE-2026-10142, bsc#1268082, CVE-2026-10143):
    * kafka.conn: Improve error handling for sasl authenticate
    mechanisms
    * kafka.net: Validate SASL/SCRAM iterations (#3026)
    * KafkaProtocol: validate network frame size (backport of #3019)
    * Clear _callbacks/_errbacks list when future is_done to avoid
    reference cycles (#2891)
    2.3.1:
    * Fix TaggedFields value encoding; add test coverage (#2725)
    * Fix zstd multi-frame decompression failure (#2717)
    * Fix KeyError in KafkaConsumer.committed() (#2710)
    * Fix VarInt/VarLong encoding; move tests to test/protocol/ (#2706)
    * Fix Fetcher._fetch_offsets_by_times retry handling (#2833)
    * Fixes to support integration testing with external KAFKA_URI
    (#2838)
    * Minor py2 fixes: consumer integration test; dont pip install
    python-snappy
    2.3.0:
    [#] CLI
    * python -m cli interfaces for kafka.admin, kafka.consumer, kafka.producer (#2650)
    [#] Producer
    * KIP-654: Abort transaction with pending data with
    TransactionAbortedError (#2662)
    * KafkaProducer: Handle UnknownProducerIdError (#2663)
    * KIP-467: Augment ProduceResponse error messaging for specific
    culprit records (#2661)
    [#] Consumer
    * KIP-345: Consumer group static membership (#2625)
    * KIP-207: Add ListOffsetsRequest v5 / handle
    OffsetNotAvailableError (#2657)
    * Fetcher: Add missing argument in debug log (#2665)
    [#] AdminClient
    * KIP-430: Return Authorized Operations in Describe Responses (#2656)
    * Add send_request() and send_requests() to KafkaAdminClient (#2649)
    [#] Maintenance
    * Remove old/unused kafka.protocol.pickle (#2653)
    * Switch protocol code to getattr/setattr from dict (#2654)
    * Drop unused imports (#2651)
    Full changelog: https://kafka-python.readthedocs.io/en/master/changelog.html
  - Drop not needed patches:
    * remove-mock.patch
    * slightly-patch-out-six.patch
    * python-311.patch

++++ python-textfsm:

  - Drop no longer required {Build,}Requires on six.

++++ python-uv:

  - update to 0.11.20
    * Enhancements
    * Add --emit-index-url and --emit-find-links to uv export
    * Add --find-links support for uv pip list
    * Group executable install errors during uv python install
    * Use ICF in macOS release builds to reduce binary sizes
    * Always compute SHA256 for remote distributions
    * Add PyEmscripten platform (PEP 783)
    * Add Pyodide 2025 target triple
    * Preview features
    * Add initial hidden uv upgrade command
    * Reject Git revisions in uv upgrade
    * Make preview features for commands have names that aren't ambiguous with the command
    * Respect --isolated in uv check
    * Configuration
    * Recognize UV_NO_INSTALL_PROJECT, UV_NO_INSTALL_WORKSPACE, UV_NO_INSTALL_LOCAL
    * Performance
    * Speed up discovery of large workspaces
    * Bug fixes
    * Allow unknown preview flags with a warning again
    * Apply dependency exclusions to direct requirements
    * Avoid following external symlinks during cache clean
    * Avoid following symlinks during cache prune
    * Fix Git cache keys for worktrees and packed refs
    * Make resolver error handling iterative to avoid stack overflows
    * Pass VIRTUAL_ENV through cygpath inside fish on Windows
    * Rebuild explicit local directory tool installs
    * Validate egg top-level entries as identifiers
    * Continue tool uninstall after dangling receipts
    * Skip Unix-specific installation steps when cross-installing Windows Python distributions
    * Documentation
    * Document --find-links caching behavior
    * Add a small section for malware checks

++++ python-wirerope:

  - Add patch no-six.patch:
    * Drop use of six and Python 2 compat code.

++++ python313-wxPython:

  - Update to 4.2.5:
    * Change sdist filename to all lowercase
    * Fix wx.svg to work with cython 3.1 generated code.
    * Populate wx.svg with _nanosvg enum values.
    * Drop Python 3.9 (EOL)
    * Add typing-extensions to build system requirements
    * Add enum class support to etgtools
    * Add a sip MappedType for std::vector
    * Update sip generator to handle constexpr's
    * Fix bug in _archive_submodules exposed by newer wx
    * Fix compile warning in ListClass __contains__ methods
    * Fix build with setuptools 81+
    * Rewrite constexpr to const in member vars
    * Handle changes in wxGLCanvas and wxWebView in wx 3.3.2
    * Make flatmenu's repositioning logic multi-monitor aware
    * Add several methods to FlatMenu and FlatMenuItem to mimic wx better.
    * Remove no-op code from aui for deleting panes created referring to
    inexistent windows
    * Fix SuperToolTip window too small when footerBmp is used
    * Expose MSWEnableDarkMode/wxDarkModeSettings on all platforms at
    compilation time
    * Fix webview stubs for wxWidgets 3.3.x
    * Set rpath in link arguments rather than LD_RUN_PATH
    * Fix using setuptools.build_meta backend (#2732)
    * Fix EOL style in wx.py.editwindow.py (#2741)
    * Replace imp with types in wx.py.editor.py (#2745)
    * Fix floatcanvas Text.ShiftFunDict: convert float to int (#2749)
    * Fix up/down option not working on the initial search in wx.py.frame
    (#2747)
    * Fix floatcanvas Arrow, Point, Bitmap drawings (#2750)
    * Officially support and build wheels for Python 3.14 and Windows 11 ARM
    * Fix crash when calling wx.SystemSettings.GetAppearance() without App
    (#2771)
    * Enable whole word search in wx.py.editwindow (#2769)
    * Add MaxSize limit to ScaledBitmap drawing in FloatCanvas (#2768)
    * Fix more OGL float/int conversion issues (#2739)
    * Major speedups and bug fixes to CustomTreeCtrl and HyperTreeList (#2088)
    * Fix duplicated string constants in wx.propgrid (#2790)
    * Add non-zero width and height to default tab size to avoid wxWidgets
    warning in wx.lib.agw.aui.auibook (#2788)
    * Fix SetHeaderHeight in UltimateListCtrl (#2239)
    * Add ScrollLeft and ScrollDown to PlotCanvas (#2795)
    * Add sample of PlotCanvas usage (#2794)
    * Fix a linker issue with GCC 16+ and wxHelpControllerBase (#2807)

++++ python314-wxPython:

  - Update to 4.2.5:
    * Change sdist filename to all lowercase
    * Fix wx.svg to work with cython 3.1 generated code.
    * Populate wx.svg with _nanosvg enum values.
    * Drop Python 3.9 (EOL)
    * Add typing-extensions to build system requirements
    * Add enum class support to etgtools
    * Add a sip MappedType for std::vector
    * Update sip generator to handle constexpr's
    * Fix bug in _archive_submodules exposed by newer wx
    * Fix compile warning in ListClass __contains__ methods
    * Fix build with setuptools 81+
    * Rewrite constexpr to const in member vars
    * Handle changes in wxGLCanvas and wxWebView in wx 3.3.2
    * Make flatmenu's repositioning logic multi-monitor aware
    * Add several methods to FlatMenu and FlatMenuItem to mimic wx better.
    * Remove no-op code from aui for deleting panes created referring to
    inexistent windows
    * Fix SuperToolTip window too small when footerBmp is used
    * Expose MSWEnableDarkMode/wxDarkModeSettings on all platforms at
    compilation time
    * Fix webview stubs for wxWidgets 3.3.x
    * Set rpath in link arguments rather than LD_RUN_PATH
    * Fix using setuptools.build_meta backend (#2732)
    * Fix EOL style in wx.py.editwindow.py (#2741)
    * Replace imp with types in wx.py.editor.py (#2745)
    * Fix floatcanvas Text.ShiftFunDict: convert float to int (#2749)
    * Fix up/down option not working on the initial search in wx.py.frame
    (#2747)
    * Fix floatcanvas Arrow, Point, Bitmap drawings (#2750)
    * Officially support and build wheels for Python 3.14 and Windows 11 ARM
    * Fix crash when calling wx.SystemSettings.GetAppearance() without App
    (#2771)
    * Enable whole word search in wx.py.editwindow (#2769)
    * Add MaxSize limit to ScaledBitmap drawing in FloatCanvas (#2768)
    * Fix more OGL float/int conversion issues (#2739)
    * Major speedups and bug fixes to CustomTreeCtrl and HyperTreeList (#2088)
    * Fix duplicated string constants in wx.propgrid (#2790)
    * Add non-zero width and height to default tab size to avoid wxWidgets
    warning in wx.lib.agw.aui.auibook (#2788)
    * Fix SetHeaderHeight in UltimateListCtrl (#2239)
    * Add ScrollLeft and ScrollDown to PlotCanvas (#2795)
    * Add sample of PlotCanvas usage (#2794)
    * Fix a linker issue with GCC 16+ and wxHelpControllerBase (#2807)

++++ rumdl:

  - Update to version 0.2.14:
    * Added
  - release: publish an alpine container image flavour (10fc739)
    * Fixed
  - discovery: honor config include patterns with non-standard
    extensions (4436dd7)
  - Update to version 0.2.13:
    * Added
  - release: publish multi-arch container image to ghcr.io
    (2e3d70b)
  - MD072: add required-keys option to enforce frontmatter key
    presence (7e8c78f)
  - config: file-precise provenance in rumdl config output
    (f401004)
    * Fixed
  - config: probe the working directory for project config even
    when it is $HOME (b49a2f8)
  - Update to version 0.2.12:
    * Fixed
  - discovery: normalize path_relative_to output to forward
    slashes on Windows (36c8fd9)
  - lsp: apply document fixes through the FixCoordinator
    (a5c5da1)
  - stdin: lint stdin through the shared engine (065c4d2)
    * - Update to version 0.2.11:
    * Fixed
  - lsp: rebuild and prune workspace index when configuration
    changes (9ca9049)
  - lsp: align workspace file discovery with CLI semantics
    (7a5d6aa)

++++ snapraid:

  - Update to 14.7:
    * Fix the 'touch' command on Windows for files with the read-only
    attribute. The read-only attribute is temporarily removed and
    then restored. No need to update if you are not on Windows.

++++ stackstate-cli:

  - Update to version 3.3.6:
    * STAC-0: fix docker registry (#148)
    * STAC-0: update dockerhub creds (#147)
    * STAC-24562: update stackstate openapi models after otel input action field type change (#143)
    * STAC-0: consolidate stackpack 2.0 feature flags (#146)
    * STAC-0: rename stackpack delete version flag to stackpack-version (#145)
    * STAC-24593 Update openapi spec
    * STAC-24574: Make sure text/plain bodies are printed upon cli error
    * Commit mise.toml
    * STAC-0 Rename flag
    * Support deletion of stackpack versions

++++ sudo:

  - Fix missing %verify(not mode) %{_bindir}/sudo (bsc#1263098)

++++ terragrunt:

  - Update to version 1.0.8:
    * Performance Improvements
  - Faster read-file tracking with the mark-many-as-read experiment
    With the mark-many-as-read experiment enabled, Terragrunt
    records every module file it marks as read during parsing.
    The bookkeeping for that record scaled quadratically: each
    new path was checked against every path recorded so far,
    which got expensive for units with large local module
    sources, and monorepos paid that cost again for every unit
    and every command.
    Recording a path now takes constant time no matter how many
    paths came before it, and re-marking already-recorded files
    is cheaper still. The reading lists reported by find and list
    are unchanged.
    * Bug Fixes
  - assume_role: preserve commas inside list expressions
    Terragrunt previously failed to correctly parse assume_role
    attributes containing list values such as transitive_tag_keys
    or policy_arns. Commas inside nested list expressions were
    incorrectly treated as top-level separators, causing
    generated configurations to fail with parsing errors.
    assume_role = {
    role_arn            = "arn:aws:iam::123456789012:role/test-role"
    transitive_tag_keys = ["Project", "Projects"]
    }
    This resulted in errors similar to:
    Missing item separator; Expected a comma to mark the beginning of the next item.
    Terragrunt now preserves commas inside nested list and object
    expressions when parsing assume_role blocks, allowing
    configurations containing array attributes to be processed
    correctly.
  - Completed experiments now evaluate as permanently enabled
    Features gated behind a completed experiment were treated as
    disabled instead of permanently enabled, so functionality
    that graduated out of experiment status could silently stop
    working.
    The one affected code path was hcl validate --inputs with a
    git filter expression such as --filter '[HEAD~1...HEAD]':
    after the filter-flag experiment completed, the command
    stopped preparing git worktrees for the filter. Git filter
    expressions now work with hcl validate --inputs again,
    matching find, list, and the other commands that accept
    filters.
  - Exposed-include resolution errors now name the include block,
    file, and failing field
    When resolving an include block with expose = true,
    Terragrunt surfaced low-level parsing or conversion errors
    with no indication of which include block, file, or field was
    at fault. This was especially hard to debug for errors that
    carry no source location, such as:
    unsuitable value: a bool is required
    The error is now annotated with the include block name, the
    included (parent) file path, and a single dotted locator for
    the failing field — the top-level config field (dependency,
    inputs, locals, or feature) plus the attribute path within it
    when go-cty can determine one:
    exposed include "root" (/path/to/root.hcl): dependency.outputs["enabled"]: unsuitable value: a bool is required
    When go-cty cannot resolve a precise attribute path, the
    locator degrades to just the field name:
    exposed include "root" (/path/to/root.hcl): dependency: unsuitable value: a bool is required
    Errors that originate in HCL parsing already carry a source
    range (file:line:column) and are preserved unchanged. This
    narrows the search from the entire configuration tree to a
    specific file and field.
  - Intersecting a graph traversal with another filter no longer
    drops the traversed components
    A graph traversal combined with an intersected filter dropped
    the components reached in discovery.
    e.g., ...a-dependent | type=unit (the dependents of
    a-dependent, intersected with type of units) returned only
    a-dependent itself instead of its dependents, and git-change
    traversals such as ...[HEAD~1...HEAD] | type=unit lost the
    dependents of the changed units.
    A component that matched both a graph expression target and a
    positive filesystem or git filter was classified as
    discovered before the graph traversal ran, so the traversal
    never expanded from it. Terragrunt now checks graph
    expression targets first, so intersecting a traversal with
    another filter keeps the dependencies and dependents it
    reaches.
  - generate blocks now honor hcl_fmt
    Terragrunt now accepts hcl_fmt on generate blocks and
    preserves the setting when configurations are parsed,
    written, and parsed again. This lets generated .tf, .hcl, and
    .tofu files opt out of automatic HCL formatting by setting
    hcl_fmt = false, matching the existing generate = { ... }
    attribute-map behavior.
  - Telemetry resource now honors OTEL_SERVICE_NAME and
    OTEL_RESOURCE_ATTRIBUTES
    Terragrunt previously hardcoded the service.name resource
    attribute to terragrunt for every emitted trace and metric,
    ignoring the standard OpenTelemetry environment variables.
    Multiple Terragrunt invocations could not be distinguished in
    an OpenTelemetry backend without an intermediate collector to
    rewrite the attribute.
    The resource is now composed via resource.New with
    WithFromEnv() placed after Terragrunt's defaults, so
    OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES are honored on
    every span and metric. Per the OpenTelemetry specification,
    OTEL_SERVICE_NAME takes precedence over a service.name entry
    in OTEL_RESOURCE_ATTRIBUTES. The default service.name remains
    terragrunt when neither variable is set.
  - s3:: sources: support virtual-hosted-style URLs
    s3:: source URLs using the virtual-hosted-style S3 endpoint
    format were rejected:
    terraform {
    source = "s3::https://my-bucket.s3.us-west-2.amazonaws.com/terraform/modules/myapp.zip"
    }
    This resulted in errors like:
    ERROR downloading source url s3::https://my-bucket.s3.us-west-2.amazonaws.com/...
    * URL is not a valid S3 URL
    Terragrunt now accepts every AWS S3 endpoint form, including
    virtual-hosted-style URLs
    (<bucket>.s3.<region>.amazonaws.com) and modern path-style
    URLs (s3.<region>.amazonaws.com).
  - Windows console mode is restored when Terragrunt exits
    On Windows, running a Terragrunt command from Nushell could
    leave the shell unable to read input afterward, with
    keystrokes such as the arrow keys appearing as raw escape
    sequences instead of being interpreted.
    While it runs, Terragrunt reconfigures the console it shares
    with the parent shell so that terminal escape sequences are
    processed, but it did not put the original mode back when it
    exited. PowerShell reapplies its own console settings on
    every prompt and recovers on its own, so the problem surfaces
    only in shells that keep the inherited mode, such as Nushell.
    Terragrunt now records the console mode at startup and
    restores it on exit, returning the shell to the state it was
    in beforehand.
    Reported in #6245.
    * Documentation Updates
  - Clean Markdown is available for every docs page at <url>.md
    Every docs page is now served as clean Markdown at the same
    URL with .md appended. For example, /getting-started/install
    is also available at /getting-started/install.md.
    curl https://docs.terragrunt.com/getting-started/install.md
    The .md version contains the page content without the site
    navigation or other surrounding HTML, which makes it well
    suited as context for LLMs and AI tooling: it is smaller and
    carries only the documentation itself. Coverage includes
    every page, including the CLI command reference and the
    changelog.
    This complements the existing llms.txt and llms-full.txt
    files by providing a per-page Markdown source.
    * Experiments Added
  - optional-hooks — Add experimental --no-hooks flag support for
    terragrunt run
    The terragrunt run command now supports an experimental
  - -no-hooks flag for disabling hook execution during command
    runs.
    The feature is gated behind the optional-hooks experiment and
    skips execution of before_hook, after_hook, and error_hook
    blocks when enabled.
    TG_EXPERIMENT=optional-hooks terragrunt run --no-hooks plan
    This feature is currently experimental because disabling
    hooks changes Terragrunt execution semantics and may evolve
    in future releases.
    Using --no-hooks without enabling the optional-hooks
    experiment will return an error.
  - hook-context-env experiment exposes additional TG_CTX_* env
    vars to hooks
    Enable the new hook-context-env experiment to surface three
    additional environment variables to every before_hook,
    after_hook, and error_hook:
  - TG_CTX_HOOK_TYPE — before_hook, after_hook, or error_hook,
    identifying which lifecycle phase invoked the hook.
  - TG_CTX_SOURCE — the resolved terraform source URL (CLI
  - -source override, else evaluated terraform.source with
    source-map applied, else .).
  - TG_CTX_TERRAGRUNT_DIR — the directory of the current
    Terragrunt config.
    terragrunt run --all --experiment hook-context-env -- apply
    These variables make it easier to share a single hook script
    across lifecycle phases and to access the unit's source and
    config directory without threading them through hook
    arguments.
    * Experiments Updated
  - cas: fallbacks now emit telemetry
    When the cas experiment is enabled and a CAS operation cannot
    complete, Terragrunt falls back to a slower path (the
    standard download client, or a temporary clone when the
    shared git store is unavailable) and keeps going. Until now
    the only record of a fallback was a warning in the logs,
    which made it impractical to measure how often CAS degrades
    across a fleet.
    Each fallback now also emits a cas_fallback telemetry event
    whose reason attribute identifies the cause: init_error,
    getter_error, git_store_unavailable, probe_failure, or
    stack_generation_error. Operators collecting OpenTelemetry
    traces or metrics from Terragrunt can count and alert on
    these events to judge CAS health before relying on it by
    default.
  - CAS flags for the catalog command
    The catalog command now accepts the --no-cas and
  - -cas-clone-depth flags, which were already available on run,
    stack generate, and stack run. When --no-cas is set, catalog
    repositories are cloned with plain Git even if the cas
    experiment is enabled. --cas-clone-depth controls the git
    clone --depth value the CAS uses when cloning catalog
    repositories.
    terragrunt catalog --experiment cas --cas-clone-depth=-1
  - cas — update_source_with_cas requires a literal source string
    When a catalog unit, stack, or terraform block set
    update_source_with_cas = true with a source that was not a
    literal string, rewriting silently produced a wrong source.
    Interpolation such as "../units/${local.name}" had the
    interpolated portion dropped, leaving a bare prefix; a
    reference such as local.foo resolved to the directory
    containing the block itself. In both cases stack generation
    packaged the wrong directory without any error.
    Stack generation now fails with an error explaining that
    update_source_with_cas requires a literal source string.
    Non-literal expressions, including interpolation, function
    calls, and references like local.foo, are rejected.
  - cas — Malformed cas:: references fail with a clear error
    A cas:: source with a malformed hash, such as cas::sha1:a,
    used to fail with an opaque internal error while looking the
    hash up in the store.
    CAS references are now validated up front: the hash must be
    lowercase hexadecimal with exactly 40 characters for sha1 or
    64 for sha256. References that don't match are rejected with
    an error identifying the bad reference.
  - cas — Repositories with submodules now clone correctly
    Cloning a repository that contains git submodules through the
    Content Addressable Store failed while ingesting the
    repository:
    git_cat_file: fatal: Not a valid object name <hash>
    A submodule appears in the repository tree as a pointer to a
    commit in another repository, so the object behind it cannot
    be read from the repository being cloned.
    The CAS now fetches each submodule from the URL registered in
    .gitmodules at its pinned commit and materializes its
    contents in place, including nested submodules. Relative
    submodule URLs (such as ../sibling.git) are resolved against
    the parent repository URL, matching git's behavior. Submodule
    contents are stored and deduplicated like any other content,
    so repeated clones reuse the cache.
  - catalog-redesign — Failures now exit nonzero and name the
    sources that failed
    The redesigned catalog exited with code 0 even when it
    failed: a session that ended on an unreachable repository, a
    failed scaffold, or a failed copy reported success in its
    exit code. Repositories that failed to load during discovery
    were dropped too: the warning logged for each one was drawn
    over by the full-screen interface, so a run where every
    source failed showed the same "No catalog sources were
    discovered" screen as a run that genuinely found nothing.
    The catalog now exits nonzero when the session ends on a
    failure: a discovery failure that leaves nothing to browse, a
    failed scaffold, or a failed copy. Quitting a working session
    still exits 0. When some sources fail to load while others
    succeed, the catalog stays usable and a clean quit still
    exits 0; the component list shows how many sources failed,
    and the failed repositories are printed with their causes
    after the catalog closes. When every source fails, the error
    screen lists each failed repository instead of claiming
    nothing was found, and dismissing it exits nonzero.
    Running terragrunt catalog without an interactive terminal,
    such as in CI, used to fail with a raw error from the
    underlying TUI library:
    bubbletea: error opening TTY: bubbletea: could not open TTY: open /dev/tty: no such device or address
    It now fails immediately with an error stating that the
    catalog command requires an interactive terminal.
  - catalog-redesign — Scaffolding a component no longer fails
    with a path-traversal error
    Scaffolding a component from the catalog (pressing s) could
    fail on macOS while downloading the source:
    subdirectory component contain path traversal out of the repository
    The catalog caches each repository under the system temporary
    directory, which macOS reports through a symlink
    (/var/folders/... pointing at /private/var/folders/...). The
    source location Terragrunt handed to the downloader was built
    against the unresolved path, so it pointed outside the cached
    repository and was rejected.
    Terragrunt now resolves the temporary directory before
    discovering components, so the source stays inside the
    repository and scaffolding proceeds.
  - stack-dependencies: HCL tooling now handles autoinclude
    Two tooling gaps around the experimental autoinclude block
    are closed:
  - hcl validate now validates autoinclude blocks. With the
    stack-dependencies experiment enabled, validating a
    terragrunt.stack.hcl that declares autoinclude runs the
    same strict checks as terragrunt stack generate. A
    malformed block (for example, a locals block inside
    autoinclude) is now reported at validation time instead of
    passing hcl validate and only failing later during
    generation. Without the experiment, validation behavior is
    unchanged.
  - read_terragrunt_config() can read stack-level autoinclude
    files. Reading a generated terragrunt.autoinclude.stack.hcl
    previously failed because the file was decoded as a unit
    configuration, which rejects its unit and stack blocks.
    With the experiment enabled, the file is now decoded as the
    stack-file fragment it is, returning its unit and stack
    blocks the same way reading a terragrunt.stack.hcl does.
    Unit-level terragrunt.autoinclude.hcl files already read
    correctly and continue to do so.
  - stack-dependencies: autoinclude merges like a regular include
    A generated unit autoinclude (terragrunt.autoinclude.hcl) now
    merges into the unit's config using the same default merge as
    a regular include, which is a shallow merge, applied
    uniformly across generation, full parse, and discovery.
    Top-level keys from the unit and the autoinclude combine, and
    on a conflict the autoinclude wins and replaces the unit's
    value rather than deep-merging nested maps; locals stay local
    in scope.
    A generated stack autoinclude
    (terragrunt.autoinclude.stack.hcl) injects unit and stack
    blocks into the generated terragrunt.stack.hcl. An injected
    block whose name matches an existing unit or stack now
    overrides that block wholesale, consistent with unit
    autoinclude override semantics, and an injected block with a
    new name is added. This applies uniformly across generation,
    full parse, and discovery, so a name match no longer produces
    a duplicate-name error. A stack autoinclude may not declare a
    top-level dependency block (stacks have no dependencies;
    declare the dependency inside the target unit's own
    autoinclude).
    A dependency block injected through an autoinclude is now
    available before a unit's remote_state is evaluated, so
    referencing dependency.<name>.outputs.<key> there no longer
    fails. remote_state now behaves the same as generate blocks.
  - stack-dependencies: autoinclude blocks can reference values.*
    An autoinclude block may now reference the stack's values.*.
    Previously a values.* reference was rejected at stack
    generate time, except in a dependency config_path. It now
    resolves to a literal like local.*, unit.<name>.path, and
    stack.<name>.path, wherever it appears: inputs, generate,
    remote_state, mock_outputs, and config_path.
    Function calls in an autoinclude now resolve at generate time
    too, in the terragrunt.stack.hcl context, instead of being
    kept verbatim and evaluated in the generated unit. Only a
    dependency.* reference (a dependency's outputs) stays
    verbatim and resolves inside the unit; in a mixed expression
    the stack-level parts resolve and only the dependency.*
    reference is kept.
    Because functions now evaluate against the stack file rather
    than the unit, directory and include functions report the
    stack file's location: get_terragrunt_dir returns the stack
    file's directory, and path_relative_to_include returns ".".
    If you relied on these resolving in the unit, move them to
    the unit's own configuration, or derive a per-unit value such
    as a remote_state backend key from unit.<name>.path.
    A locals block inside an autoinclude remains rejected;
    declare stack-level locals in terragrunt.stack.hcl instead.
  - stack-dependencies: stack dependencies resolve values.* in
    the target stack's locals
    Expanding a dependency that points at a generated stack
    directory no longer fails when that stack's
    terragrunt.stack.hcl reads values.* in its locals block.
    Previously, terragrunt stack generate succeeded but
    terragrunt run --all then failed with There is no variable
    named "values" while expanding the dependency into its units.
    Dependency expansion now reads the generated
    terragrunt.values.hcl next to each terragrunt.stack.hcl it
    visits, including nested stacks, so each nesting level
    resolves values.* from its own values file, the same way a
    full stack parse does.
  - stack-dependencies: component path references in values no
    longer break next to autoinclude blocks
    A unit or stack block's values can reference unit.<name>.path
    and stack.<name>.path even when another block in the same
    terragrunt.stack.hcl declares an autoinclude. Previously, the
    presence of any autoinclude block made stack generate reject
    those references with Unknown variable; There is no variable
    named "unit", while the same file without an autoinclude
    generated fine.
    * Features
  - feat: add hook-context-env experiment by @arnaud-dezandee in
    [#6189]
  - feat: Adding CAS fallback telemetry by @yhakbar in #6298
    * Bug Fixes
  - fix: Fixing filter tests on Windows by @yhakbar in #6247
  - fix: Fix Windows nushell bug by @yhakbar in #6250
  - fix(codegen): fix assume_role parsing failure when
    transitive_tag_keys or policy_arns arrays are present by
    @Rahul-Kumar-prog in #5975
  - fix: Fixing scaffold path traversal check by @yhakbar in
    [#6255]
  - fix(telemetry): honor OTEL_SERVICE_NAME and
    OTEL_RESOURCE_ATTRIBUTES environment variables by @Tensho in
    [#6256]
  - fix: Fixing graph traversal bug with intersected filter by
    @yhakbar in #6270
  - fix: resolve locals in autoinclude mock_outputs by @denis256
    in #6274
  - fix: report the offending field in Terragrunt config errors
    by @denis256 in #6284
  - fix: Fixing values without autoinclude by @yhakbar in #6290
  - fix: Fixing values references in locals of
    terragrunt.stack.hcl files by @yhakbar in #6291
  - fix: Fixing experiment promotion by @yhakbar in #6293
  - fix: Adding support for submodules in CAS by @yhakbar in
    [#6294]
  - fix: Validating CAS sources by @yhakbar in #6296
  - fix: Support autoinclude in hcl validate and fix
    read_terragrunt_config() for configurations using autoinclude
    by @yhakbar in #6297
  - fix: Fixing legacy virtual hosted style S3 URLs by @yhakbar
    in #6311
  - fix: Addressing lint findings by @yhakbar in #6312
    * Documentation
  - docs: Documenting CAS Getters by @yhakbar in #6251
  - docs: Support completedSince by @yhakbar in #6252
  - docs: Since/Before cleanup by @yhakbar in #6277
  - docs: Since/Before cleanup workflow by @yhakbar in #6276
  - docs: Support .md changelog files by @yhakbar in #6286
  - docs: Adding autoinclude documentation by @yhakbar in #6299
    * Chores
  - chore: weekly tests reporting by @denis256 in #6191
  - chore: Add thanks for #5975 by @yhakbar in #6253
  - chore: autoinclude merge fixes by @denis256 in #6248
  - chore: cleaned unused code by @denis256 in #6260
  - chore: Add CodeRabbit release check by @yhakbar in #6278
  - chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
    by @dependabot[bot] in #6265
  - chore(deps): bump docker/setup-docker-action from 5.1.0 to
    5.2.0 by @dependabot[bot] in #6266
  - chore(deps): bump aws-actions/configure-aws-credentials by
    @dependabot[bot] in #6267
  - chore: Make autoinclude more flexible, supporting values.* by
    @yhakbar in #6283
  - chore: Threading venv through CLI by @yhakbar in #6089
  - chore: Isolate test git servers by @yhakbar in #6233
  - chore: Add --no-cas flag to the catalog command by @yhakbar
    in #6292
  - chore: Clean up from #6290 by @yhakbar in #6295
  - chore: Adding DAG view tests by @yhakbar in #6300
  - chore: Speeding up files read by @yhakbar in #6301
    * Other Changes
  - Make guides collapsed to start by @karlcarstensen in #6262
  - Fix for light/dark mode by @karlcarstensen in #6264
  - Collapse reference section by @karlcarstensen in #6263
  - serve clean Markdown at .md for every page by @karlcarstensen
    in #6281
  - Feature/optional hooks experiment by @Rahul-Kumar-prog in
    [#6227]
  - Update to llms.txt. Added curated llms.txt and configured
    plugin to also serve full and small by @karlcarstensen in
    [#6280]
  - Changelog by @karlcarstensen in #6285
  - Fix #5054: support hcl_fmt in generate blocks by @DadaVinqi
    in #6287
  - fix Fixing catalog exit codes by @yhakbar in #6302

++++ ttl:

  - Update to version 0.20.0:
    * Add trace diffing (--diff) and streaming JSON output
    (--stream-json).
    * Add daemon mode, Prometheus exporter.
    * Publish multi-arch container images to GHCR on release.
    * Add interactive target selection.
    * Use a radix trie for IX prefix lookup.
    * Update some dependencies.

++++ virt-firmware:

  - Update to v25.12, last version with support for Python 3.6:
    * No changelog available, git log is also unusable :-/
  - Add a simple %check
  - Install man pages

++++ virt-v2v:

  - Fix virt-v2v: error: nbdkit is not installed or not working.
    bsc#1266387 - virt-v2v challenges...
    virt-v2v.spec

++++ virtualbox:

  - support kernel 7.1 (bsc#1268088)
    * 0001-7.2-Backported-r173880-Linux-vboxdrv-Add-initial-sup.patch
    * 0001-7.2-Backported-r173857-Additions-Linux-vboxsf-Add-in.patch

++++ virtualbox-kmp:

  - support kernel 7.1 (bsc#1268088)
    * 0001-7.2-Backported-r173880-Linux-vboxdrv-Add-initial-sup.patch
    * 0001-7.2-Backported-r173857-Additions-Linux-vboxsf-Add-in.patch

------------------------------------------------------------------
------------------  2026-6-10  -  Jun 10 2026  -------------------
------------------------------------------------------------------

++++ GraphicsMagick:

  - version update to 1.3.47
    * DPX: Fix subsampling validation logic which was failing due to
    incorrect logic. This avoids a divide by zero possibility.
    * JNG writer: Properly handle and report the case where
    ImageToBlob()returns NULL.
    * MNG writer: Enforce that MNG only supports a color palette up to 256
    colors (ImageMagick CVE-2026-28690).
    * MagickXImageWindowCommand(): Assure that static buffer does not
    overflow if the user keeps a numeric key depressed (ImageMagick
    CVE-2026-33535).
    * PCD: Prevent an out of bounds read (ImageMagick security advisory
    GHSA-wrhr-rf8j-r842).
    * PNG writer: Detect and report an excessively large profile, an other
    unexpected conditions (ImageMagick CVE-2026-30883).
    * RenderFreetype(): Use MagickConfirmAccess() to verify that font file
    name is allowed to be read.
    * TIFF EXIF IFD writer: Detect and prevent infinite looping (EXIF IFD
    writer code may be excluded by the -DEXPERIMENTAL_EXIF_TAGS=0
    define).
    * TIFF EXIF IFD writer: Only transfer tags from EXIF and GPS IFDs. Do
    not transfer tags from the main IFDs.
    * YUV: Fix validation of 'sampling-factor' argument. (ImageMagick
    CVE-2026-25799). Given that the argument normally comes from a user
    (rather than an input file) this seems to be a minor security issue
    at most.
    * PS, PS2, PS3: Enforce that width and height dimensions, and total
    pixels, to/from Ghostscript are within the same limits as specified
    for GraphicsMagick.  This helps avoid Ghostscript-based denial of
    service opportunities.
    * SVG: Add validations for element id syntax.  Reject invalid
    attribute values which contain single quotes.
    * XCF: Report an error if there are no layers. Fix two unsigned
    integer overflow cases.
    * DescribeImage(): Avoid heap write overflow while parsing the image
    directory.
    * and so on, see NEWS.txt
  - modified patches
    * GraphicsMagick-CVE-2026-42050.patch (refreshed)
    * GraphicsMagick-disable-insecure-coders.patch (refreshed)
    * GraphicsMagick-perl-linkage.patch (refreshed)
  - deleted patches
    * GraphicsMagick-CVE-2026-25799.patch (upstreamed)
    * GraphicsMagick-CVE-2026-26284.patch (upstreamed)
    * GraphicsMagick-CVE-2026-28690.patch (upstreamed)
    * GraphicsMagick-CVE-2026-30883.patch (upstreamed)
    * GraphicsMagick-CVE-2026-33535.patch (upstreamed)
  - modified patches
    * GraphicsMagick-perl-linkage.patch (refreshed)

++++ aaa_base:

  - Update to version 84.87+git20260610.3b5a868c:
    * Add missing "=" in alljava.csh (boo#1267423)

++++ agama:

  - Make `agama` command-line help translatable
    (gh#agama-project/agama#3594).
  - Honor extraRepositories repository priorities when adding software
    repositories through libzypp (related to gh#agama-project/agama#3483).

++++ agama-web-ui:

  - Redesign the installer header: replace the "Review and Install"
    button with breadcrumb navigation, show the product and the
    installer tools (localization, configuration, appearance and
    status) on every page, and add tooltips, clearer labels and a
    customizable icon size scale (gh#agama-project/agama#3607).

++++ amfora:

  - Update golang.org/x/net to v0.55.0 due to bsc#1267184: fixes
    CVE-2026-25680,CVE-2026-42502,CVE-2026-27136,CVE-2026-25681,CVE-2026-42506

++++ ansible-core:

  - Security fix for CVE-2026-11332 (bsc#1267822): argument injection in
    ansible-galaxy role install; pass role requirements as positional
    arguments to 'git clone' (add '--' separator). git-format-patch backport
    of gh#ansible/ansible#87078 (commit 5ae948f, stable-2.21).
    * add ansible-core-CVE-2026-11332.patch

++++ ansilove:

  - Update to version 4.2.2
    * Fix "Amiga Topaz 1" font selection from SAUCE metadata.
    * Fix font table entry count to make topaz500+ reachable.

++++ bird3:

  - Update to version 3.3.1
    * BGP: Fix crash when incoming connection for disabled protocol
    arrives.
    * BGP: Fix parsing labelled NLRIs with no next hop.
    * BGP: Fix cork behavior in collision with graceful restart.
    * BGP: Fix crash on dumping pending export statistics.
    * BGP: Fix several issues in Flowspec handling.
    * BMP/Nest: No refeed after listener or protocol restart.
    * MPLS: Fix crash on reconfiguring CS_DOWN channel.
    * OSPF: Fix handling of LLS data length field.
    * OSPF: Fix OOB read in authentication check.
    * OSPF: Fix OOB read in Router-LSA validation.
    * Proto: Fix regression in protocol enabling.
    * Channel: Fix refeeds and reloads during graceful restart.
    * Export: Mitigate duplicate withdrawals.
    * Filters: Fix crash when setting gateway on recursive nexthops.
    * Filters: Fix path matching when AS path is too long.
    * Table: Fix RCU double-anchor.
    * Table: Propagate thread group config into aux.
    * RCU: Catch leaks sooner.

++++ llvm22:

  - Update to version 22.1.7.
    * This release contains bug-fixes for the LLVM 22.1.0 release.
    This release is API and ABI compatible with 22.1.0.

++++ conan:

  - Update to version 2.29.0:
    * Feature: Limited support for python_requires in workspace,
    only in conanws.yml file (gh#conan-io/conan#20028).
    * Feature: Added new public attribute binaries to the
    MesonToolchain generator (gh#conan-io/conan#20017).
    * Feature: Add support for Apple OS 26.5 release
    (gh#conan-io/conan#19976).
    * Feature: Document RemoveAPI (gh#conan-io/conan#19930).
    * Feature: New global_user.conf file to locally customize
    global.conf (gh#conan-io/conan#19923).
    * Feature: Add support for GCC 16 (gh#conan-io/conan#19921).
    * Fix: Forward -vxxx verbosity argument to conan workspace
    build/install packages (gh#conan-io/conan#20015).
    * Fix: Add message when no packages found in conan list command
    (gh#conan-io/conan#20013).
    * Fix: source_credentials.json now supports supplying only
    headers (gh#conan-io/conan#20004).
    * Fix: conan workspace add --output-folder now properly updates
    the output_folder of an existing package entry in conanws.yml
    instead of ignoring it (gh#conan-io/conan#19988).
    * Fix: Default variant for QNX and VxWorks in default
    settings.yml should be null, not None. Also, add qcc=12.2
    version (gh#conan-io/conan#19981).
    * Fix: runtime_deploy: avoid crashing when overriding existing
    symlinks (gh#conan-io/conan#19977).
    * Fix: AutotoolsDeps will link with -rpath on shared package
    types and components correctly (gh#conan-io/conan#19975).
    * Fix: Warn and re-fetch when requested URLs conflict with
    existing ones with the same SHA256 (gh#conan-io/conan#19969).
    * Fix: cppstd_flag for clang-cl now correctly maps C++23, C++26
    and gnu++ standards instead of producing invalid /std: flags
    (gh#conan-io/conan#19965).
    * Fix: Correct the conan workspace init docstring
    (gh#conan-io/conan#19950).
    * Fix: Allow workspaces root Conanfile to have a name to apply
    conf with patterns that would match that name
    (gh#conan-io/conan#19927).
    * Fix: Fix meson_lib missing deps, meson_exe layout & install
    verbosity (gh#conan-io/conan#19918).
    * Bugfix: Raise an error if package_type and shared option
    mismatch (package-type is set to shared-library and
    shared=False or package_type=static-library and shared=True)
    (gh#conan-io/conan#20023).
    * BugFix: Fix the computation of options in graph build-order
    (gh#conan-io/conan#19950).
    * Bugfix: Fix requirement definition for multilib components
    without explicit requirements for CMakeConfigDeps
    (gh#conan-io/conan#19942).
    * Bugfix: MSBuildDeps no longer generates duplicate include and
    library directory paths in multi-component packages
    (gh#conan-io/conan#19937).

++++ gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ criu:

  - Fix the build on TW; by some reason, rseq detection didn't work, so
    make it more explicitly conflicting with the existing definition:
    criu-rseq-feature-test-fix-for-TW.patch

++++ crmsh:

  - Update to version 5.1.0+20260610.968f62d8:
    * Dev: utils: Add class MultipathInspector to inspect multipath devices

++++ cross-aarch64-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-aarch64-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-amdgcn-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-arm-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-arm-none-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-arm-none-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-avr-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-avr-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-bpf-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-hppa-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-nvptx-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-ppc64-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-ppc64le-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-ppc64le-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-pru-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-riscv64-elf-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-riscv64-elf-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-riscv64-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-riscv64-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-rx-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-rx-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-s390x-gcc13:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ cross-s390x-gcc13-bootstrap:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ crossplane-cli:

  - Update to version 2.3.2:
    The v2.3.2 release is a patch release that fixes regressions in
    the Crossplane CLI's render commands that were introduced in the
    v2.3.0 release. It also includes security updates to various
    dependencies.
    * chore(render): address adamwg's review nits on PR #91
    * chore(render): align engine tests with package conventions per
    coderabbit
    * fix(render): address code review on PR #91
    * refactor(render): swap docker test seam to one-method-interface
    idiom
    * chore(render): expand comments on test seam + helper-process
    pattern
    * feat(render): capture stderr and handle pipeline-fatal exit
    code in both engines
    * Bump crossplane dependencies to v2.3.2 (release-2.3)
    * render: Sort composed resources by `composition-resource-name`
    annotation
    * render: Replace condition lastTransitionTime timestamps in
    output
    * render: wire CompositionInputs.XRD through to the proto
    * proto: Sync render.proto with crossplane/crossplane main
    * fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1
    [security]
    * docs: Enclose the CLI version number in backticks
    * ci: Use the vale-action to run vale
    * ci: Validate generated docs using vale
    * Add targeted vale ignores
    * help: Correct spelling in help text
    * Fix vale errors in help
    * generate-docs: Clean up maturity level notes
    * fix(deps): update module github.com/go-git/go-billy/v5 to
    v5.9.0 [security]
    * chore(deps): update module golang.org/x/net to v0.55.0
    [security]
    * chore(deps): update module github.com/sigstore/cosign/v2 to
    v2.6.2 [security]
    * chore(deps): update module github.com/containerd/containerd to
    v1.7.32 [security]

++++ elixir:

  - Upgrade to Elixir 1.20.1:
    * Changelog available at https://hexdocs.pm/elixir/1.20.1/changelog.html

++++ enc:

  - CVE-2026-1229: Fix incorrect value (bsc#1265533)
    Bump circl to 1.6.3

++++ fwupd:

  - Update to version 2.1.5:
    + This release adds the following features:
  - Allow overriding the detected CPU vendor to allow more self tests
  - Allow updating the Windows-specific UEFI CA on dual boot machines
  - Install the db updates on broken hardware with new firmware
    + This release fixes the following bugs:
  - Add tests for the vbe, upower, uefi-sbat, pci-bcr, mtd, gpio and msr plugins
  - Check the array index in some runtime-generated code
  - Claim the udev netlink backend before old libusb versions
  - Expand the netlink socket buffer to prevent packet loss during event floods
  - Fix a msgpack regression when updating some Huddly cameras
  - Fix HID feature read buffer size in goodix-tp device probe
  - Fix reproducible builds
  - Fix the check-reboot-needed command
  - Increase the i2c-hid re-bind delay for synaptics-rmi PID 0x96e7
  - Parse the dell-dock marketing name in a more safe way
  - Set a firmware size limit on intel-gsc aux and oprom firmware types
  - Simplify the engine by only loading the config object once
  - Use a cryptographically secure RNG when building the idle and inhibit IDs
  - Use a more appropriate firmware maximum size for Huddly cameras
    + This release adds support for the following hardware:
  - Elan touchscreens

++++ gcc13-testresults:

  - Update to gcc-13 branch head, 1990e6544b9f0db39c470b999, git10355
    * pulls fix for haproxy build [bsc#1267998]

++++ gitsign:

  - Update to version 0.16.1:
    * Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the
    actions group (#804)
    * Return the actual signer cert from CertVerifier.Verify (#810)
    * Updates (#803)
    * Reject malformed objects in attest predicate generation (#809)
    * Bump github.com/go-openapi/strfmt in the gomod group across 1
    directory (#811)

++++ glib-networking:

  - Add CVE-2026-10028.patch:
    tls: detect cycles when setting issuer property
    (CVE-2026-10028, bsc#1267979, glgo#GNOME/glib-networking!279)

++++ grub2:

  - Fix 00-grub script deletes snapshot directory (bsc#1267884)
    * grub2-snapper-plugin.sh

++++ hawk2:

  - Update to version 2.7.0+git.1781104125.e8be47d6:
    * Dev: rename 'Promotable' --> 'Unpromoted' (bsc#1267454)
    * CI/CD: use fencing-sbd in sle16, instead of stonith-sbd
    * Test: enable both fencing-sbd and stonith-sbd
    * Test: use another name for hot_primitive

++++ helmfile:

  - Update to version 1.5.3:
    * build(deps): bump github.com/gookit/color from 1.5.4 to 1.6.1
    by @dependabot[bot] in #2608
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.17 to 1.32.18 by @dependabot[bot] in #2610
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.101.0 to 1.102.0 by @dependabot[bot] in #2612
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.102.0 to 1.102.1 by @dependabot[bot] in #2613
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.18 to 1.32.20 by @dependabot[bot] in #2614
    * fix: support array of maps in set/setTemplate values by
    @yxxhero in #2615
    * fix: remove naked return by returning expected values by
    @ceriath in #2617
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.102.1 to 1.103.0 by @dependabot[bot] in #2619
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.20 to 1.32.21 by @dependabot[bot] in #2618
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.103.0 to 1.103.1 by @dependabot[bot] in #2620
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.21 to 1.32.22 by @dependabot[bot] in #2621
    * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
    1.103.1 to 1.103.2 by @dependabot[bot] in #2622
    * build(deps): bump github.com/aws/aws-sdk-go-v2/config from
    1.32.22 to 1.32.23 by @dependabot[bot] in #2623
    * Bump helm-diff to v3.15.8 across runtime defaults and execution
    environments by @Copilot in #2624
    * build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 by
    @dependabot[bot] in #2625

++++ himmelblau:

  - Update to version 3.1.6+git0.102ee045:
    * Fix cargo-fuzz install in fuzz CI
    * cargo vet
    * Update ldap3_proto to 0.6.2
    * Update `openssl` from 0.10.79 to 0.10.80
    * Version 3.1.6
    * Update cargo vet audits for backport
    * Work around resume lockout on network down
    * Reset Hello TOTP when passwd changes Hello key
    * Clear Hello TOTP keys during full cache clear
    * Add automatic fallback when requested MFA method is unavailable
    * Fix SSHd configuration load order on Fedora/RHEL systems
    * himmelblau-init-hsm-pin: don't bind the hsm-pin to PCR7
    * qr-greeter: support GNOME Shell 50
    * Update libhimmelblau to latest version
    * deps(rust): bump the all-cargo-updates group across 1 directory with 2 updates

++++ python-panel:

  - skip builds for python311 for the test flavor. Several of the
    required packages are not available for python311.

++++ kargo-cli:

  - Update to version 1.10.6:
    Kargo v1.10.6 is a patch release gathering four bug fixes,
    including a regression from v1.10.5 that prevented project Roles
    from loading in the UI.
    CLI-related changes:
    * Clearer error when resource creation conflicts (#6428):
    Creating a resource that conflicts with an existing one — for
    example, recreating a Project whose namespace is still
    terminating — previously surfaced an opaque, empty 500 error.
    These 409 Conflict responses are now parsed and presented with
    a meaningful message in the CLI and UI.

++++ kernel-default:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-source:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-docs:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-firmware-amdgpu:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-ath10k:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-ath11k:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-ath12k:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-atheros:

  - Update to version 20260610 (git commit e7eb98afc667):
    * LICENSES: update GPL-2.0 text and references
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-bluetooth:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory
    * QCA: Update Bluetooth WCN6856 firmware 2.1.0-00666 to 2.1.0-00669

++++ kernel-firmware-bnx2:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-brcm:

  - Update to version 20260610 (git commit e7eb98afc667):
    * LICENSES: update GPL-2.0 text and references
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-chelsio:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-dpaa2:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-i915:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-intel:

  - Update to version 20260610 (git commit e7eb98afc667):
    * LICENSES: update GPL-2.0 text and references
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-iwlwifi:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-liquidio:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-marvell:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-media:

  - Update to version 20260610 (git commit e7eb98afc667):
    * LICENSES: update GPL-2.0 text and references
    * LICENSES: rename GPL-3 to GPL-3.0-only
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-mediatek:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-mellanox:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-mwifiex:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-network:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-nfp:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-nvidia:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-platform:

  - Update to version 20260610 (git commit e7eb98afc667):
    * LICENSES: update GPL-2.0 text and references
    * LICENSES: rename GPL-3 to GPL-3.0-only
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-prestera:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-qcom:

  - Update to version 20260610 (git commit e7eb98afc667):
    * qcom: Update ADSP firmware for Glymur platform
    * Move firmware licenses to a LICENSES/ directory
    * qcom: update ADSP firmware for sm8750 platform
    * qcom: Update DSP firmware for qcs8300 platform
    * qcom: Update DSP firmware for sa8775p platform

++++ kernel-firmware-qlogic:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-radeon:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-realtek:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-serial:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Remove any files with unknown licenses
    * LICENSES: update GPL-2.0 text and references
    * LICENSES: rename GPL-3 to GPL-3.0-only
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-sound:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-ti:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-ueagle:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-firmware-usb-network:

  - Update to version 20260610 (git commit e7eb98afc667):
    * LICENSES: update GPL-2.0 text and references
    * LICENSES: rename GPL-3 to GPL-3.0-only
    * Move firmware licenses to a LICENSES/ directory

++++ kernel-kvmsmall:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-obs-build:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-obs-qa:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-syms:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kernel-vanilla:

  - Linux 7.0.12 (bsc#1012628).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1012628).
  - ACPI: button: Fix ACPI GPE handler leak during removal
    (bsc#1012628).
  - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    (bsc#1012628).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1012628).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1012628).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1012628).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1012628).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1012628).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1012628).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1012628).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1012628).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1012628).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1012628).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1012628).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1012628).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1012628).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1012628).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1012628).
  - tap: free page on error paths in tap_get_user_xdp()
    (bsc#1012628).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1012628).
  - vsock: keep poll shutdown state consistent (bsc#1012628).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1012628).
  - net: netlink: don't set nsid on local notifications
    (bsc#1012628).
  - net/smc: Do not re-initialize smc hashtables (bsc#1012628).
  - net/iucv: fix locking in .getsockopt (bsc#1012628).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1012628).
  - scsi: scsi_debug: Add missing newline in
    scsi_debug_device_reset() (bsc#1012628).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1012628).
  - ALSA: hda: cs35l56: Fix system name string leaks (bsc#1012628).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1012628).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1012628).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1012628).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1012628).
  - accel/ivpu: prevent uninitialized data bug in debugfs
    (bsc#1012628).
  - gpio: mxc: fix irq_high handling (bsc#1012628).
  - drm/i915/aux: use polling when irqs are unavailable
    (bsc#1012628).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1012628).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1012628).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1012628).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1012628).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1012628).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1012628).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1012628).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1012628).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1012628).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1012628).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1012628).
  - ethtool: cmis: require exact CDB reply length (bsc#1012628).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1012628).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1012628).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1012628).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1012628).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1012628).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1012628).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1012628).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1012628).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1012628).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1012628).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1012628).
  - bonding: refuse to enslave CAN devices (bsc#1012628).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1012628).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1012628).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1012628).
  - ethtool: tsconfig: fix reply error handling (bsc#1012628).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1012628).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1012628).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1012628).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1012628).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1012628).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1012628).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1012628).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1012628).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1012628).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1012628).
  - net/sched: fix packet loop on netem when duplicate is on
    (bsc#1012628).
  - net: Introduce skb tc depth field to track packet loops
    (bsc#1012628).
  - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress
    mirred loop (bsc#1012628).
  - net/sched: act_mirred: Fix blockcast recursion bypass leading
    to stack overflow (bsc#1012628).
  - net/sched: act_mirred: Fix return code in early mirred redirect
    error paths (bsc#1012628).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1012628).
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu()
    in RX path (bsc#1012628).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1012628).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1012628).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1012628).
  - net/handshake: hand off the pinned file reference to accept_doit
    (bsc#1012628).
  - net/handshake: Take a long-lived file reference at submit
    (bsc#1012628).
  - net/handshake: Drain pending requests at net namespace exit
    (bsc#1012628).
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    (bsc#1012628).
  - dpll: zl3073x: add die temperature reporting for supported chips
    (bsc#1012628).
  - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    (bsc#1012628).
  - dpll: zl3073x: use __dpll_device_change_ntf() and remove
    change_work (bsc#1012628).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1012628).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1012628).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1012628).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1012628).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1012628).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1012628).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1012628).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1012628).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1012628).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1012628).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1012628).
  - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    (bsc#1012628).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1012628).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1012628).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1012628).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1012628).
  - Revert "ipv6: preserve insertion order for same-scope addresses"
    (bsc#1012628).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1012628).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1012628).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1012628).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1012628).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1012628).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1012628).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1012628).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1012628).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1012628).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1012628).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1012628).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1012628).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1012628).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1012628).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1012628).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1012628).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1012628).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1012628).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1012628).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1012628).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1012628).
  - mm/vmalloc: do not trigger BUG() on BH disabled context
    (bsc#1012628).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1012628).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1012628).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1012628).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1012628).
  - mm/migrate_device: fix pgtable leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1012628).
  - zram: fix use-after-free in zram_writeback_endio (bsc#1012628).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1012628).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1012628).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1012628).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1012628).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1012628).
  - Bluetooth: HIDP: fix missing length checks in
    hidp_input_report() (bsc#1012628).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1012628).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1012628).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1012628).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1012628).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1012628).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1012628).
  - parport: Fix race between port and client registration
    (bsc#1012628).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1012628).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1012628).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1012628).
  - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    (bsc#1012628).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits
    (bsc#1012628).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1012628).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1012628).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1012628).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1012628).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1012628).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1012628).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1012628).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1012628).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1012628).
  - gpio: shared: undo the vote of the proxy on GPIO free
    (bsc#1012628).
  - gpio: shared: fix deadlock on shared proxy's parent removal
    (bsc#1012628).
  - gpio: shared: fix lockdep false positive by removing unneeded
    lock (bsc#1012628).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1012628).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1012628).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1012628).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1012628).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1012628).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1012628).
  - iio: dac: ad5686: fix input raw value check (bsc#1012628).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1012628).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1012628).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1012628).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1012628).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    (bsc#1012628).
  - iio: adc: nxp-sar-adc: Avoid division by zero (bsc#1012628).
  - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    (bsc#1012628).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1012628).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1012628).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1012628).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1012628).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1012628).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1012628).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1012628).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1012628).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1012628).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1012628).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1012628).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1012628).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1012628).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1012628).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1012628).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across
    bind/unbind cycles (bsc#1012628).
  - usb: dwc2: Fix use after free in debug code (bsc#1012628).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1012628).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1012628).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1012628).
  - wireguard: send: append trailer after expanding head
    (bsc#1012628).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1012628).
  - macsec: fix replay protection at XPN lower-PN wrap
    (bsc#1012628).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1012628).
  - octeontx2-af: validate body pcifunc in
    rvu_mbox_handler_rep_event_notify (bsc#1012628).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
    (bsc#1012628).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1012628).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1012628).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1012628).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1012628).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1012628).
  - spi: spi-mem: avoid mutating op template in
    spi_mem_supports_op() (bsc#1012628).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1012628).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1012628).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1012628).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1012628).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1012628).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1012628).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1012628).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1012628).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1012628).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1012628).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1012628).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1012628).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1012628).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1012628).
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (bsc#1012628).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1012628).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1012628).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1012628).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1012628).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1012628).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1012628).
  - dt-bindings: usb: Fix EIC7700 USB reset's issue (bsc#1012628).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1012628).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1012628).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1012628).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1012628).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1012628).
  - uio: uio_pci_generic_sva: fix double free of devm_kzalloc()
    memory (bsc#1012628).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1012628).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1012628).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1012628).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1012628).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1012628).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1012628).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1012628).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1012628).
  - usb: usbtmc: reject interrupt endpoints with small
    wMaxPacketSize (bsc#1012628).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1012628).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1012628).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1012628).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1012628).
  - USB: serial: option: add MeiG SRM813Q (bsc#1012628).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1012628).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1012628).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1012628).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1012628).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1012628).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1012628).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1012628).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1012628).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1012628).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1012628).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1012628).
  - usb: gadget: dummy_hcd: Reject hub port requests for
    non-existent ports (bsc#1012628).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1012628).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1012628).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1012628).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1012628).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1012628).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1012628).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1012628).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1012628).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1012628).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1012628).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1012628).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1012628).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1012628).
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    (bsc#1012628).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1012628).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1012628).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1012628).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1012628).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1012628).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    (bsc#1012628).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1012628).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1012628).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1012628).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1012628).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1012628).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1012628).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1012628).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1012628).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1012628).
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1012628).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1012628).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1012628).
  - serial: dz: Fix bootconsole handover lockup (bsc#1012628).
  - serial: dz: Convert to use a platform device (bsc#1012628).
  - serial: zs: Fix bootconsole handover lockup (bsc#1012628).
  - serial: zs: Switch to using channel reset (bsc#1012628).
  - serial: zs: Convert to use a platform device (bsc#1012628).
  - serial: core: introduce
    guard(uart_port_lock_check_sysrq_irqsave) (bsc#1012628).
  - serial: 8250: dispatch SysRq character in
    serial8250_handle_irq() (bsc#1012628).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1012628).
  - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
    (bsc#1012628).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1012628).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1012628).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1012628).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360
    15-fh0xxx (bsc#1012628).
  - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston
    OmniBook X (bsc#1012628).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1012628).
  - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    (bsc#1012628).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1012628).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1012628).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1012628).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1012628).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1012628).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1012628).
  - tools: ynl: add scope qualifier for definitions (bsc#1012628).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1012628).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.12-006-bcache-fix-uninitialized-closure-object.patch.
  - Rename to
    patches.kernel.org/7.0.12-055-blk-mq-reinsert-cached-request-to-the-list.patch.
  - commit 32bf651
  - Update
    patches.kernel.org/7.0.10-0188-net-sched-act_ct-Only-release-RCU-read-lock-a.patch
    (bsc#1012628 CVE-2026-46319).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242 bsc#1267618).
  - Update
    patches.kernel.org/7.0.10-0889-netfilter-nf_tables-use-list_del_rcu-for-netl.patch
    (bsc#1012628 CVE-2026-46324 bsc#1267995).
  - Update
    patches.kernel.org/7.0.10-1090-io-wq-check-that-the-predecessor-is-hashed-in.patch
    (bsc#1012628 CVE-2026-46274 bsc#1267918).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243 bsc#1266238).
  - Update
    patches.kernel.org/7.0.11-030-io_uring-waitid-clear-waitid-info-before-copyi.patch
    (bsc#1012628 CVE-2026-46315 bsc#1267953).
  - Update
    patches.kernel.org/7.0.11-044-Bluetooth-hci_uart-fix-UAFs-and-race-condition.patch
    (bsc#1012628 CVE-2026-46275 bsc#1267968).
  - Update
    patches.kernel.org/7.0.11-060-netfilter-nft_inner-Fix-IPv6-inner_thoff-desyn.patch
    (bsc#1012628 CVE-2026-46244 bsc#1267654).
  - Update
    patches.kernel.org/7.0.11-452-net-gro-don-t-merge-zcopy-skbs.patch
    (bsc#1012628 CVE-2026-46323).
  - Update
    patches.kernel.org/7.0.12-019-tun-free-page-on-short-frame-rejection-in-tun_.patch
    (bsc#1012628 CVE-2026-46321).
  - Update
    patches.kernel.org/7.0.12-020-tap-free-page-on-error-paths-in-tap_get_user_x.patch
    (bsc#1012628 CVE-2026-46320 bsc#1267993).
  - Update
    patches.kernel.org/7.0.12-021-tun-free-page-on-build_skb-failure-in-tun_xdp_.patch
    (bsc#1012628 CVE-2026-46322 bsc#1267994).
  - Update
    patches.kernel.org/7.0.12-315-Revert-mm-hugetlbfs-update-hugetlbfs-to-use-mm.patch
    (bsc#1012628 CVE-2026-46318).
  - Update
    patches.kernel.org/7.0.12-332-KVM-arm64-vgic-its-Drop-the-translation-cache-.patch
    (bsc#1012628 CVE-2026-46316).
  - Update
    patches.kernel.org/7.0.12-333-KVM-arm64-Reassign-nested_mmus-array-behind-mm.patch
    (bsc#1012628 CVE-2026-46317).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993 bsc#1267352).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006 bsc#1267479).
  - Update
    patches.kernel.org/7.0.4-010-leds-qcom-lpg-Check-for-array-overflow-when-sel.patch
    (bsc#1012628 CVE-2026-46286 bsc#1267932).
  - Update
    patches.kernel.org/7.0.4-011-greybus-gb-beagleplay-bound-bootloader-receive-.patch
    (bsc#1012628 CVE-2026-46332).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041 bsc#1267589).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022 bsc#1267434).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994 bsc#1267432).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064 bsc#1267497).
  - Update
    patches.kernel.org/7.0.4-019-drm-nouveau-fix-nvkm_device-leak-on-aperture-re.patch
    (bsc#1012628 CVE-2026-52904).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100 bsc#1267447).
  - Update
    patches.kernel.org/7.0.4-024-lib-test_hmm-evict-device-pages-on-file-close-t.patch
    (bsc#1012628 CVE-2026-46280 bsc#1267958).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080 bsc#1267596).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097 bsc#1267428).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089 bsc#1267445).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092 bsc#1267595).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069 bsc#1267437).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036 bsc#1267470).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996 bsc#1267436).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074 bsc#1267468).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028 bsc#1267430).
  - Update
    patches.kernel.org/7.0.4-047-of-unittest-fix-use-after-free-in-of_unittest_c.patch
    (bsc#1012628 CVE-2026-46288 bsc#1267941).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073 bsc#1267597).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030 bsc#1267451).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098 bsc#1267552).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102 bsc#1267502).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011 bsc#1267491).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002 bsc#1267587).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049 bsc#1267448).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078 bsc#1267505).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044 bsc#1267464).
  - Update
    patches.kernel.org/7.0.4-078-media-rockchip-rkcif-fix-off-by-one-bugs.patch
    (bsc#1012628 CVE-2026-52907).
  - Update
    patches.kernel.org/7.0.4-081-mm-alloc_tag-clear-codetag-for-pages-allocated-.patch
    (bsc#1012628 CVE-2026-46279 bsc#1267929).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025 bsc#1267585).
  - Update
    patches.kernel.org/7.0.4-084-mm-hugetlb-fix-early-boot-crash-on-parameters-w.patch
    (bsc#1012628 CVE-2026-46284 bsc#1267938).
  - Update
    patches.kernel.org/7.0.4-085-mtd-docg3-fix-use-after-free-in-docg3_release.patch
    (bsc#1012628 CVE-2026-46285 bsc#1267948).
  - Update
    patches.kernel.org/7.0.4-105-mm-zone_device-do-not-touch-device-folio-after-.patch
    (bsc#1012628 CVE-2026-46277 bsc#1267960).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998 bsc#1267452).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012 bsc#1267350).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000 bsc#1267490).
  - Update
    patches.kernel.org/7.0.4-135-net-txgbe-fix-RTNL-assertion-warning-when-remov.patch
    (bsc#1012628 CVE-2026-46287 bsc#1267954).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053 bsc#1267427).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031 bsc#1267463).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086 bsc#1267524).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037 bsc#1267361).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065 bsc#1267458).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007 bsc#1267586).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054 bsc#1267475).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060 bsc#1267594).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005 bsc#1267431).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096 bsc#1267371).
  - Update
    patches.kernel.org/7.0.4-186-tpm-Use-kfree_sensitive-to-free-auth-session-in.patch
    (bsc#1012628 CVE-2026-46283 bsc#1267952).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093 bsc#1267548).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013 bsc#1267351).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042 bsc#1267588).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087 bsc#1267492).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020 bsc#1267446).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067 bsc#1267498).
  - Update
    patches.kernel.org/7.0.4-198-mm-damon-core-disallow-non-power-of-two-min_reg.patch
    (bsc#1012628 CVE-2026-52905).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082 bsc#1267473).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059 bsc#1267495).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071 bsc#1267591).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014 bsc#1267440).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032 bsc#1267476).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076 bsc#1267365).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045 bsc#1267474).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095 bsc#1267363).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051 bsc#1267360).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070 bsc#1267501).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040 bsc#1267472).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015 bsc#1267439).
  - Update
    patches.kernel.org/7.0.4-252-9p-fix-access-mode-flags-being-ORed-instead-of-.patch
    (bsc#1012628 CVE-2026-52906).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056 bsc#1267435).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103 bsc#1267555).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077 bsc#1267466).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075 bsc#1267367).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068 bsc#1267592).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023 bsc#1267449).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066 bsc#1267593).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052 bsc#1267494).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072 bsc#1267441).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062 bsc#1267358).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039 bsc#1267465).
  - Update
    patches.kernel.org/7.0.4-287-iio-frequency-admv1013-fix-NULL-pointer-derefer.patch
    (bsc#1012628 CVE-2026-46282 bsc#1267919).
  - Update
    patches.kernel.org/7.0.4-299-drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA.patch
    (bsc#1012628 CVE-2026-46276 bsc#1267922).
  - Update
    patches.kernel.org/7.0.4-300-drm-imagination-Fix-segfault-when-updating-ftra.patch
    (bsc#1012628 CVE-2026-46278 bsc#1267915).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048 bsc#1267496).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090 bsc#1267531).
  - Update
    patches.kernel.org/7.0.4-303-vmalloc-fix-buffer-overflow-in-vrealloc_node_al.patch
    (bsc#1012628 CVE-2026-46281 bsc#1267961).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029 bsc#1267590).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149 bsc#1267648).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177 bsc#1267725).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128 bsc#1267643).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108 bsc#1267615).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179 bsc#1267719).
  - Update
    patches.kernel.org/7.0.7-018-flow_dissector-do-not-dissect-PPPoE-PFC-frames.patch
    (bsc#1012628 CVE-2026-46306 bsc#1267986).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173 bsc#1267723).
  - Update
    patches.kernel.org/7.0.7-030-wifi-ath5k-do-not-access-array-OOB.patch
    (bsc#1012628 CVE-2026-46307 bsc#1267987).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122 bsc#1267583).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151 bsc#1267728).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146 bsc#1267571).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157 bsc#1267726).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116 bsc#1267369).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193 bsc#1267656).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104 bsc#1267559).
  - Update
    patches.kernel.org/7.0.7-064-selinux-allow-multiple-opens-of-sys-fs-selinux-.patch
    (bsc#1012628 CVE-2026-46302 bsc#1267947).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123 bsc#1267621).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140 bsc#1267677).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111 bsc#1267626).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138 bsc#1267649).
  - Update
    patches.kernel.org/7.0.7-088-spi-s3c64xx-fix-NULL-deref-on-driver-unbind.patch
    (bsc#1012628 CVE-2026-46296 bsc#1267927).
  - Update
    patches.kernel.org/7.0.7-089-staging-rtl8723bs-os_dep-avoid-NULL-pointer-der.patch
    (bsc#1012628 CVE-2026-46305 bsc#1267930).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150 bsc#1267388).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132 bsc#1267616).
  - Update
    patches.kernel.org/7.0.7-111-pseries-papr-hvpipe-Fix-race-with-interrupt-han.patch
    (bsc#1012628 CVE-2026-46298 bsc#1267923).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182 bsc#1267383).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120 bsc#1267640).
  - Update
    patches.kernel.org/7.0.7-118-net-libwx-use-request_irq-for-VF-misc-interrupt.patch
    (bsc#1012628 CVE-2026-46297 bsc#1267935).
  - Update
    patches.kernel.org/7.0.7-125-x86-efi-Fix-graceful-fault-handling-after-FPU-s.patch
    (bsc#1012628 CVE-2026-46290 bsc#1267973).
  - Update
    patches.kernel.org/7.0.7-132-pmdomain-mediatek-fix-use-after-free-in-scpsys_.patch
    (bsc#1012628 CVE-2026-46308 bsc#1267988).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191 bsc#1267690).
  - Update
    patches.kernel.org/7.0.7-145-ibmveth-Disable-GSO-for-packets-with-small-MSS.patch
    (bsc#1012628 CVE-2026-46273 bsc#1267651).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148 bsc#1267718).
  - Update
    patches.kernel.org/7.0.7-158-spi-topcliff-pch-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46301 bsc#1267983).
  - Update
    patches.kernel.org/7.0.7-165-clk-microchip-mpfs-ccc-fix-out-of-bounds-access.patch
    (bsc#1012628 CVE-2026-46293 bsc#1267933).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143 bsc#1267712).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159 bsc#1267652).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160 bsc#1267624).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107 bsc#1267612).
  - Update
    patches.kernel.org/7.0.7-181-dm-fix-a-buffer-overflow-in-ioctl-processing.patch
    (bsc#1012628 CVE-2026-46294 bsc#1267939).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106 bsc#1267613).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130 bsc#1267629).
  - Update
    patches.kernel.org/7.0.7-188-isofs-validate-Rock-Ridge-CE-continuation-exten.patch
    (bsc#1012628 CVE-2026-46303 bsc#1267984).
  - Update
    patches.kernel.org/7.0.7-195-lib-scatterlist-fix-length-calculations-in-extr.patch
    (bsc#1012628 CVE-2026-46289 bsc#1267966).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119 bsc#1267628).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135 bsc#1267373).
  - Update
    patches.kernel.org/7.0.7-201-nvmet-avoid-recursive-nvmet-wq-flush-in-nvmet_c.patch
    (bsc#1012628 CVE-2026-46304 bsc#1267985).
  - Update
    patches.kernel.org/7.0.7-203-pmdomain-core-Fix-detach-procedure-for-virtual-.patch
    (bsc#1012628 CVE-2026-46292 bsc#1267943).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112 bsc#1267582).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105 bsc#1267372).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155 bsc#1267720).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139 bsc#1267681).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131 bsc#1267636).
  - Update
    patches.kernel.org/7.0.7-215-KVM-x86-Do-IRR-scan-in-__kvm_apic_update_irr-ev.patch
    (bsc#1012628 CVE-2026-46295 bsc#1267931).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126 bsc#1267584).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117 bsc#1267375).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145 bsc#1267715).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178 bsc#1267493).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137 bsc#1267570).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170 bsc#1267714).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194 bsc#1267569).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147 bsc#1267689).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156 bsc#1267385).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169 bsc#1267713).
  - Update
    patches.kernel.org/7.0.7-297-hfsplus-fix-held-lock-freed-on-hfsplus_fill_sup.patch
    (bsc#1012628 CVE-2026-46299 bsc#1267920).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153 bsc#1267574).
  - Update
    patches.kernel.org/7.0.7-301-crypto-caam-guard-HMAC-key-hex-dumps-in-hash_di.patch
    (bsc#1012628 CVE-2026-46291 bsc#1267937).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174 bsc#1267384).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232 bsc#1267669).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213 bsc#1267665).
  - Update
    patches.kernel.org/7.0.9-014-media-renesas-vsp1-Fix-NULL-pointer-deref-on-mo.patch
    (bsc#1012628 CVE-2026-46310 bsc#1267934).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239 bsc#1267530).
  - Update
    patches.kernel.org/7.0.9-039-media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mma.patch
    (bsc#1012628 CVE-2026-46312 bsc#1267990).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222 bsc#1267695).
  - Update
    patches.kernel.org/7.0.9-042-media-intel-ipu6-fix-error-pointer-dereference.patch
    (bsc#1012628 CVE-2026-46313 bsc#1267991).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235 bsc#1267702).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210 bsc#1267692).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228 bsc#1267705).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226 bsc#1267673).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225 bsc#1267627).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219 bsc#1267667).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203 bsc#1267620).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211 bsc#1267380).
  - Update
    patches.kernel.org/7.0.9-125-drm-v3d-Reject-empty-multisync-extension-to-pre.patch
    (bsc#1012628 CVE-2026-46314 bsc#1267992).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229 bsc#1267567).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218 bsc#1267632).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204 bsc#1267661).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199 bsc#1267638).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230 bsc#1267623).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209 bsc#1267663).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197 bsc#1267381).
  - Update
    patches.kernel.org/7.0.9-150-drm-xe-uapi-Reject-coh_none-PAT-index-for-CPU-c.patch
    (bsc#1012628 CVE-2026-46309 bsc#1267989).
  - Update
    patches.kernel.org/7.0.9-155-drm-amdgpu-userq-fix-access-to-stale-wptr-mappi.patch
    (bsc#1012628 CVE-2026-46311 bsc#1267949).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220 bsc#1267704).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227 bsc#1267697).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212 bsc#1267693).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233 bsc#1267701).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231 bsc#1267565).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221 bsc#1267523).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223 bsc#1267699).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207 bsc#1267691).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214 bsc#1267717).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217 bsc#1267655).
    suse-add-cves
  - commit 8beab0b
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit 41887ca

++++ kicad:

  - Update to 10.0.3:
    See https://www.kicad.org/blog/2026/05/KiCad-10.0.3-Release/
    for details
  - Spec cleanup, removed conditionals for old distribution versions.

++++ kicad-doc:

  - Update to 10.0.3:
    See https://www.kicad.org/blog/2026/05/KiCad-10.0.3-Release/
    for details

++++ kicad-footprints:

  - Update to 10.0.3:
    See https://www.kicad.org/blog/2026/05/KiCad-10.0.3-Release/
    for details

++++ kicad-packages3D:

  - Update to 10.0.3:
    See https://www.kicad.org/blog/2026/05/KiCad-10.0.3-Release/
    for details

++++ kicad-symbols:

  - Update to 10.0.3:
    See https://www.kicad.org/blog/2026/05/KiCad-10.0.3-Release/
    for details

++++ kicad-templates:

  - Update to 10.0.3:
    See https://www.kicad.org/blog/2026/05/KiCad-10.0.3-Release/
    for details

++++ ldns:

  - Update to version 1.9.2
    Insufficient verification that responses belong to a query
    (CVE-2026-10846, bsc#1267670)
  - ldns.keyring: updated from https://nlnetlabs.nl/signing-keys/

++++ libfaketime:

  - Disable lto
  - Add fix-build-with-ISO_C23.patch (gh#wolfcw/libfaketime#524)
  - Add fix-build-with-gcc-16.patch (gh#wolfcw/libfaketime#528)
  - Add %{set_build_flags}
  - Add %check/test section
  - Add FAKETIME_COMPILE_CFLAGS for ppc64le & riscv64
  - Make the libraries executable, needed for stripping them

++++ texlive:

  - Skip verification of the mode of the public binary (boo#1263098)

++++ mariadb:

  - Update to 12.3.2:
    https://mariadb.com/docs/release-notes/community-server/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/12.3/12.3.2
    https://mariadb.com/docs/release-notes/community-server/12.3/mariadb-12.3-changes-and-improvements
  - Refresh fix-pamdir.patch
  - Update list of skipped tests
  - Remove --ssl option when running the test suite as it was causing some failures
  - Remove INFO_SRC (dropped upstream)
  - Adjust file list and removal of systemd unit files for upstream changes in the galera config

++++ sendmail:

  - Skip verification of the mode of sendmail binary (boo#1263098)

++++ nlopt-main:

  - Update to version 2.11.0:
    * New CCSA and MMA parameters inner_gradients and always_improve
    (gh#stevengj/nlopt#623).
    * Various minor bugfixes (gh#stevengj/nlopt#637,
    gh#stevengj/nlopt#640).

++++ scintilla:

  - Update to version 5.6.3:
    * Restore selection and scroll position for undo and redo on
    additional views instead of just the view performing the undo
    or redo. Notepad++ Pull Request #18014.
    * Improve performance of rectangular paste when many spaces must
    be inserted. Bug #2302.
    * On Qt with Wayland, fix failures with displaying calltips and
    autocompletion lists.
  - Changes from version 5.6.2:
    * Add error status SC_STATUS_OUTSIDE_DOCUMENT that is set when
    operations are attempted on a position outside the document.
  - Changes from version 5.6.1:
    * Add mode to draw tabs as [HT] blobs with
    SCI_SETTABDRAWMODE(SCTD_CONTROLCHAR).
    * Improve mouse drag behaviour when drag and drop disabled.
    Feature #1581.
    * Fix regression in SCI_CONVERTEOLS that may not convert whole
    file. Bug #2501.

++++ snapper:

  - improve error handling if uid of client cannot be detected
    (see bsc#1265853)

++++ libstorage-ng:

  - Translated using Weblate (Danish) (bsc#1149754)
  - 4.5.330

++++ suseconnect-ng:

  - Update version to 1.22.1:
  - library: Allow clients to disable the token handling mechanism (jsc#SCC-801)
  - Ensure updated system certs are included when creating HTTP client
    connections (bsc#1268017, jsc#SCC-804)

++++ logback:

  - Upgrade to upstream version 1.5.34
    * General changes between series
    + The 1.2.x series has been deprecated for several years and is
    no longer maintained
    + In Logback 1.2.x/1.3.x, few optional components depend on
    Java EE, whereas in logback versions 1.4.x/1.5.x, these
    optional components depend on Jakarta EE. The 1.5.x series
    continues the 1.4.x series, but with logback-access relocated
    to its own repository
    * Fixes
    + In case certain StackTraceElement values returned by the
    Throwable.getStackTrace method are null,
    StackTraceElementProxy substitutes a dummy instance instead of
    throwing an IllegalArgumentException (#1040)
    + HardenedObjectInputStream will now throw an
    InvalidClassException during deserialization attempts of Proxy
    classes (bsc#1266783, CVE-2026-10532)
    + PropertiesConfiguratorModelHandler now registers properties
    file URLs to the ConfigurationWatchList when scan is enabled
    (via local scan="true" attribute or top-level configuration
    scan), ensuring changes are detected and reconfiguration
    occurs (issues/1034)
    + When processing <conversionRule> elements and both class and
    converterClass attributes are specified, silently use the
    class attribute without issuing a warning. However, if the
    attribute values differ, a warning will be issued (issues/1031)
    + HardenedModelInputStream will no longer accept to deserialize
    all classes located under the "java.lang" and "java.util"
    packages but only a limited number of explicitly authorized
    classes in those packages (bsc#1266783, CVE-2026-9828)
    + SSL parameters for SSLSocketAppender now enable hostname
    verification by default. Moreover, the default protocol is now
    "TLSv1.2"
    + When printing the status message field,
    ViewStatusMessagesServletBase now escapes special characters
    such as "&" as character entities
  - Removed patches:
    * logback-1.2.3-getCallerClass.patch
    * logback-CVE-2024-12801-CVE-2024-12798.patch
    * logback-CVE-2025-11226.patch
    * logback-CVE-2026-1225.patch
    + not needed with this version
  - Added patch:
    * new-janino.patch
    + upgrade to new janino that has packages in org.codehaus
    namespace

++++ lv2-airwindows:

  - Update to new upstream release 38.0
    * New plugins: Balanced, YHighpass, YNotch

++++ maven-surefire:

  - Obsolete the separate maven-surefire-provider-junit5-javadoc,
    since it is now included in the javadoc of this package

++++ mistral-vibe:

  - Update to 2.14.1:
  - Added
  - /teleport slash command exposed over ACP, mirroring the TUI
    command for IDE integrations
  - Startup prompt to install a pending Vibe update before
    continuing the session
  - Fixed
  - JetBrains IDEs no longer trigger a preemptive auth prompt
    over ACP and no longer drop terminal arguments
  - Initial ACP slash-command advertisement is delayed so Zed
    registers commands like /help instead of rejecting them
  - Built-in tool prompts no longer reference the removed
    search_replace name and now point to edit
  - Update to 2.14.0:
  - Added
  - Image attachments via @-mentions in the TUI for
    vision-capable models
  - Session deletion, exposed over ACP as the session/delete
    extension method
  - Browser sign-in now shows a copyable fallback URL when the
    browser does not open, so SSH and remote sessions can
    complete onboarding
  - Toast notification when a SKILL.md file fails to parse
    instead of silently dropping the skill
  - Trust prompt now proposes the git repository ancestor as
    a trust target
  - EnvironmentLayer in the layered configuration, populated
    from VIBE_-prefixed environment variables
  - Changed
  - New tool-call format for read and the file edit tool
  - write_file is now create-only and refuses to overwrite
    existing files
  - Bumped agent-client-protocol to 0.10.1
  - Fixed
  - LLM calls now retry on network errors and timeouts
    (connection, read, write, remote protocol, timeout)
  - Approval modal now sizes itself so the bottom of long
    tool-call payloads stays visible above the options block
  - Banner connector count and /mcp panel ordering now reflect
    which connectors are actually usable and the user's
    enable/disable choices
  - disabled_tools from runtime is merged with the TOML
    configuration instead of replacing it, and is enforced
    inside ToolManager.get()
  - shift+backspace and shift+delete now work in the chat input
  - Crash in the ACP todo plan-update handler when the model's
    tool call failed validation
  - Removed
  - Recursive search for nested harness files

++++ nekobox:

    Update to 5.11.20
  - Fix preshared_key option

++++ neonmodem:

  - Update golang.org/x/net dependency to v0.55.0 due to bsc#1267193

++++ netbird:

  - Netbird does not really comply to the format for /etc/sysconfig/
    so using /etc/default/${servicename} is a better idea. For
    backwards compatibility reasons we will still load the old path
    but the new path is preferred to be used.
  - Update to 0.72.3
  - Client Improvements
  - Added commands to discover and write Kubernetes
    configuration. experimental #6260
  - Masked sensitive data during debug bundle creation. #6364
  - Preserved user deselect-all route preferences across
    management syncs. #6363
  - Fixed state manager crashes caused by concurrent iptables map
    access. #6345
  - Added WebSocket relay fallback when QUIC datagrams exceed
    transport limits. #6339
  - Filtered DNS fallback upstreams matching NetBird server IPs
    to prevent loops. #6183
  - Preserved posture checks on configuration-only sync updates.
    [#6373]
  - Improved embedded client shutdown by canceling context before
    stopping the engine. #6397
  - Management Improvements
  - Added IPv6 default permit rules for exit node routes. #6368
  - Logged user agent information and returned request IDs. #6380
  - Added version gating to stop sending deprecated RemotePeers
    field. #6371
  - Fixed L4 service updates when no custom port is configured.
    [#6396]
  - Proxy Enhancements
  - Added non-blocking mapping updates. #6369
  - Improved certificate handling by notifying readiness for
    domains covered by static certificates. #6389
  - Switched proxy ID generation to UUIDs. #6391
  - Infrastructure & Tooling
  - Improved support for atomic Linux distributions in install
    scripts and fixed Docker-related issues in
    getting-started.sh. #6139
  - Updated the Go toolchain version in go.mod. #6377

++++ nlopt:

  - Update to version 2.11.0:
    * New CCSA and MMA parameters inner_gradients and always_improve
    (gh#stevengj/nlopt#623).
    * Various minor bugfixes (gh#stevengj/nlopt#637,
    gh#stevengj/nlopt#640).

++++ nvim-lspconfig:

  - Update to version 2.10.0:
    + fix: logic bugs found by AI
    + feat(dexter): add dexter LSP for large Elixir codebases
    + feat: improve emmylua_ls
    + feat: add support for hare-lsp
    + docs(emmylua_ls): fix config example
    + feat(harper_ls): add tex filetype
    + docs(emmylua_ls): fix docstring
    + docs: fix broken helptag
    + Attach zizmor languange server to action.yaml
    + feat: update oxfmt and oxlint to detect vite plus
    + feat: add shuck language server
    + fix(ruby-lsp): reuse_client issue in ruby lsp to avoid spawning extra LSP instances
    + fix(oxc): fix oxlint and oxfmt vite plus config search
    + fix(roslyn_ls): remove unnecessary code and recommend maintained plugin for razor
    + docs(roslyn_ls): add instructions to install the server as a dotnet tool
    + feat: slang-server
    + fix(flow): resolve project-local binary before npx fallback
    + fix(rescript): default parameters do not enable incremental typechecking
    + feat(jls): added jls config
    + feat(oxlint): check if tsgolint bin exists inside project
    + feat(gopls): semantic tokens enabled by default on client side
    + feat: cqlls
    + fix(emmylua_ls): move settings under emmylua section

++++ oc:

  - Update to version 4.22.0:
    * OCPBUGS-62799: Add required-scc annotation to node-joiner pod
    to prevent third-party SCC interference
    * claude: Split tester agent away from code-reviewer
    * Fix extraction of gated manifests using --install-config
    * NO-JIRA: Add feature gate changes to changelog JSON output
    (#2247)
    * NO-ISSUE: recover the context in upgrade
    * claude: Turn pr-review skill into code-reviewer agent
    * Address comments from review
    * Revert "TRT-2587: Revert #2219 "CNTRLPLANE-2769: Bump k8s
    dependencies to 1.35""
    * MCO-1961: Allow multiple machine-os image versions
    * Use the informing label to not block the release
    * must-gather: Handle signals properly
    * Revert "Merge pull request #2219 from ardaguclu/bump-1.35"
    * Revert "Merge pull request #2222 from
    JoelSpeed/update-release-extract-inclusion"
    * pkg/cli/admin/release/extract: Support zero-output extraction
    * Implement feature gate and major version extraction for
    manifest inclusion
    * pkg/cli/admin/release/extract: Read manifests into memory
    * Add e2e test for oc adm upgrade accept
    * OTA-1548: set up accepted risks
    * adm policy add-role-to-user: Fix --dry-run=server
    * Add .coderabbit.yaml and AGENTS.md configurations
    * Fixing manifest ci failure
    * RFE-7406: Include the K8s ingress resource in namespace inspect
    collection (#2004)
    * Update golang.org/x libraries to latest
    * Fix lifecycle_test failure
    * Skip new resources that do not have Describer
    * Update manifest Include signature
    * Bump openshift libraries
    * Bump some of other packages to keep up to date
    * Update metadata for Go 1.25 k8s 1.35
    * React to the changes coming from 1.35
    * Bump k8s 1.35.2
    * fix: reduce the amount of resources for debug pod
    * oc fips ci fix
    * pkg/cli/admin/release/mirror: Deprecate in favor of oc-mirror
    * images/tools/Dockerfile: Just install it and if it fails fall
    back to iotop-c
    * Allow periods in display name labels for version validation
    * pkg/cli/admin/upgrade/recommend/alerts: Add VMCannotBeEvicted
    * pkg/cli/admin/upgrade/recommend/alerts: Add
    openShiftUpdatePrecheck label
    * pkg/cli/admin/upgrade/recommend/alerts: Add
    VirtHandlerDaemonSetRolloutFailing
    * pkg/cli/admin/upgrade/recommend/alerts: Add KubeletHealthState
    * Update Dockerfile to work on CentOS/RHEL 10
    * OCPBUGS-76394: Ignore group ownership on rpm -V
    * Fix ns inspect when resource group is specified
    * inspect: Refactor to use sets.Set[string]
    * image extract: Use Explicit strategy for ICSP/IDMS
    * Makefile: Strip debugging symbols by default
    * images/tools: Install subscription-manager
    * fixing oc cli failures
    * OCPBUGS-76394: Install subscription-manager in cli image
    * Revert "CNTRLPLANE-2656: Fixing oc client cases for microshift
    and metal ipv6 profiles"
    * pkg/helpers: Print the right error object
    * CNTRLPLANE-2656: Add oc CLI e2e tests with OTE framework
    support
    * expose: Fix labels not being added to route
    * Revert "CNTRLPLANE-2656:Migrating oc cli tests to ote"
    * OSDOCS#18071: Updating CLI docs templates to include a required
    abstract/short description
    * removing bindata.go
    * Removed sos cases
    * Fix unit test failure by updating ruby version to 3.3
    * go.mod and vendor update
    * CNTRLPLANE-2167: Integrate OpenShift Test Extension (OTE)
    infrastructure
    * CNTRLPLANE-2167:Integrate OpenShift Test Extension (OTE) into
    oc
    * OTE extensin of oc
    * update go.mod and vendor
    * Bump library-go to update selinux and x/crypto
    * Updating ose-cli-artifacts-container image to be consistent
    with ART for 4.22 Reconciling with
    https://github.com/openshift/ocp-build-data/tree/087d1930e36b609f77d73bd8a313d85c940cff4d/images/ose-cli-artifacts.yml
    * Updating openshift-enterprise-deployer-container image to be
    consistent with ART for 4.22 Reconciling with
    https://github.com/openshift/ocp-build-data/tree/087d1930e36b609f77d73bd8a313d85c940cff4d/images/openshift-enterprise-deployer.yml
    * Updating ose-tools-container image to be consistent with ART
    for 4.22 Reconciling with
    https://github.com/openshift/ocp-build-data/tree/087d1930e36b609f77d73bd8a313d85c940cff4d/images/ose-tools.yml
    * Updating openshift-enterprise-cli-container image to be
    consistent with ART for 4.22 Reconciling with
    https://github.com/openshift/ocp-build-data/tree/087d1930e36b609f77d73bd8a313d85c940cff4d/images/openshift-enterprise-cli.yml
    * Bump docker/docker to 28.5.2 to drop dependency of
    containerd/containerd
    * oc login: Respect insecure flag from kubeconfig
    * fix(nodeimage): add PodSecurityContext to image creation and
    monitor pods

++++ octave:

  - Update to version 11.3.0:
  - Fix returning reciprocal condition number as second output
    from det for triangular dense matrices.
  - Changes from version 11.2.0:
    * Improvements and fixes:
  - Speed up pkg install and provide more output with -verbose.
  - cmach-info.h: Add visibility attribute to function
    declarations.
  - Re-implement weboptions and affected functions webread,
    webwrite (bug #68079).
  - Remove semicolon after function definitions.
  - Fix possible out-of-bound indexing in N-D Array assignment.
  - Allow classdef constructor to return a classdef array of
    itself (bug #59775).
  - Fix pager in CLI on Windows and disable it in the GUI (bug
    [#68112]).
  - Deprecate all and any for non-numeric/non-logical types (bug
    [#68172]).
  - Silence compiler warning about possible use of uninitialized
    variable.
  - Fix input validation of permB input to eigs().
  - Check floating point subscripts before converting to
    octave_idx_type (bug #68167). Reject non-finite,
    non-integer, and out-of-range floating-point index values
    before casting them to octave_idx_type.
  - Fix norm (S, 2) for all-zero sparse matrices (bug #68254).
  - colorbar.m: Change %!demo #3 to use new syntax with
    "location" first.
  - max: Avoid potential integer overflow.
    * GUI fixes:
  - Remove accidental double spaces in language translation
    files.
  - Use form of “bearbeiten” instead of “editieren” in German
    translation.
  - Include missing .svg icon in GUI resources (bug #68389).
  - Use mouse cursor shape from Qt if possible or SVG (bug
    [#68389]).
    * Build fixes and improvements:
  - Create Info documentation in build directory, not source
    directory.
  - Fix Qt help generator for Texinfo 7.3 Function-Index output.
  - Fix run-octave to locate documentation in either srcdir or
    builddir.
  - system: Silence output of self-test.
  - Disable delete warning locally in BISTs as part of cset e17e4e419245.
    * Documentation updates.

++++ openSUSE-release-tools:

  - Update to version 20260610.93957ea7:
    * gocd: Add TTM.Leap_16.0_Images

++++ patool:

  - update to 4.0.5:
    4.0.5 (released 18.05.2026)
    * [Security] Fix generation of files and directories outside
    the given extraction directory when extracting TAR (.tar) archives
    with the Python tarfile module for Python < 3.12.
    * [Feature] Expose the format option in CLI and API to bypass automatic
    format detection, ie. "patool list archive --format 7z".
    Thanks jpsnyder for the patch and pull request.
    4.0.4 (released 19.01.2026)
    * Do not propagate log messages.
    Thanks MatteoH2O1999 for the bug report and suggested fix.
    Closes: GH bug #187
    * Updated dev dependencies, now requires Python >= 3.12
    4.0.3 (released 11.12.2025)
    * Added support for FREEARC (.arc) archives. Peazip can create and extract these.
    * Set SOURCE_DATE_EPOCH to latest git commit date instead of zero.
    Fixes test failures on some platforms.
    Closes: GH bug #186
    * Updated dev dependencies
    4.0.2 (released 14.10.2025)
    * Allow stdin when interactive mode is requested.
    Closes: GH bug #184
    * Use the Python module "compression.zstd" for Python version >= 3.14 to
    extract and create ZSTD (.zst) files.
    * Updated dev dependencies
    * Replace pytype type checks with ty
    * Added Python 3.14 to the test matrix
    4.0.1 (released 02.05.2025)
    * Updated dev dependencies; support reproducible builds with setuptools_reproducible.
    * Fix command options for star.
    Thanks Robert-André Mauchin for the patch!
    4.0.0 (released 28.02.2025)
    * Detect and use archive programs from Peazip installations.
    Closes: GH bug #51
    * Require Python >= 3.11
    3.1.3 (released 15.02.2025)
    * Expand rar detection logic to all 7zip programs
    Thanks Alfred Wingate for the patch!
    * Detect if 7zip programs support COMPRESS (.Z) archives, since 7za 24.09 does not support it anymore.
    This fixes test errors on newer Ubuntu systems.
    3.1.2 (released 14.02.2025)
    * Add workaround for an error using uv publish.
    3.1.1 (released 14.02.2025)
    * Improved RAR support detection for the 7-Zip archiver.
    Closes: GH bug #175, #176
    * Enable file(1) detection of ALZ archives, and improved handling of RAR detection for file 5.46.
    Thanks Alfred Wingate for the patches!
    3.1.0 (released 19.11.2024)
    * Added support for UDF (.udf) archives with 7z.
    Closes: GH bug #80
    * The options --quiet and --verbose are now mutually exclusive options.
    * When --quiet is given twice, output on stderr from archive commands is
    suppressed. When using the API functions, set verbosity to -2.
    3.0.3 (released 04.11.2024)
    * Fix UnicodeDecode errors when logging, especially on windows systems.
    Closes: GH bug #170
    * Added support for WIM (windows image) archives with 7z.
    * If the MIME database cannot detect the file type, check again with a lowercase filenanme extension.
    * Use 7z option -aou to rename files when extracting instead of overwriting them.
    * Use rar option -or to rename files when extracting instead of overwriting them.
    * Use rar option -kb to keep files when extracting broken RAR archives.
    3.0.2 (released 21.10.2024)
    * When running in verbose mode (-vv), print mime and compression info.
    * Use official github command line client "gh" for releases.
    * Added type annotations.
    3.0.1 (released 06.10.2024)
    * Use more uv command to replace other build tools, ie. twine.
    * Add new --quiet option to suppress command output.
    * Document that Windows needs a file program to be able to determine file types without extensions.
    Closes: GH bug #152
    3.0.0 (released 25.09.2024)
    * When a program does not support a compression type, try to find other programs instead of failing.
    This changes some library functions which are not part of the official API, but might be used by
    other programs, hence the major version upgrade.
    Thanks to github user benjaminwinger for the idea and initial patch!
    Closes: GH bug #87
    * Better detection for tar programs which compression is supported.
    Closes: GH bug #86
    * The Python module "tarfile" supports LZMA and XZ compressed archives.
    Added tests for these archive formats (.tar.lzma and .tar.xz).
    * Do not print program output when running with verbosity=-1.
    Closes: GH bug #157
    2.4.0 (released 21.08.2024)
    * Document that patool extracts the archive for the search and repack commands.
    Closes: GH bug #154
    * Add supported_formats() API function listing supported formats and operations
    for each format.
    Idea and patch by github user nohr-ai, thanks!
    2.3.0 (released 26.06.2024)
    * Add linting check to github workflow CI.
    Idea and patch by sorairolake, thanks!
    * Format the python code with ruff, and
    add a check to github workflow CI.
    Idea and initial patch by sorairolake, thanks!
    Closes: GH bug #151
    * Support tar --zstd for extracting TAR archives compressed with ZSTANDARD.
    Closes: GH bug #162
    * Use locale.getpreferredencoding() instead of sys.stderr.encoding for
    logging output encoding.
    Closes: GH bug #158
    2.2.0 (released 14.02.2024)
    * Improved detection when running under pythonw.exe.
    Also fixes the output problems on Windows systems.
    Closes: GH bug #147, #142
    * Document API functions.
    2.1.1 (released 26.01.2024)
    * Added support for 7zz and 7zzs programs from the Linux-specific release
    of 7-Zip.
    Closes: GH bug #145
    2.1.0 (released 17.01.2024)
    * Document all functions and modules, and add linting rule for it.
    * Remove spaces between function and argument list
    Closes: GH bug #100
    * Log warnings when subprocesses in utility functions return errors
    that are ignored.
    * Fix a TypeError when using unar with passwords.
    Thanks to Kevin Matt for the patch.
    Closes: GH bug #144
    * Catch errors when using file --uncompress on system which do not support this.
    Closes: GH bug #141
    2.0.0 (released 14.11.2023)
    * Require Python >= 3.10
    * Use Python logging module instead of print() for diagnostic output.
    Diagnostic output of patool will now be printed on stderr instead of
    stdout.
    This change is the reason for the major version number increase.
    Closes: GH bug #37
    * Support the jar program to list and extract ZIP archives.
    * Do not use the -v option when extracting or testing ZIP archives
    with unzip, since -v lists files instead of printing verbose output.
    Closes: GH bug #49
    * Use the -sae option for 7z to use the provided archive name.
    Closes: GH bug #72
    * Add error message about temporary directory when extraction fails.
    Closes: GH bug #57
    * Removed the recompress command.
    * Use the new filter option when extracting TAR archives with the tarfile
    module in Python >= 3.12 to detect unsafe archive entries.
    * Added new command "patool version" to print version information.
    * Do not use maximum compression anymore, the default settings should
    be good enough for our standard use case.
    * Restore original file name for GZIP (.gz) archives.
    Closes: GH bug #67
    1.15.0 (released 28.10.2023)
    * Added support for LZ4 archives with the lz4 tool.
    Closes: GH bug #46
    * Use correct registry key flag for 32-bit Python on 64-bit Windows
    when detecting 7z.
    Closes: GH bug #35
    * Fix configuration for listing .bz2 and .bz3 archives.
    * Added support for the unar program which can extract a lot of
    archive formats, for example ZIP, RAR, 7Z, TAR, GZIP, BZIP2 etc.
    Closes: GH bug #39
    * Document how to enable bash completion.
    Closes: GH bug #127
    1.14.1 (released 26.10.2023)
    * Fix wrong option in bzip3, and add tests.
    Closes: GH bug #134
    * Create non-existing directories when using the --outdir option
    with patool extract.
    Closes: GH bug #117, #132
    * Ensure log output does not have a UnicodeEncodeError
    Closes: GH bug #122, #121, #52, #29
    * Don't open new console windows for subprocesses on Windows.
    Closes: GH bug #85
    * Use 7z to extract, list and test CHM (.chm) archives.
    Closes: GH bug #78
    1.14.0 (released 25.10.2023)
    * Test if tar supports --force-local on macOS systems.
    Closes: GH bug #125
    * Enable archive header encryption for 7z
    Thanks to Michael Serajnik for the initial patch.
    Closes: GH bug #102
    * Added support for BZIP3 archives with the bzip3 tool.
    Closes: GH bug #129
    * Fix Windows tar doesn't use --force-local
    Thanks to Jack Cherng for the patch.
    * Include tests data in the source distribution.
    Thanks to Alfred Wingate for the patch.
    1.13 (released 24.10.2023)
    * Added support for ZSTANDARD archives with the zstd tool.
    * Improved patool diff output: when two archives each have
    only one entry, compare those entries directly instead of
    the parent directory.
    * Replace deprecated distutils with setuptools to fix build errors
    with modern Python environments.
    Closes: GH bug #114, #103
    * Disable password prompting with 7z in non-interactive mode with
    the option "-p-".
    Thanks to Pascua Theus for the patch.
    * Disable sandbox mode for file(1) to fix detection of compressed tar
    archives on systems with libseccomp.
    Thanks to Alfred Wingate for the patch.
    * Remove read-only directories after a diff comparison of two archives.
    Thanks to c01o for the patch.
  - remove the bash-completion subpackage, as upstream no longer contains
    the files

++++ patterns-base:

  - only do Requires: libyui-ncurses-pkg and libyui-qt-pkg if
    Tumbleweed since libyui is no longer available in Leap 16.1

++++ perl-GD:

  - updated to 2.860.0 (2.86)
    see /usr/share/doc/packages/perl-GD/ChangeLog
    2.86    * Fix CVE-2026-11526, command injection via 2-arg open() in _make_filehandle.
    CWE-78, CWE-73 (Reported and fixed by Paul Johnson) bsc#1268240
    2.85    * Tolerate runtime TIFF decode failures in autodetect (GH #62)
    * Replace cpm with cpanm in github actions
    * Fixed a minor precedence bug in t/z_manifest.t
    2.84    * Added Makefile.PL --with and --without options to bypass autodetection
    errors or upstream libgd or subsequent library errors, as
    libtiff 4.5.1+git230720 wrongly packaged on ubuntu/debian (GH #55).
    * Better support MSWin32 without gdlib.pc. Requires manual --options and
  - -lib_gd_path.
    * Workaround broken ExtUtils::PkgConfig->find (GH #61)
    * Fixed snprintf for newer MSVC (>= VS 2015)
    * Added GD::Image::supported() image types method.
    * Added newFromTiffData() method.
    * Fixed t/GD.t for unsupported image types.
    * Add GIFANIM to the default since 2.0.33 (PeterCJ GH #56)
    * Honor PKG_CONFIG_PATH for finding gdlib.pc (PeterCJ GH #57)
    * Add demos/png2jpeg.pl

++++ perl-JSON-Validator:

  - updated to 5.190.0 (5.19)
    see /usr/share/doc/packages/perl-JSON-Validator/Changes
    5.19 2026-06-10T09:13:00
  - Fix OpenAPIv3 string coercion regression #298 #299
    Contributor: Archey Barrell
    5.18 2026-06-08T09:53:00
  - Bundle OpenAPI v3.0 schema 2021-09-28 as default #295, #286
    Contributor: Henrik Andersen
  - Fix nondeterministic false errors from the recursive_data_protection cache #272, #294
    Contributor: Henrik Andersen
    5.17 2026-06-04T22:32:00
  - Add validate Mojo::Upload as binary string in OpenAPIv3 #288
    Contributor: Archey Barrell
    5.16 2026-06-04T10:06:00
  - Use Mojo::File::spew instead of Mojo::File::spurt #281
    Contributor: Emmanuel Seyman
  - Updated dependency list #283
  - Use negotiated content-type to select schema #289
    Contributor: Archey Barrell
  - Updated idn-email format verification to allow periods in local part #290
    Contributor: Keith Carangelo
  - Add string as valid format #293

++++ perl-Test-Simple:

  - updated to 1.302220
    see /usr/share/doc/packages/perl-Test-Simple/Changes
    1.302220  2026-06-09 15:49:19-07:00 America/Los_Angeles
  - Add [PruneCruft] to dist.ini so build artifacts (blib/, pm_to_blib, MYMETA.*) no longer leak into release tarballs.
  - Remove Net::BitTorrent from broken list
  - Amend tests to adapt to more accurate line number reporting in core (#1080)

++++ pt2-clone:

  - Update to version 1.90
    * Audio code has been rewritten to mainly use 32-bit
    single-precision float instead of 64-bit double-precision
    float, for a possible performance gain on some platforms. The
    difference in audio quality shouldn't be audible (but is
    measurable).

++++ python-pyqtgraph:

  - Add patch skip-single-values-svgexport.patch:
    * Skip single values when exporting to SVG.

++++ python-agent-client-protocol:

  - Update to 0.10.1:
  - fix(examples): improve gemini.py CLI experience
  - fix: assign receive-loop attributes before spawning recv task
  - Update to 0.10.0:
  - fix: reject pending requests on EOF to prevent infinite hang
  - feat: bump acp protocol to 0.12.2
  - fix(schema): coerce string protocolVersion in
    InitializeRequest
  - fix: skip blank/whitespace lines in receive loop
  - feat: add receive_timeout parameter to Connection class

++++ python-django-rq:

  - Add upstream patch fix-job-id-test-failures.patch, to fix tests with
    latest python-req. gh#rq/django-rq@7aa920acd594

++++ python-eventlet:

  - Skip another test that raises a RuntimeError.

++++ python-jsonpath-python:

  - Update to 1.1.6:
  - Fixes
  - security: prevent regex filter injection (4973594)
  - Update to 1.1.5:
  - Fixes
  - Python 3.8 AST compatibility and ruff formatting (04199c5)
  - security: prevent RCE via eval() in filter expressions
    (#21, #20) (07e2c11)
  - Update to 1.1.4:
  - Fixes
  - docs: sync description with README (190ffce)
  - Update to 1.1.3:
  - Performance Improvements
  - use isidentifier() instead of regex in _build_path
    (3054ca4)
  - Update to 1.1.2:
  - Performance Improvements
  - pre-compile regex and refactor code structure (70b0103)
  - Update to 1.1.1:
  - Performance Improvements
  - optimize regex compilation and add performance test suite
    (61152d7)
  - Update to 1.1.0:
  - Fixes
  - modernize project structure and fix path output (#7)
    (7713759)
  - resolve issue #10 by raising JSONPathTypeError on mixed
    type sorting (8ac2080)
  - resolve issue #15 where filters with bracket notation
    returned empty results (100bf6f)
  - resolve issue #16 support quoted keys in filters and paths
    (6caa9d4)
  - resolve issue #17 false positive errors and parsing bugs
    (47bba25)
  - resolve issue #9 by filtering out missing keys in field
    extractor (5e38031)
  - Features
  - add search and complie interfaces (8dcf854)
  - add update function to JSONPath class (#12) (d396bc5)
  - Custom eval implementation (22d7154)
  - resolve issue #13 by adding support for 'in' operator and
    regex matching (=~) (a5e2973)

++++ python-posthog:

  - Add missing BuildRequires on opentelemetry-exporter-otlp-proto-http.

++++ salt:

  - Fix ImportError during reentrant SIGTERM shutdown
  - Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
  - Added:
    * fix-importerror-during-reentrant-sigterm-shutdown.patch
    * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch

++++ salt-test:

  - Fix ImportError during reentrant SIGTERM shutdown
  - Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
  - Added:
    * fix-importerror-during-reentrant-sigterm-shutdown.patch
    * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch

++++ python-sortinghat:

  - Add patch use-django-rq-commit-mode.patch to fix tests with
    python-django-rq >= 4.0

++++ scite:

  - Update to version 5.6.3:
    * Sync with scintilla 5.6.3; no scite specific code changes.
  - Changes from version 5.6.2:
    * Fix spurious error message when an untitled buffer has a
    filter command executed on it. Bug #2504.
  - Changes from version 5.6.1:
    * For GTK, replace deprecated or removed function
    gdk_pixbuf_new_from_xpm_data. Bug #2498.

++++ scribus:

  - Add upstream change:
    * scribus_poppler_26_06_0.patch

++++ shotwell:

  - Update to version 0.32.17:
    + Fix issue with Flicker and non-latin titles

++++ skaffold:

  - Update to version 2.22.0:
    * fix: restore Go and gRPC versions in Spanner bootstrap example
    (#10102)
    * chore: upgrade Go version to 1.26.4 (#10100)
    * chore: bump the golang group across 1 directory with 13 updates
    (#10099)
    * chore!: updating docker to moby and drop native Windows
    buildpacks support(#10096)
    * chore: bump github.com/containerd/containerd from 1.7.31 to
    1.7.32 (#10093)

++++ step-cli:

  - update to 0.30.6:
  - bump for the build pipeline
  - update to 0.30.5:
  - Fix release workflow to work with immutable releases setting
    (#1650)
  - update to 0.30.4:
    Mostly updating dependencies. For the whole list see:
    https://github.com/smallstep/cli/releases/tag/v0.30.4

++++ talhelper:

  - Update to version 3.1.11:
    * docs: update CLI reference documentation (#1638)
    * chore(container): update alpine docker tag to v3.24.0
    * chore(deps): update dependency siderolabs/talos to v1.13.4
    * chore(container): update ghcr.io/siderolabs/talosctl docker tag
    to v1.13.4
    * chore(schema): update talos-extensions.yaml JSON schema
    * fix(deps): update module golang.org/x/mod to v0.37.0
    * chore(github-action): update renovatebot/github-action action
    to v46.1.15
    * chore(schema): update talos-extensions.yaml JSON schema
    * chore(schema): update talos-extensions.yaml JSON schema
    * fix(deps): update module github.com/gookit/validate to v1.6.0
    * chore(github-action): update actions/checkout digest to df4cb1c
    (#1627)
    * chore(github-action): update actions/checkout action to v6.0.3
    * chore(flake): update flake
    * fix(deps): update module github.com/siderolabs/image-factory to
    v1.3.3
    * feat(readme): thank you @parzival-space for the sponsor!
    * chore(schema): update talos-extensions.yaml JSON schema (#1623)
    * chore(schema): update talconfig.yaml JSON schema (#1622)
    * fix(test): propagate the now required k8s version to test
    * feat(genconfig)!: `kubernetesVersion` is now a required field
    * fix(test): there's new validation made upstream
    * feat(genconfig): `secretboxEncryptionSecret` now have its own
    document
    * fix(code): changes in upstream API
    * fix(code): upstream API changes
    * fix(deps): update module
    github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.1
    * chore(schema): update talos-extensions.yaml JSON schema (#1621)
    * docs: update CLI reference documentation (#1620)
    * chore(deps): update dependency siderolabs/talos to v1.13.3
    * chore(container): update ghcr.io/siderolabs/talosctl docker tag
    to v1.13.3
    * fix(deps): update module github.com/siderolabs/image-factory to
    v1.3.2
    * chore(container): update goreleaser/goreleaser docker tag to
    v2.16.0
    * chore(schema): update talos-extensions.yaml JSON schema (#1618)
    * chore(schema): update talos-extensions.yaml JSON schema (#1612)
    * chore(schema): update talos-extensions.yaml JSON schema (#1611)
    * chore(schema): update talos-extensions.yaml JSON schema (#1610)
    * chore(schema): update talos-extensions.yaml JSON schema (#1609)
    * fix(deps): update module github.com/google/go-containerregistry
    to v0.21.6
    * chore(container)!: Update
    ghcr.io/devcontainers/features/docker-in-docker Docker tag to
    v3
    * feat(genconfig): also handle VIP inside VLAN
    * chore(container): update
    mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest
    to de99286 (#1606)
    * chore(schema): update talos-extensions.yaml JSON schema (#1604)
    * fix(deps): update module github.com/getsops/sops/v3 to v3.13.1
    * chore(container): update ghcr.io/getsops/sops docker tag to
    v3.13.1
    * chore(schema): update talos-extensions.yaml JSON schema (#1601)
    * fix(deps): update module github.com/siderolabs/image-factory to
    v1.3.1
    * fix(deps): update module github.com/budimanjojo/talhelper/v3 to
    v3.1.10
    * chore(schema): update talos-extensions.yaml JSON schema
    * feat: update Scoop for talhelper version v3.1.10
    * feat: update flake (#1596)

++++ teleport:

  - update to 17.7.25:
    * Fixed minor formatting bug on tsh request show output. #67446
    * Prevented ssh users from being able to cancel other users'
    remote port forwards. #67443
    * Updated Go to 1.25.11. #67422
    * Fixed "error gathering metrics" log spam. #67352

++++ tempo-cli:

  - Update to version 3.0.2:
    * Security
  - deps: Build Tempo with Go 1.26.3, which includes upstream
    security and bug fixes. (#7423) (@ie-pham)
    * Dependencies
  - chore(deps): update grafana/tempo-ci-tools docker tag to
    v20260527 (#7401)
  - chore(deps): update golang docker tag to v1.26.3 (#7400)

++++ topgrade:

  - Update to version 17.6.1:
    * chore: release v17.6.1 (#2085)
    * chore: release v17.6.0 (#2070)
    * fix(needrestart): skip if hooks already run it (#2066)
    * chore(pre-commit): autoupdate (#2079)
    * chore(deps): update vmactions/openbsd-vm action to v1.4.3 (#2071)
    * chore(deps): update github/codeql-action action to v4.36.2 (#2073)
    * chore(deps): lock file maintenance (#2078)
    * chore(deps): lock file maintenance (#2061)
    * chore(deps): update vmactions/openbsd-vm action to v1.4.2 (#2054)
    * chore(deps): update rust to v1.96.0 (#2058)
    * chore(deps): update github/codeql-action action to v4.36.1 (#2069)
    * chore(deps): update actions/checkout action to v6.0.3 (#2068)
    * chore(pre-commit): autoupdate (#2064)
    * chore(pre-commit): autoupdate (#2053)
    * chore(deps): update github/codeql-action action to v4.36.0 (#2047)
    * chore(deps): update vmactions/openbsd-vm action to v1.4.1 (#2051)
    * chore(deps): lock file maintenance (#2052)
    * feat(vim): add opt-in vim.pack pruning (#2044)
    * refactor: improve path handling in config, node steps, and build (#2015)
    * fix(tmux): update path to tpm update script (#2050)
    * fix(jetbrains-toolbox): skip step when Toolbox is not installed, but remotely managed IDEs are installed (#2038)
    * fix(jetbrains-toolbox): fix breakage on new Toolbox version by switching to different update finished line (#2039)

++++ tpm2-pkcs11:

  - Use pyproject macros to build and install the tools.

++++ ucode-amd:

  - Update to version 20260610 (git commit e7eb98afc667):
    * Move firmware licenses to a LICENSES/ directory

++++ werf:

  - Update to version 2.70.0:
    * Features
  - cleanup: add --kube-scan-namespaces support for in-cluster
    scan (#7517) (8941a1e)
    * Bug Fixes
  - build: eliminate redundant registry tag listing in post-build
    metadata publication (#7559) (27404cb)
  - Update to version 2.69.1:
    * Bug Fixes
  - build, stapel: handle platform mismatch in stage base image
    resolution and avoid panic (#7493) (cdf0e83)
  - cleanup: failing for cross-account ECR repositories (37c636c)
  - Update to version 2.69.0:
    * Features
  - host-cleanup: add support for absolute storage units
    (c5dbdd0)
    * Bug Fixes
  - build, stapel, import: orphan import-server containers after
    cancellation (#7527) (5c75bea)
  - build, stapel, import: unnecessary image rebuilds when using
  - -secondary-repo with imports (#7526) (915a403)
  - host-puge, buildah: fix panic in "host purge" when running in
    buildah mode (a3ae3df)
  - build: freezing on random image (#7539) (6cf58b7)
  - ci-env: ci-env ignores session docker config when
    WERF_DOCKER_CONFIG is set (#7530) (5161412)
  - host-cleanup: fix absolute volume usage unit parsing logic
    (0e3f5d6)
  - host-clenaup: prevent overflow while subtraction (math)
    (544c423)

++++ wxMaxima:

  - Update to version 26.06.1:
    * Fix syntax errors caused by sending duplicate/consecutive
    command delimiters to Maxima by filtering out delimiter-only
    commands and correctly handling unicode non-breaking space
    characters during ending checks.
    * Fix a rare access violation (crash) when activating or
    clicking on an EditorCell that has a null or detached group
    cell pointer.
    * Fix mouse capture lost warning messages by correctly marking
    mouse capture loss events as handled in the table of contents
    and worksheet.
    * Fix the error status being immediately replaced by "awaiting
    input" on the status bar and taskbar when Maxima encounters an
    error.
    * Fix layout recalculation of images and plots when window
    height changes (e.g. at startup or on vertical resizing).
    * Fix duplicate evaluation triggers (sending known answers
    twice) when Maxima questions are received in multiple chunks.
    * Fix scroll position tracking: call
    ScrolledAwayFromEvaluation(true) when the user manually
    scrolls so that the active cell is completely outside the
    visible portion of the worksheet.
    * Fix inserting a new cell (via hCaret) on large worksheets
    causing the scroll range to shrink to the first screen and the
    view to jump to the top.
  - Changes from version 26.06.0:
    * Optimize drawing during mouse moves (bracket autohide): redraw
    only the actual height of the cell, rather than drawing all
    the way to the absolute bottom coordinate.
    * Change the "Jump to first error" menu item to "Jump to last
    error" and fix its implementation to scroll to the most recent
    error cell.
    * Fix handling of to_lisp() and (to-maxima).
    * Fix redundant Maxima process spawns when opening worksheets
    and in batch mode.
    * A Diff Viewer that compares two wxmx files from the same
    origin that were saved with this wxMaxima version or newer.
    * Fix startup keyboard focus: The worksheet now correctly gains
    focus on application start.
    * New wx_matrix() command for advanced matrix formatting (lines,
    headers, custom brackets).
    * Persistent matrix formatting: Style flags are now saved within
    the matrix object.
    * Major XML performance optimization: Faster worksheet loading
    via hash-based attribute filtering.
    * Improved XML integrity: Automated validation tests to prevent
    duplicate attributes and malformed files.
    * Windows Accessibility: Fixed several bugs in the wxAccessible
    implementation for better screen reader support.
    * Script rendering: Fixed issues where complex
    subscripts/superscripts would flatten into standard
    subscripts.
    * High-DPI: Optimized SVG rendering and resolved redundant
    resource requests.
    * Editor performance: Optimized drawing by rendering only
    visible text tokens.
    * Non-interactive mode: Automated tests now skip most blocking
    modal dialogues.
    * The log now contains errors maxima encountered.
    * Many improvements to the Doxygen documentation.
    * Fix the cursor position after autocompletion (#2090).
    * Fix XML for saving as wxmx, when Maxima warnings are displayed
    (#2092).
    * Fix XML output for definite integrals. It was saved without
    the limits.
    * Resolved a Crash on encountering some integrals (#2095)
    * A complete overhaul of the worksheet's layout and display
    engine.
    * Opening <file.wxmx>#UUID opens the file and scrolls to the
    Group with that UUID
    * Many stability improvements, most of these AI-driven (#2072,
    [#2061])
    * The size of subscripts is now calculated correctly
    * The table of contents can now show section numbers
    * Massive improvement of the search within the worksheet
    * Ctrl+G now interrupts the current command again on MS windows
    * Reduced the time windows in which wxMaxima blocks because it
    is processing data
    * Fixed a deadlock when closing the application while background
    autocompletion tasks were running.
    * Fixed a bug where finding an item in an output cell didn't
    trigger a scroll to the found item.
    * Fixed a bug where text from long output cells couldn't be
    selected if the beginning of the cell was scrolled out of view
    (#2069)
    * MS Windows: The "maxima is running" indicator should now work
    correctly
    * HI-DPI improvements
    * A few Autocompletion fixes
    * Better SVGZ support
    * Some fixes for selection of output
    * Improved MathML and RTF output
    * Big find-and-replace functionality additions
    * A compiler supporting C++20 is required now
    * Files opened by double-clicking now have a consistent layout
    * Added automatic tests and repaired others.

++++ xournalpp:

  - Update to version 1.3.5:
    * Fixed crash when exiting after playing sound.
    * Fixed some button-to-tools configuration issues.
    * Fixed crash involving page background selection.
    * Added multidevice support for X11 palm rejection.
    * Reduced PDF cache retention for off-screen pages.
    * Fixed moving display when selecting "Fit to Screen".
    * Fixed disabled "Merge layer" menu entry.
    * Fixed a concurrency crash when using layers.
    * Fixed typos in some displayed strings.
    * Fixed "Missing background" display when missing PDF page.
    * Updated translations.

++++ xrdp:

  - Update sesman.ini:
    + Introduce MaxDisplayNumber=1000 to support SUSE large
    X11DisplayOffset=200
  - Update xrdp.ini:
    + Align the logo section with the latest upstream
  - Rebase patches:
    + xrdp-support-KillDisconnected-for-Xvnc.patch
    + xrdp-avahi.diff
  - Drop upstreamed patches:
    + xrdp-systemd-services.patch
    + xrdp-Moved-initgroups-call-to-before-auth_start_session.patch
    + xrdp-Add-function-to-get-user-information-by-UID.patch
    + xrdp-fix-username-in-env.patch
  - Update to version 0.10.6:
    + Security Fixes
    * Resolved CVE-2026-32105, CVE-2026-32107, CVE-2026-32623,
    CVE-2026-32624, CVE-2026-33145, CVE-2026-33516,
    CVE-2026-33689, and CVE-2026-35512.
    + Drop upstreamed patches
    * xrdp-CVE-2026-35512.patch
    * xrdp-CVE-2026-32624.patch
    * xrdp-CVE-2026-32107.patch
    * xrdp-CVE-2026-32623.patch
    * xrdp-CVE-2026-33145.patch
    * xrdp-CVE-2026-33689.patch
    * xrdp-CVE-2026-32105-1-fips-slowpath.patch
    * xrdp-CVE-2026-32105-2-fips-fastpath.patch
    * xrdp-CVE-2026-32105-3-nonfips-slowpath.patch
    * xrdp-CVE-2026-32105-4-nonfips-fastpath.patch
    + New Features
    * Added support for xorgxrdp bug fixes
    neutrinolabs/xorgxrdp#249 and neutrinolabs/xorgxrdp#342
    (#3721).
    + Bug Fixes
    * Honour pass_shell_as_env setting only if the user
    explicitly sets a shell (#3725).
    * Blocked attempts to create a NULL authentication file
    when utilizing VNC over UDS (#3727).
    * Corrected layout alignment issues with the Brazilian
    ABNT2 keyboard mapping (#3728, #3736).
    * Addressed a 'file exists' installation block when
    overwriting an existing xrdp setup (#3780).
    + Changes for Packagers or Developers
    * The unfinished PIV smartcard support is now disabled by
    default due to potential security risks; it can be
    manually re-enabled via --enable-smartcard for
    non-production environments (#3759).
    + General & Deprecations
    * The use_vsock parameter in xrdp.ini is deprecated. Use
    'port=vsock://' instead.
  - Changes since 0.10.1:
    + Update to version 0.10.5:
  - Security Fixes
    * Resolved CVE-2025-68670: Fixed improper bounds checking
    on domain string lengths to prevent stack-based buffer
    overflows.
  - New Features
    * Added support for running the xrdp daemon completely
    unprivileged via the service manager (#3599, #3603).
    * Enabled recording of TLS pre-master secrets to
    facilitate easier network packet captures (#3617).
    * Added FuseRootReportMaxFree parameter to mitigate 'no
    free space' computation bugs in various file managers
    (#3639).
    * Allowed alternate shell names to be passed to startwm.sh
    via environment variables for tighter system policy
    controls (#3624, #3651).
    * Updated fallback Xorg path hooks in sesman.ini to
    support newer Linux distributions (#3663).
    * Integrated a Slovenian keyboard layout mapping (#3668,
    [#3670]).
    * xrdpapi: Introduced a native binding hook to monitor
    session connection and disconnection events (#3693).
  - Bug Fixes
    * Allowed empty X11 UTF8_STRING blocks to be copied and
    pasted to the clipboard system (#3580, #3582).
    * Patched a v0.10.x regression that broke connections to
    VNC servers lacking ExtendedDesktopSize encoding support
    (#3540, #3584).
    * Fixed a v0.10.x regression impacting PAM group
    evaluation logic (#3594).
    * Resolved protocol inconsistencies with the [MS-RDPBCGR]
    specification block (#3608).
    * Cleaned up uninitialized data references inside the
    verify_user_pam_userpass.c module (#3638).
    * Fixed intermittent daemon crashes triggered when the RFX
    encoder is actively resized (#3590, #3644).
    * Corrected a GFX engine regression that disrupted proper
    operation of the JPEG encoder sub-system (#3649).
    * Fixed a file management regression where the xrdp PID
    file was unexpectedly deleted (#3650).
    * Ensured VNC ports specified directly by the user are not
    overwritten when bypassed by sesman (#3674).
    * Fixed a 0.9.x regression where connections failed if the
    FreeRDP client passed the /workarea parameter (#3618,
    [#3676]).
    * Corrected a crash occurring when a display resize event
    is triggered while drdynvc is disabled (#3672, #3680).
    * Fixed getgrouplist() compatibility to ensure successful
    compilation on macOS environments (#3575).
    * Addressed various static analysis warnings raised by
    Coverity (#3656) alongside documentation tweaks (#3665).
  - Internal Changes
    * Cleared an unnecessary sys/signal.h header include that
    triggered compilation warnings on MUSL-C toolchains
    (#3679).
    + Update to version 0.10.4.1:
  - Bug Fixes
    * Fixed a critical regression that prevented xorgxrdp
    v0.10.4 backend pairings from functioning properly with
    this version release (#3561).
    + Update to version 0.10.4:
  - New Features
    * Introduced the vmconnect configuration parameter in
    xrdp.ini to expose additional virtualization security
    tracking features when operating inside Hyper-V virtual
    environments (#3524).
    * Integrated Latvian keyboard layout support (#3511,
    [#3519]).
  - Bug Fixes
    * Refined systemd initialization detection logic on
    Debian-derived operating systems (#3497, #3502).
    * Resolved an interoperability bug where xrdp sessions
    failed when brokered by Quest/OneIdentity Safeguard for
    Privileged Sessions (#3498, #3507).
    * Fixed a startup race condition inside chansrv that
    prevented the service from being cleanly terminated on
    exit (#3482).
    * Addressed a potential double-free hazard present during
    chansrv exit routines (#3546).
    * Rectified several Coverity-identified static analysis
    warnings (#3508).
  - Internal Changes
    * Upgraded the embedded TOML-C99 parser dependency to the
    latest upstream state (#3530).
    + Update to version 0.10.3:
  - General Announcements & Core Behavioral Shifts
    * Introduced experimental utmp/wtmp session tracking
    support. Actions are logged solely during session
    creation/destruction.
  - New Features
    * Added configuration support to explicitly declare the
    thread pool count assigned to the x264 compression
    encoder (#3366, #3367).
    * Provided a mechanism to substitute colon characters (:)
    passed inside client share names with alternate
    characters (#3389).
    * Integrated a Hungarian keyboard layout configuration
    mapping (#3424, #3430).
    * Optimized keyboard fallback routing structures inside
    xorgxrdp to handle complex multi-variant maps like
    Brazil ABNT2 (#3478).
    * Introduced a more secure 'Xvnc over Unix Domain Socket'
    session mode for Enterprise FIPS environments (#3453).
  - Bug Fixes
    * Resolved several memory leak conditions (#3380, #3388).
    * Implemented error handling path fixes for environments
    containing a mis-installed or broken openh264 encoder
    binary (#3405, #3432).
    * Mitigated FIPS-compliant enterprise configuration errors
    (Bug #2518) via the introduction of the new Unix Domain
    Socket session architecture (#3453).
    * Fixed a FreeBSD specific conflict where xrdp occasionally
    attempted to claim display IDs already utilized by
    active SSH X11-forwarding sessions (#3381, #3456).
    * Fixed Coverity engine warnings (#3411, #3423) and
    updated project documentation (#3403).
  - Internal Changes
    * Bumped the FreeBSD CI validation matrix platform up to
    14.2 (#3427).
  - Changes for Packagers or Developers
    * Added configuration capability to customize the exact
    subdirectory location for configurations (#3369).
    * Packagers must explicitly append the --enable-utmp
    compile flag to enable the experimental utmp framework
    features.
    + Update to version 0.10.2:
  - Highlights
    * H.264 Graphics Remoting: Officially introduced H.264
    video stream graphics compression encoding, substantially
    lowering bandwidth utilization.
    * Unprivileged Daemon Operation: Officially enabled support
    to isolate the main xrdp daemon execution block under a
    distinct, unprivileged user account.
  - New Features
    * Allowed FUSE filesystem mount configurations to execute
    direct I/O routines, bypassing the kernel block cache
    layer (#3260).
    * Enabled compliant remote clients to entirely skip
    virtual channel join handshakes (#3282).
    * Added discrete frame capture interval configuration
    items inside xrdp for both H.264 and RFX codecs
    independently (#3317).
    * Added statvfs system call passthrough capabilities on
    the FUSE storage layer backend (#3304).
    * Allowed packagers to define a custom target log path
    for the chansrv file logger (#3344).
    * Integrated Czech keyboard layout support (#3348, #3358).
  - Bug Fixes
    * Enhanced the channel redirector pipeline by removing
    rigid filename length caps and improving compatibility
    hooks for FreeRDP clients (#3165, #3194).
    * Fixed an accounting bug that led to misreported graphic
    cache allocation limits (#3212).
    * Clarified the inline documentation descriptions for the
    Policy variable inside sesman.ini (#3235).
    * Repaired a regression that broke connection pathways
    targeting non-resizable VNC environments (#3242).
    * Patched a chansrv functionality breakage affecting
    standalone VNC sessions, introduced during the socket
    directory transition (#3283).
    * Corrected AltGr modifier mapping behaviors on standard
    Spanish keyboard layouts (#3313).
    * Resolved a FUSE layer conflict preventing the KDE Dolphin
    file manager from successfully writing files back onto
    mapped client drives (#3300).
    * Added explicit packaging inclusions for pam_limits.so on
    Debian and downstream targets (#3347).
  - Internal Changes
    * Updated internal CI code quality engines: cppcheck to
    v2.15.0 and astyle to 3.4.14 (#3232, #3309, #3314).
    * Dropped the legacy xrdp_sec_in_mcs_data() internal
    function block (#3273).
  - Changes for Packagers or Developers
    * Modified the build sequence so xrdp.ini and sesman.ini
    macro substitutions occur dynamically during compiling
    (#3187, #3188).
    * Elevated the baseline libfuse requirement to versions
    strictly greater than > 3.1.0 (#3284).
    + Update to version 0.10.1:
  - Security Fixes
    * Unauthenticated RDP security scan finding / partial auth
    bypass (no CVE).
  - New Features
    * Allowed client connection quality properties to
    dynamically dictate selected GFX-RFX lossy compression
    levels (#3183).
  - Bug Fixes
    * Fixed a regression inside the creation loop of the
    chansrv FUSE directory hierarchy (#3088).
    * Added missing systemd dependency entries targeting
    network-online.target (#3088).
    * Resolved a session listing processing race that caused
    improper display allocations (#3088).
    * Patched a memory fault (SEGV) caused during active GFX
    display resizing actions (#3088).
    * Resolved tracking bugs associated with the US Dvorak
    keyboard layout specification (#3088).
    * Fixed a regression preventing clipboard image payloads
    from being pasted into LibreOffice sheets and documents
    (#3102, #3120).
    * Corrected a GFX negotiation failure condition when the
    max_bpp parameter configuration was set too low (#3118,
    [#3122]).
    * Fixed a coordinate placement bug causing multi-monitor
    GFX displays to misalign upon minimize or maximize
    actions (#3075, #3127).
    * Fixed missing file inclusion targets within release
    packaging tarball generation routines (#3149, #3150).
    * Corrected logical processing for the session selection
    assignment rule when set to policy 'I' (#3167, #3171).
    * Cleared an unneeded licensing handshake phase that
    caused handshake interruptions for FIPS-compliant RDP
    clients (#3132).
    * Extended maximum resolution display limitations to allow
    client screens wider than 4096 pixels (#3083).
  - Internal Changes
    * Bumped the base FreeBSD automated regression testing
    platform instance to 13.3 (#3088).

++++ ytree:

  - Update to version 2.13
    * Add Haiku OS support
    * Minor bugfixes.

------------------------------------------------------------------
------------------  2026-6-9  -  Jun 9 2026  -------------------
------------------------------------------------------------------

++++ Fragments:

  - Add ix86 to ExcludeArch, transmission is no longer built for that
    arch.

++++ MozillaFirefox:

  - Mozilla Firefox 151.0.4
    * Fixed an issue where Firefox could fall back to software
    rendering on some older GPUs, reducing graphics performance
    (bmo#2043249)
    * Fixed an issue where some text input fields could incorrectly
    show a resize handle (bmo#2044051)

++++ afl:

  - updated to 5.00c
    ! AFL++ is now an AGPL 3.0 project !
    ! Files where the license could be switched were moved to AGPL 3.0+, files
    that were under Apache 2.0 with contributations stay on that license.
    ! Commercial license (donate to a good cause - no money for AFL++) is available
  - Switched https://github.com/AFLplusplus/cov-analysis for outdated afl-cov
  - MacOS most current version support for afl-fuzz, afl-cc (incl. LTO) and
    frida mode!
  - Refreshed FreeBSD support by jsaunders-rr, thanks!
  - Linux persistent mode uses futex now which increases speed and reduces
    system call overhead (opt out with AFL_FAST_CHILD_SYNC), thanks to
    @martinus for most of the implementation!
  - afl-fuzz:
  - `-I tool` call now receives the new crash as a command line parameter
  - changed to a better map classifier
  - frameshift is disabled now if AFL_CUSTOM_MUTATOR_ONLY is set
  - python module fixes
  - minor speed, leak and zombie enhancements
  - stability info was lost on fast resume - fixed
  - somewhere we removed .state/variable/... now it is back :-)
  - afl-cc:
  - Add LLVM 23 support
  - LTO and PCGUARD: new `AFL_LLVM_PATH` (also `AFL_LLVM_LTO_PATH` /
    `AFL_LLVM_PATH_MODE`) Ball-Larus per-function path coverage on top
    of edge coverage. Three levels: `=1` relaxed (collapse all
    guard-only BBs), `=2` restricted (collapse only 2-successor
    guard-only BBs), `=3` strict Ball-Larus. LTO additionally composes
    with `AFL_LLVM_LTO_CALLER`. See
    instrumentation/README.llvm.md and instrumentation/README.lto.md.
  - Fixes in the PCGUARD and LTO instrumentation that could lead to sanitizer
    triggers in target binaries
  - new instrumentation: `afl-llvm-bug-pass.so` provides five runtime
    oracles (SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, SLACK) plus a slice-
    filter sub-mode for SCALAR, covering arithmetic-bound and logical-
    OOB bugs that ASan misses (CVE-2023-4863 / libwebp-Huffman class).
    Note: ALLOCSIZE/DERIVE are disabled automatically under
    AFL_USE_ASAN to avoid double-instrumentation; see
    docs/env_variables.md.
    * `AFL_LLVM_BUG_SCALAR=1`   - max-value-per-arithmetic-site coverage,
    plus per-loop iteration count
    * `AFL_LLVM_BUG_SCALAR_SLICE=1` - restrict SCALAR instrumentation to
    arithmetic that flows into a memory-
    size sink (allocator size, GEP index,
    memcpy/memset length). Implies SCALAR.
    * `AFL_LLVM_BUG_BUDGET=1`   - check `ptr += func()` write-extent
    contract
    * `AFL_LLVM_BUG_SIZEFILL=1`  - check NULL-means-size-only idioms
    * `AFL_LLVM_BUG_ALLOCSIZE=1` - track every malloc/calloc/realloc and
    feed three signals (headroom IJON-min,
    proximity-bucket coverage edge, soft-OOB
    tripwire) per in-loop store
    * `AFL_LLVM_BUG_SLACK=1`    - per-icmp |op0-op1| feedback, mapped
    MIN-style onto the bug map (inverse-
    bucket) for tight-comparison signal
    * `AFL_LLVM_BUG_ALLOCSIZE_FUNCS=Name1,Name2,...` - extend tracking
    to user-listed custom allocators
    * `AFL_LLVM_BUG_ALLOCSIZE_FREE_FUNCS=Name1,Name2,...` - matching
    custom-free functions for the above
    * `AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1` - log tracked allocation sizes
    into CmpLog RTN slots for `-l Z`
    * `AFL_LLVM_BUG=1`           - enable all bug-pass modes
    Per-site bug-map slots are kept in a private MAP_SIZE_BUG region and
    tracked max-rule (compatible with the IJON model)
  - cmplog scheduling extensions (companion to bug-pass):
    * `-l M` (afl-fuzz) - predicate-tightness scheduling. Treat any
    new per-site minimum slack on an inequality CmpLog cmp as a
    coverage event and mark the queue entry favoured. Catches the
    libwebp-1.3.1 / CVE-2023-4863 input pattern (validation
    predicates simultaneously at their tight edges).
    * `AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1` or `AFL_LLVM_BUG=1`
    (compile-time) and
    `-l Z` (afl-fuzz) - size-derive logging. On every freed tracked
    allocation, write `(computed_size, max_observed_offset)` into a
    CmpLog RTN slot keyed by alloc-site. The existing CmpLog
    dictionary mining harvests `computed_size` as a magic constant
    and feeds the producing input bytes back into havoc.
  - afl-cmin*:
  - nyx_mode is now working for all minimizer variants
  - afl-showmap:
  - no more .afl-showmap-temp-* files lying around
  - IJON dist was changed to original IJON implementation: initial matching
    bytes, max length is 1024
  - lib* tools:
  - MacOS support is back, thanks to @Jay-1409 !

++++ agama:

  - Improve tasks management: code refactoring, fix scope of zFCP and
    DASD tasks, emit TaskAdded event, avoid iSCSI blocking, manage
    storage reprobing (related to bsc#1266276).

++++ agama-web-ui:

  - Improve retry popup when failed to load unattended profile. It
    now allows to change URL and also improve its UX.
    (gh#agama-project/agama#3589)
  - Fix detection of task changes (related to bsc#1266276).
  - Add dark and high-contrast styles, enabling per-product branding
    (gh#agama-project/agama#3604, jsc#PED-14955).

++++ agama-yast:

  - Avoid running DASD formatting in a separate thread (related to
    bsc#1266276).

++++ aliyun-cli:

  - Update to version 3.3.22
    * {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)
  - from version 3.3.21
    * {Configure} Match policy rules against the command users actually type
    for ROA by @AllyW in (#1344)
  - from version 3.3.20
    * {OpenAPI} Add call context logging by @AllyW in (#1342)
  - from version 3.3.19
    * [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
    * feat(appmanager): Generalized PrepareEnv credential pass-through
    supports multiple authentication modes by @mengjunwei-mjw in (#1341)
  - from version 3.3.18
    * Improve CMS2 command descriptions and clarify exception
    return codes by @tingbin-ctb in (#1337)
    * feat(iact3): add iact3 subcommand with manual upgrade
    by @xiao201208 in (#1336)
    * Add kmscli command by @oobujieshi in (#1340)
  - from version 3.3.17
    * {Plugin} Support lang and profile from flag for plugin
    execution by @AllyW in (#1330)
    * Computenest pypi venv by @mengjunwei-mjw in (#1331)
    * feat: add codeup-cli subcommand for migrating third-party
    code repos by @imu2008 in (#1335)
  - from version 3.3.16
    * Optimize error messages by @CodeSpaceiiii in (#1327)
    * {Openapi} Return InvalidApiError for unknown API on
    restful products by @AllyW in (#1326)
    * feat(acrutil): Add Alibaba Cloud Container Registry(ACR)
    Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
    * {Configure} Support BearerToken profile mode by @AllyW in (#1333)
  - from version 3.3.15
    * feat add saectl by @Beimingx in (#1319)
    * Cloud Monitor version 2.0: Independent binary access,
    Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
    * feat(otel): integrate OpenTelemetry support with environment
    variable by @CodeSpaceiiii in (#1324)
    * aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT,
    AI_USER_AGENT, and OTEL headers have been added. Issues with business
    parameter passing have been fixed by @tingbin-ctb in (#1325)

++++ alloy:

  - CVE-2026-41889: Fix SQL injection by bumping github.com/jackc/pgx
    to version 5.9.2 (bsc#1265440)
  - add patch 0003-Bump-jackc-pgx.patch

++++ ant:

  - Build against the new extended junit5-minimal

++++ ant-antlr:

  - Build against the new extended junit5-minimal

++++ ant-junit:

  - Build against the new extended junit5-minimal

++++ ant-junit5:

  - Build against the new extended junit5-minimal

++++ argocd-cli:

  - fix version output and add %check section

++++ arkade:

  - Update to version 0.11.99:
    * Fix amp and update go.mod
  - Update to version 0.11.98:
    * Updates on formatting for releases
  - Update to version 0.11.97:
    * Add mediamtx
  - Update to version 0.11.96:
    * Show progress of "arkade oci install"
  - Update to version 0.11.95:
    * Update vendor
  - Update to version 0.11.94:
    * Update template for polaris tool due to upstream change
  - Update to version 0.11.93:
    * Fix for --latest=true flag for releases
  - Update to version 0.11.92:
    * Fix gofmt
    * Add jsongrep and more flexible docker upgrade command
  - Update to version 0.11.91:
    * Anonymous auth for openfaasltd images
  - Update to version 0.11.90:
    * Print out helpers/hints for setting PATH for .arkade/bin
  - Update to version 0.11.89:
    * Sync semver v3 with gha-bump
    * Upgrade semver to v3
  - Update to version 0.11.88:
    * Fix for argocd's massive CRDs
  - Update to version 0.11.87:
    * Add gen command to docker command
    * Update for message for arkade installation
  - Update to version 0.11.86:
    * Quick shortcut for superterm
  - Update to version 0.11.85:
    * Add argo workflow tool
    * Fix errors left over from codex
    * We can do better than this
    * Update sponsors section
    * Updates for support messages
    * Update sponsor messages to let people know about slicer
  - Update to version 0.11.84:
    * Bring fstail, gha-bump in-process via vendor

++++ cabal-install:

  - Drop obsolete Cabal-absolute-datadir.patch.

++++ chromium:

  - Chromium 149.0.7827.102 (boo#1267911):
    * CVE-2026-11628: Use after free in Ozone
    * CVE-2026-11629: Use after free in Ozone
    * CVE-2026-11630: Use after free in File Input
    * CVE-2026-11631: Use after free in Aura
    * CVE-2026-11632: Use after free in TabStrip
    * CVE-2026-11633: Use after free in Bluetooth
    * CVE-2026-11634: Use after free in Gamepad
    * CVE-2026-11635: Use after free in Bluetooth
    * CVE-2026-11636: Use after free in Autofill
    * CVE-2026-11637: Use after free in Views
    * CVE-2026-11638: Use after free in Printing
    * CVE-2026-11639: Use after free in Compositing
    * CVE-2026-11640: Integer overflow in libyuv
    * CVE-2026-11641: Use after free in Bluetooth
    * CVE-2026-11642: Use after free in Web Apps
    * CVE-2026-11643: Use after free in Proxy
    * CVE-2026-11644: Use after free in Views
    * CVE-2026-11645: Out of bounds memory access in V8
    * CVE-2026-11646: Use after free in ViewTransitions
    * CVE-2026-11647: Use after free in Printing
    * CVE-2026-11648: Use after free in FullScreen
    * CVE-2026-11649: Use after free in V8
    * CVE-2026-11650: Use after free in V8
    * CVE-2026-11651: Use after free in Network
    * CVE-2026-11652: Use after free in Extensions
    * CVE-2026-11653: Insufficient validation of untrusted input in Extensions
    * CVE-2026-11654: Use after free in CameraCapture
    * CVE-2026-11655: Integer overflow in Media
    * CVE-2026-11656: Use after free in ServiceWorker
    * CVE-2026-11657: Use after free in Payments
    * CVE-2026-11658: Insufficient validation of untrusted input in Extensions
    * CVE-2026-11659: Insufficient validation of untrusted input in UI
    * CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page
    * CVE-2026-11661: Use after free in Views
    * CVE-2026-11662: Type Confusion in Bindings
    * CVE-2026-11663: Use after free in Skia
    * CVE-2026-11664: Use after free in Payments
    * CVE-2026-11665: Out of bounds read in Dawn
    * CVE-2026-11666: Insufficient validation of untrusted input in Input
    * CVE-2026-11667: Out of bounds read in WebRTC
    * CVE-2026-11668: Uninitialized Use in Codecs
    * CVE-2026-11669: Integer overflow in Media
    * CVE-2026-11670: Use after free in PDF
    * CVE-2026-11671: Use after free in Navigation
    * CVE-2026-11672: Out of bounds write in GPU
    * CVE-2026-11673: Use after free in InterestGroups
    * CVE-2026-11674: Use after free in Guest View
    * CVE-2026-11675: Insufficient validation of untrusted input in Skia
    * CVE-2026-11676: Insufficient validation of untrusted input in Dawn
    * CVE-2026-11677: Race in Network
    * CVE-2026-11678: Integer overflow in libyuv
    * CVE-2026-11679: Use after free in Codecs
    * CVE-2026-11680: Use after free in Media
    * CVE-2026-11681: Use after free in Ozone
    * CVE-2026-11682: Insufficient validation of untrusted input in Views
    * CVE-2026-11683: Use after free in WebCodecs
    * CVE-2026-11684: Insufficient policy enforcement in Network
    * CVE-2026-11685: Insufficient data validation in MediaCapture
    * CVE-2026-11686: Insufficient validation of untrusted input in Dawn
    * CVE-2026-11687: Use after free in Dawn
    * CVE-2026-11688: Object lifecycle issue in SVG
    * CVE-2026-11689: Insufficient validation of untrusted input in Passwords
    * CVE-2026-11690: Out of bounds read and write in Media
    * CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page
    * CVE-2026-11692: Use after free in Read Anything
    * CVE-2026-11693: Inappropriate implementation in Plugins
    * CVE-2026-11694: Use after free in ServiceWorker
    * CVE-2026-11695: Inappropriate implementation in Passwords
    * CVE-2026-11696: Uninitialized Use in Video
    * CVE-2026-11697: Insufficient validation of untrusted input in UI
    * CVE-2026-11698: Use after free in Bluetooth
    * CVE-2026-11699: Use after free in Bluetooth
    * CVE-2026-11700: Use after free in Tracing
    * CVE-2026-11701: Insufficient validation of untrusted input in Guest View

++++ cvise:

  - Update to version 2.12.0+git.20260418.64ff7de2:
    * lines: Don't trim last newline in files (#501)
    * clex: Another fix for trailing newline trimming (#500)
    * tests: Initialize sigmonitor where needed (#499)
    * ci: Retry on infra errors (#498)
    * clex: Don't trim last newline in files (#495)
    * clex,topformflat: Fix Windows build (#497)
    * ci: Set timeouts on jobs (#496)
    * fileutil: Another fix for KeyboardInterrupt leftovers (#494)
    * tests: Add output variant for blocksort-part.c reduction (#493)
    * fileutil: Fix leftover files in atomic dir replacement (#491)
    * ci: Bump checkout action version (#492)
    * cli: Don't require arguments for --list-passes (#490)
    * clang_delta: support HIP (.hip) inputs on LLVM 17+ (#489)
    * test_manager: Fix copying of separate input files (#484)
    * test_manager: Fix pass init when multiple input files (#485)
    * tree-sitter-cpp: Update to latest upstream (#480)
    * ci, docs: Add macOS build (#477)
    * [tests] Fix tests for macOS (#478)
    * clex: Fix macOS build with system Flex (#476)
    * cmake: Fix updating CLANG_FORMAT_PATH when clang-format is not found (#475)
    * signals: Resole future eagerly; allow empty wakeup (#474)
    * multifile: Add Fibonacci integration test (#472)
    * multifile: Fix errors on empty dir (#473)
    * multifile: Fix backup error (#471)
    * docs, tests: Full example of directory input test cases (#468)
    * cli: Print stdout/stderr when interestingness test fails (#469)
    * [help] Mention that input can be a directory (#467)
    * signals: Prefer asynchronous, delayed handling (#465)
    * docs: Recommend Pebble 5.1.1+ (#464)
    * [ci] Add free-threaded Python testing (#462)
    * [ci] Add testing on Python 3.14 (#461)
    * Modernize code for Python 3.10 (#459)
    * Use dataclass with `__slots__` (#455)
    * tree-sitter: Delete unused Cargo.lock (#458)
    * test_manager: Only calc size diff for successful transforms (#456)
    * test_manager: Specify cwd instead of doing chdir (#457)
    * docs,pyproject: Document Python 3.10+ is requirement (#454)
    * clang_delta: Downgrade instance count logs to debug-only (#453)
    * Statistics accounts for timed-out/stopping/canceled jobs (#452)
    * Force-clean unexpected temp dirs periodically (#445)
    * clang_delta: Only brute force C++ standard for select heuristics (#451)
    * hints: Refactor out patch sorting key function (#450)
    * hints: Fix assert when inserting into to-be-removed chunk (#449)
    * interleaving: Print group information in --list-passes (#446)
    * IndentPass: Get rid of no-op jobs (#448)
    * logs: Correctly pluralize byte/line counts (#444)
    * logs: Fix orphan comma for single-pass stat messages (#443)
    * clang_delta: Only use bin search for select heuristics (#442)
    * clang_delta, clang_include_graph: Fix clang_tidy findings (#440)
    * test_manager: Fix wait when missing timeout workaround is due  (#441)
    * Support for LLVM 22 updated, as of 2025-10-25 (#439)
    * docs: Update note on supported Clang/LLVM versions (#438)
    * multifile: Introduce InlineIncludesPass (#427)
    * ci: Disable pytest parallelization (#436)
    * subprocesses: Spin loop when communicating (#429)
    * clangincludegraph: Fix empty paths in hints (#433)
    * interleaving: Always reinit passes consumed by other passes (#435)
    * Refactoring: sort Python imports (#434)
    * multifile: Prioritize passes providing data to others (#432)
    * clanghints: Validate all hints in tests (#431)
    * ci: Remove unneeded pytype dep for CI-Python jobs (#428)
    * clang_delta: Support for LLVM 22 20251014 (#430)
    * rmunusedfiles: Fix omitting pass name when only dirs removed (#426)
    * test_manager: Log initial file sizes on startup (#425)
    * multifile: Remove files created by interestingness test (#424)
    * rmunusedfiles: Removal of empty unused directories (#423)
    * lines: Fix inefficiency for multi-file inputs (#422)
    * hints: Preserve empty dirs in the test case (#421)
    * hints: Refactor "file" field to be "path" (#420)
    * makefile: Filerefs for directories (#419)
    * signals: Fix race condition around future.set_exception (#418)
    * makefile: Report filerefs for mentioned files (#417)
    * hints: Migrate clang_delta CallExprToValue (#415)
    * hints: Print vocab null-char separated in clang_delta (#416)
    * hints: Migrate clang_delta ReplaceDependentTypedef (#413)
    * clang_delta: Fix crash in replace-dependent-typedef on unresolved using (#414)
    * pyright: Add CI job (#412)
    * pyright: Add pyproject config (#411)
    * pyright: Add workarounds to avoid checker errors (#410)
    * Fix bugs caught by pyright (#409)
    * interleaving: Also add looped category into the default config (#408)
    * Modernize code for Python 3.9+ (#407)
    * ci: Add Python version compatibility tests (#400)
    * docs,pyproject: Document Python 3.9+ is requirement (#406)
    * Python 3.9+ compatibility fixes (#404)
    * tests: Pass -Wall -Werror to GCC to avoid unexpected reductions (#405)
    * makefile: Fix unescaped special char in regexp (#403)
    * hints: Fix test flakiness due to file ordering (#402)
    * ci: Fix typo in LLVM RelWithDebInfo jobs (#401)
    * makefile: Only remove args for recognized programs (#396)
    * makefile: Fix arg incorrectly removed after "-osomething" (#397)
    * cli: Exit with nonzero code on bad interestingness test (#395)
    * logs: Sort-uniquify pass names (#398)
    * ci: Use ubuntu:25.04 instead of rolling for Nightly job (#399)
    * Prevent makefiles from corruption by other passes (#394)
    * multifile: Support --print-diff (#393)

++++ dealers-choice:

  - dealers-choice 0.0.14
  - Drop 0001-server-skip-buffered-MSG_PING_RESPONSE-at-game-start.patch
    (fixed upstream)
    * Replace SDL2_net with tcpme (thin POSIX/Winsock wrapper)
    + Game-play display overhaul: relative seating (local bottom-centre,
    opponents clockwise), a bottom dashboard, an anchor-based layout system,
    and SVG card suits
    + Configurable game-play action hotkeys via a press-to-bind Hotkeys screen
    (#102)
    + The seat that opens each betting round is marked in its nameplate (#264)
    + Optional timestamped diagnostic logging (--log-file): server slow-send /
    high-ping / slow-action warnings and client frame-stall / slow-audio
    warnings, all gated by --verbose (#307)
    * regression fix: discard-phase timeout now reports 0 cards drawn (#265)
    * Fix OpenBSD build (#270)
    * server: skip stray MSG_PING_RESPONSE frames buffered from the lobby,
    fixing a spurious disconnect on slow/emulated hardware
    * Move deckhandler and pokeval inline (no longer meson subprojects)
    * rank-aware wild tiebreak for THREE/FOUR_OF_A_KIND, FULL_HOUSE,
    FIVE_OF_A_KIND
    * wild-aware tiebreak for PAIR and TWO_PAIR
    * fix wild kicker comparison for THREE/FOUR_OF_A_KIND at equal trip/quad
    value
    * wild-aware tiebreak for STRAIGHT / STRAIGHT_FLUSH
    * substitute wild = ACE_HIGH for FLUSH tiebreak
    * rank-aware PAIR/TWO_PAIR tiebreak in update_best_5card (Omaha / 7-card
    picker)
    * route update_best_wild same-rank tiebreak through the wild-aware compare
    * bugfix: run audio init on a background thread with silent fallback, so
    a blocked audio backend can't freeze the window
    * Bump GAME_PROTOCOL_VERSION from 9 to 10

++++ dhewm3:

  - Update to version 1.5.5
    * Build with SDL3
    Release highlights:
    * several sources of microstutters have been removed (like the
    old 60 vs 62.5fps problem) so the game should run smoother than
    before, especially when using VSync.
    * A new feature is the support for widescreen GUIs. It requires
    adjusting the .ui files; Arl created versions for the base
    game, Resurrection of Evil and The Lost Mission, they are
    provided as an optional Download (dhewm3-wide-guis-*.zip).
    * Note that especially the main menus may have some little
    glitches here and there - they're very big/complex, so
    converting them to widescreen wasn't exactly straightforward.
    * dhewm3 now supports BC7-compressed (BPTC) .dds textures. They
    offer better quality than the older S3TC/DXT/BC1-3 texture
    compression standard that Doom3 always supported, at the same
    size as DXT3-5. Useful for high-res retexturing packs.
    Full changelog:
    * https://github.com/dhewm/dhewm3/releases/tag/1.5.5

++++ espresso:

  - Buildrequire Boost >= 1.83.0 rather than a fixed version
  - Only build with SHARED_MEMORY_PARALLELISM if kokkos-devel is >= 4.6

++++ fast_float:

  - Update to release 8.2.8
    * Fix some compile errors when used with clang

++++ framework_tool:

  - Update to 0.6.4
    * README: Document how to install on Solus by @clintre in #336
    * smbios: Update Laptop 13 Pro naming by @JohnAZoidberg in #338
    * Haptic touchpad updates by @JohnAZoidberg in #337
    * fw16: fix invalid GPU read lengths by @kiram9 in #339
    * README: fix apt install package name by @alextwl in #340
    * Fix a bunch of issues on desktop by @JohnAZoidberg in #343
    * Prepare 064 by @JohnAZoidberg in #344

++++ frei0r-plugins:

  - Update to version 3.2.1:
    * Fix: add buffer-length check in cairoaffineblend.c
  - Changes from version 3.2.0:
    * Fix camerashake params
    * build: switch tests to cmake/ctest
    * fix(build): fix build failure on msys2 Windows
    * fix(build): check SSE2 macro before defining
    * fix(uvmap): fix off-by-one error
    * fix(water): fix a range check
    * feat(filter/colorenhance): new filter to increase color
    contrast of video
    * Docs/new website
    * fix(msvc): put math.h after _USE_MATH_DEFINES again
    * fix(ci): test release build with MSVC

++++ ghc-glib:

  - Apply "adapt-to-rts-api-change-in-ghc-9.12.x.patch" to fix a
    build error with ghc-9.12.3 or later. Found at
    https://github.com/gtk2hs/gtk2hs/pull/349.

++++ ghc-magic:

  - Update magic to version 1.1.2.
    Upstream added a new change log file in this release. With no
    previous version to compare against, the automatic updater cannot
    reliable determine the relevante entries for this release.

++++ ghc-vector:

  - Update vector to version 0.13.2.0 revision 4.
    Upstream has revised the Cabal build instructions on Hackage.

++++ git-bug:

  - CVE-2026-44740: improper input handling in many components can
    lead to DoS (bsc#1267331) revendoring of
    github.com/go-git/go-billy/v5 to the version 5.9.0.

++++ golang-github-prometheus-prometheus:

  - rebase patches to 3.12.0

++++ grype-db:

  - Update to version 0.54.0:
    * Added Features
  - Pull grype to get go vuln db provider and enable it [#1027
    @willmurphyscode]
    * Bug Fixes
  - pull in grype@main to fix withdrawn Go Vuln OSVs [#1029
    @willmurphyscode]
    * Additional Changes
  - Bump mxschmitt/action-tmate from 3.23 to 3.24 in the
    actions-minor-patch group across 1 directory [#1032
    @dependabot]
  - chore(deps): update anchore dependencies (#1028)
  - chore(deps): Bump the actions-minor-patch group with 3
    updates (#1030)
  - chore(deps-dev): Update coverage[toml] requirement (#1031)

++++ halloy:

  - Update to version 2026.7.2:
    Added:
    * Add clear buffer shortcut to title bar
    * Indicate in query if user is offline in its title bar
    Fixed:
    * Issue where large window size could cause Halloy to crash in
    certain scenarios
    * Correctly support RPL_METADATASYNCLATER
    * Issue where input box could lose focus after a filehost, reply,
    or reaction modal
    * Issue where a buffer could jitter in certain particular scroll
    positions
    * Minor issues where input tooltips could fail to reflect current
    caret position, highlight the correct active argument, show
    when first the input is first loaded, etc
    * Show Display in Configuration docs menu
    * Document that servers.<name>.username setting will fall back to
    servers.<name>.nickname if not set
    * Nick completion tooltip no longer shows when there is only a
    single match
    Changed:
    * buffer.reply.insert_nick no longer inserts nick when replying
    in query buffers or to yourself
    * Input tooltips are aligned with the input (i.e. inset when
    text_input.nickname.enabled = true)
    * servers.<name>.sasl.plain.username setting will fall back to
    servers.<name>.nickname if not set

++++ haproxy:

  - Force gcc 15 on 16.x to workaround an ICE on s390x/ppc64le

++++ hawk-apiserver:

  - Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 (bsc#1267454)

++++ java-1_8_0-openjdk:

  - Require at least gcc 7 on aarch64 since with gcc < 5 is considered
    broken by upstream on this architecture: "checking for broken
    aarch64 gcc 4.x... configure: error: GCC < 5 may incorrectly
    compile HotSpot on aarch64. See JDK-8360869."

++++ junit5:

  - Build also the modules junit-platform-engine and
    junit-platform-launcher within the flavour bootstrap.
    This does not pull in other dependencies and allows the majority
    of consumers of junit5 build early against the junit5-minimal
    package

++++ junit5-minimal:

  - Build also the modules junit-platform-engine and
    junit-platform-launcher within the flavour bootstrap.
    This does not pull in other dependencies and allows the majority
    of consumers of junit5 build early against the junit5-minimal
    package

++++ kernel-default:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-source:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-source-longterm:

  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit d0893ef
  - Linux 6.18.35 (bsc#1258210).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1258210).
  - net/sched: cls_fw: fix NULL dereference of "old" filters before
    change() (bsc#1258210).
  - net: mctp: ensure our nlmsg responses are initialised
    (bsc#1258210).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1258210).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1258210).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1258210).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1258210).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1258210).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1258210).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1258210).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1258210).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1258210).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1258210).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1258210).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1258210).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1258210).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1258210).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1258210).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1258210).
  - vsock: keep poll shutdown state consistent (bsc#1258210).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1258210).
  - net: netlink: don't set nsid on local notifications
    (bsc#1258210).
  - net/smc: Do not re-initialize smc hashtables (bsc#1258210).
  - net/iucv: fix locking in .getsockopt (bsc#1258210).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1258210).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1258210).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1258210).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1258210).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1258210).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1258210).
  - gpio: mxc: fix irq_high handling (bsc#1258210).
  - net: team: Remove unused team_mode_op, port_enabled
    (bsc#1258210).
  - net: team: Rename port_disabled team mode op to port_tx_disabled
    (bsc#1258210).
  - net: team: fix NULL pointer dereference in team_xmit during
    mode change (bsc#1258210).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1258210).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1258210).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1258210).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1258210).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1258210).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1258210).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1258210).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1258210).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1258210).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1258210).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1258210).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1258210).
  - ethtool: cmis: require exact CDB reply length (bsc#1258210).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1258210).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1258210).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1258210).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1258210).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1258210).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1258210).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1258210).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1258210).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1258210).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1258210).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1258210).
  - bonding: refuse to enslave CAN devices (bsc#1258210).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1258210).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1258210).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1258210).
  - ethtool: tsconfig: fix reply error handling (bsc#1258210).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1258210).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1258210).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1258210).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1258210).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1258210).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1258210).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1258210).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1258210).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1258210).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1258210).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1258210).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1258210).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1258210).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1258210).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1258210).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1258210).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1258210).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1258210).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1258210).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1258210).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1258210).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1258210).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1258210).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1258210).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1258210).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1258210).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1258210).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1258210).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1258210).
  - media: rc: fix race between unregister and urb/irq callbacks
    (bsc#1258210).
  - media: rc: ttusbir: fix inverted error logic (bsc#1258210).
  - smb: client: validate the whole DACL before rewriting it in
    cifsacl (bsc#1258210).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1258210).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1258210).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1258210).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1258210).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1258210).
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575,
    VSC856X (bsc#1258210).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1258210).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1258210).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1258210).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1258210).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1258210).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1258210).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1258210).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1258210).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1258210).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1258210).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1258210).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1258210).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1258210).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1258210).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1258210).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1258210).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1258210).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1258210).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1258210).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1258210).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1258210).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1258210).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1258210).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1258210).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1258210).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1258210).
  - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
    (bsc#1258210).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1258210).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1258210).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1258210).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1258210).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1258210).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1258210).
  - parport: Fix race between port and client registration
    (bsc#1258210).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1258210).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1258210).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1258210).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits (bsc#1258210).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1258210).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1258210).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1258210).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1258210).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1258210).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1258210).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1258210).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1258210).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1258210).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1258210).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1258210).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1258210).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1258210).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1258210).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1258210).
  - iio: dac: ad5686: fix input raw value check (bsc#1258210).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1258210).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1258210).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1258210).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1258210).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1258210).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1258210).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1258210).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1258210).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1258210).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1258210).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1258210).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1258210).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1258210).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1258210).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1258210).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1258210).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1258210).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1258210).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1258210).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1258210).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across bind/unbind
    cycles (bsc#1258210).
  - usb: dwc2: Fix use after free in debug code (bsc#1258210).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1258210).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1258210).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1258210).
  - wireguard: send: append trailer after expanding head
    (bsc#1258210).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1258210).
  - macsec: fix replay protection at XPN lower-PN wrap (bsc#1258210).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1258210).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1258210).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1258210).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1258210).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1258210).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1258210).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1258210).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1258210).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1258210).
  - spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
    (bsc#1258210).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1258210).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1258210).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1258210).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1258210).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1258210).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1258210).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1258210).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1258210).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1258210).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1258210).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1258210).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1258210).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1258210).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1258210).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1258210).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1258210).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1258210).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1258210).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1258210).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1258210).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1258210).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1258210).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1258210).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1258210).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1258210).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1258210).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1258210).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1258210).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1258210).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1258210).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1258210).
  - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    (bsc#1258210).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1258210).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1258210).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1258210).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1258210).
  - USB: serial: option: add MeiG SRM813Q (bsc#1258210).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1258210).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1258210).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1258210).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1258210).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1258210).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1258210).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1258210).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1258210).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1258210).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1258210).
  - usb: gadget: dummy_hcd: Reject hub port requests for non-existent
    ports (bsc#1258210).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1258210).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1258210).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1258210).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1258210).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1258210).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1258210).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1258210).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1258210).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1258210).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1258210).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1258210).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1258210).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1258210).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1258210).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1258210).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1258210).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position (bsc#1258210).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1258210).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1258210).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1258210).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1258210).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1258210).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1258210).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1258210).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1258210).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1258210).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1258210).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1258210).
  - serial: dz: Fix bootconsole handover lockup (bsc#1258210).
  - serial: dz: Convert to use a platform device (bsc#1258210).
  - serial: zs: Fix bootconsole handover lockup (bsc#1258210).
  - serial: zs: Switch to using channel reset (bsc#1258210).
  - serial: zs: Convert to use a platform device (bsc#1258210).
  - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
    (bsc#1258210).
  - serial: 8250: dispatch SysRq character in serial8250_handle_irq()
    (bsc#1258210).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1258210).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1258210).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1258210).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1258210).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1258210).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1258210).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1258210).
  - serdev: Provide a bustype shutdown function (bsc#1258210).
  - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
    (bsc#1258210).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1258210).
  - selftests: mptcp: drop nanoseconds width specifier (bsc#1258210).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1258210).
  - mptcp: handle first subflow closing consistently (bsc#1258210).
  - mptcp: borrow forward memory from subflow (bsc#1258210).
  - mptcp: do not drop partial packets (bsc#1258210).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1258210).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1258210).
  - mptcp: cleanup fallback dummy mapping generation (bsc#1258210).
  - mptcp: reset rcv wnd on disconnect (bsc#1258210).
  - cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
    (bsc#1258210).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1258210).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1258210).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1258210).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1258210).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1258210).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1258210).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1258210).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1258210).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1258210).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1258210).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1258210).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1258210).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1258210).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1258210).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1258210).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1258210).
  - tools: ynl: add scope qualifier for definitions (bsc#1258210).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1258210).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1258210).
  - Rename to
    patches.kernel.org/6.18.35-006-bcache-fix-uninitialized-closure-object.patch.
  - commit 46a8662

++++ kernel-docs:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-kvmsmall:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-longterm:

  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit d0893ef
  - Linux 6.18.35 (bsc#1258210).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1258210).
  - net/sched: cls_fw: fix NULL dereference of "old" filters before
    change() (bsc#1258210).
  - net: mctp: ensure our nlmsg responses are initialised
    (bsc#1258210).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1258210).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1258210).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1258210).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1258210).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1258210).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1258210).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1258210).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1258210).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1258210).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1258210).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1258210).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1258210).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1258210).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1258210).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1258210).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1258210).
  - vsock: keep poll shutdown state consistent (bsc#1258210).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1258210).
  - net: netlink: don't set nsid on local notifications
    (bsc#1258210).
  - net/smc: Do not re-initialize smc hashtables (bsc#1258210).
  - net/iucv: fix locking in .getsockopt (bsc#1258210).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1258210).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1258210).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1258210).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1258210).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1258210).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1258210).
  - gpio: mxc: fix irq_high handling (bsc#1258210).
  - net: team: Remove unused team_mode_op, port_enabled
    (bsc#1258210).
  - net: team: Rename port_disabled team mode op to port_tx_disabled
    (bsc#1258210).
  - net: team: fix NULL pointer dereference in team_xmit during
    mode change (bsc#1258210).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1258210).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1258210).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1258210).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1258210).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1258210).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1258210).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1258210).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1258210).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1258210).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1258210).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1258210).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1258210).
  - ethtool: cmis: require exact CDB reply length (bsc#1258210).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1258210).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1258210).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1258210).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1258210).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1258210).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1258210).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1258210).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1258210).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1258210).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1258210).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1258210).
  - bonding: refuse to enslave CAN devices (bsc#1258210).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1258210).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1258210).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1258210).
  - ethtool: tsconfig: fix reply error handling (bsc#1258210).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1258210).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1258210).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1258210).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1258210).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1258210).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1258210).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1258210).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1258210).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1258210).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1258210).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1258210).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1258210).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1258210).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1258210).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1258210).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1258210).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1258210).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1258210).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1258210).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1258210).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1258210).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1258210).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1258210).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1258210).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1258210).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1258210).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1258210).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1258210).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1258210).
  - media: rc: fix race between unregister and urb/irq callbacks
    (bsc#1258210).
  - media: rc: ttusbir: fix inverted error logic (bsc#1258210).
  - smb: client: validate the whole DACL before rewriting it in
    cifsacl (bsc#1258210).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1258210).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1258210).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1258210).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1258210).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1258210).
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575,
    VSC856X (bsc#1258210).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1258210).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1258210).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1258210).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1258210).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1258210).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1258210).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1258210).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1258210).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1258210).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1258210).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1258210).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1258210).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1258210).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1258210).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1258210).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1258210).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1258210).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1258210).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1258210).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1258210).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1258210).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1258210).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1258210).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1258210).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1258210).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1258210).
  - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
    (bsc#1258210).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1258210).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1258210).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1258210).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1258210).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1258210).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1258210).
  - parport: Fix race between port and client registration
    (bsc#1258210).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1258210).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1258210).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1258210).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits (bsc#1258210).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1258210).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1258210).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1258210).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1258210).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1258210).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1258210).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1258210).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1258210).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1258210).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1258210).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1258210).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1258210).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1258210).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1258210).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1258210).
  - iio: dac: ad5686: fix input raw value check (bsc#1258210).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1258210).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1258210).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1258210).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1258210).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1258210).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1258210).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1258210).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1258210).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1258210).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1258210).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1258210).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1258210).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1258210).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1258210).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1258210).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1258210).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1258210).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1258210).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1258210).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1258210).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across bind/unbind
    cycles (bsc#1258210).
  - usb: dwc2: Fix use after free in debug code (bsc#1258210).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1258210).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1258210).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1258210).
  - wireguard: send: append trailer after expanding head
    (bsc#1258210).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1258210).
  - macsec: fix replay protection at XPN lower-PN wrap (bsc#1258210).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1258210).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1258210).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1258210).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1258210).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1258210).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1258210).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1258210).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1258210).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1258210).
  - spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
    (bsc#1258210).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1258210).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1258210).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1258210).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1258210).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1258210).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1258210).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1258210).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1258210).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1258210).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1258210).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1258210).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1258210).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1258210).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1258210).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1258210).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1258210).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1258210).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1258210).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1258210).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1258210).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1258210).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1258210).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1258210).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1258210).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1258210).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1258210).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1258210).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1258210).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1258210).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1258210).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1258210).
  - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    (bsc#1258210).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1258210).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1258210).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1258210).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1258210).
  - USB: serial: option: add MeiG SRM813Q (bsc#1258210).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1258210).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1258210).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1258210).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1258210).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1258210).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1258210).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1258210).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1258210).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1258210).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1258210).
  - usb: gadget: dummy_hcd: Reject hub port requests for non-existent
    ports (bsc#1258210).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1258210).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1258210).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1258210).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1258210).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1258210).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1258210).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1258210).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1258210).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1258210).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1258210).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1258210).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1258210).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1258210).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1258210).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1258210).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1258210).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position (bsc#1258210).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1258210).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1258210).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1258210).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1258210).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1258210).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1258210).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1258210).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1258210).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1258210).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1258210).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1258210).
  - serial: dz: Fix bootconsole handover lockup (bsc#1258210).
  - serial: dz: Convert to use a platform device (bsc#1258210).
  - serial: zs: Fix bootconsole handover lockup (bsc#1258210).
  - serial: zs: Switch to using channel reset (bsc#1258210).
  - serial: zs: Convert to use a platform device (bsc#1258210).
  - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
    (bsc#1258210).
  - serial: 8250: dispatch SysRq character in serial8250_handle_irq()
    (bsc#1258210).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1258210).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1258210).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1258210).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1258210).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1258210).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1258210).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1258210).
  - serdev: Provide a bustype shutdown function (bsc#1258210).
  - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
    (bsc#1258210).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1258210).
  - selftests: mptcp: drop nanoseconds width specifier (bsc#1258210).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1258210).
  - mptcp: handle first subflow closing consistently (bsc#1258210).
  - mptcp: borrow forward memory from subflow (bsc#1258210).
  - mptcp: do not drop partial packets (bsc#1258210).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1258210).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1258210).
  - mptcp: cleanup fallback dummy mapping generation (bsc#1258210).
  - mptcp: reset rcv wnd on disconnect (bsc#1258210).
  - cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
    (bsc#1258210).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1258210).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1258210).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1258210).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1258210).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1258210).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1258210).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1258210).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1258210).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1258210).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1258210).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1258210).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1258210).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1258210).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1258210).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1258210).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1258210).
  - tools: ynl: add scope qualifier for definitions (bsc#1258210).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1258210).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1258210).
  - Rename to
    patches.kernel.org/6.18.35-006-bcache-fix-uninitialized-closure-object.patch.
  - commit 46a8662

++++ kernel-obs-build:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-obs-qa:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-syms:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ kernel-syms-longterm:

  - drm/gem: Try to fix change_handle ioctl, attempt 4 (git-fixes).
  - commit d0893ef
  - Linux 6.18.35 (bsc#1258210).
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
    buffer size (bsc#1258210).
  - net/sched: cls_fw: fix NULL dereference of "old" filters before
    change() (bsc#1258210).
  - net: mctp: ensure our nlmsg responses are initialised
    (bsc#1258210).
  - xfrm: move policy_bydst RCU sync from per-netns .exit to
    .pre_exit (bsc#1258210).
  - net/sched: sch_sfb: Replace direct dequeue call with peek and
    qdisc_dequeue_peeked (bsc#1258210).
  - nfc: llcp: Fix use-after-free in llcp_sock_release()
    (bsc#1258210).
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    (bsc#1258210).
  - xfrm: Check for underflow in xfrm_state_mtu (bsc#1258210).
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    (bsc#1258210).
  - tools/bootconfig: Fix buf leaks in apply_xbc (bsc#1258210).
  - HID: remove duplicate hid_warn_ratelimited definition
    (bsc#1258210).
  - kunit: fix use-after-free in debugfs when using kunit.filter
    (bsc#1258210).
  - accel/rocket: fix UAF via dangling GEM handle in create_bo
    (bsc#1258210).
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    (bsc#1258210).
  - netfilter: xt_cpu: prefer raw_smp_processor_id (bsc#1258210).
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    (bsc#1258210).
  - netfilter: nf_tables: fix dst corruption in same register
    operation (bsc#1258210).
  - tun: free page on short-frame rejection in tun_xdp_one()
    (bsc#1258210).
  - tun: free page on build_skb failure in tun_xdp_one()
    (bsc#1258210).
  - vsock: keep poll shutdown state consistent (bsc#1258210).
  - net: netlink: fix sending unassigned nsid after assigned one
    (bsc#1258210).
  - net: netlink: don't set nsid on local notifications
    (bsc#1258210).
  - net/smc: Do not re-initialize smc hashtables (bsc#1258210).
  - net/iucv: fix locking in .getsockopt (bsc#1258210).
  - scsi: core: Run queues for all non-SDEV_DEL devices from
    scsi_run_host_queues (bsc#1258210).
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after
    unregister_net_sysctl_table() (bsc#1258210).
  - ALSA: pcm: oss: Fix setup list UAF on proc write error
    (bsc#1258210).
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    (bsc#1258210).
  - net/mlx5: HWS: Reject unsupported remove-header action
    (bsc#1258210).
  - net: hsr: fix potential OOB access in supervision frame handling
    (bsc#1258210).
  - gpio: mxc: fix irq_high handling (bsc#1258210).
  - net: team: Remove unused team_mode_op, port_enabled
    (bsc#1258210).
  - net: team: Rename port_disabled team mode op to port_tx_disabled
    (bsc#1258210).
  - net: team: fix NULL pointer dereference in team_xmit during
    mode change (bsc#1258210).
  - net: Avoid checksumming unreadable skb tail on trim
    (bsc#1258210).
  - ethtool: rss: avoid modifying the RSS context response
    (bsc#1258210).
  - ethtool: rss: add missing errno on RSS context delete
    (bsc#1258210).
  - ethtool: rss: fix falsely ignoring indir table updates
    (bsc#1258210).
  - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    (bsc#1258210).
  - ethtool: rss: fix hkey leak when indir_size is 0 (bsc#1258210).
  - ethtool: rss: avoid device context leak on reply-build failure
    (bsc#1258210).
  - ethtool: module: call ethnl_ops_complete() on module flash
    errors (bsc#1258210).
  - ethtool: module: avoid leaking a netdev ref on module flash
    errors (bsc#1258210).
  - ethtool: module: avoid racy updates to dev->ethtool bitfield
    (bsc#1258210).
  - ethtool: module: check fw_flash_in_progress under rtnl_lock
    (bsc#1258210).
  - ethtool: module: fix cleanup if socket used for flashing
    multiple devices (bsc#1258210).
  - ethtool: cmis: require exact CDB reply length (bsc#1258210).
  - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    (bsc#1258210).
  - ethtool: cmis: validate start_cmd_payload_size from module
    (bsc#1258210).
  - ethtool: cmis: validate fw->size against start_cmd_payload_size
    (bsc#1258210).
  - cxl/test: Update mock dev array before calling
    platform_device_add() (bsc#1258210).
  - tunnels: load network headers after skb_cow() in
    iptunnel_pmtud_build_icmp[v6]() (bsc#1258210).
  - vxlan: do not reuse cached ip_hdr() value after
    skb_tunnel_check_pmtu() (bsc#1258210).
  - tunnels: do not assume transport header in
    iptunnel_pmtud_check_icmp() (bsc#1258210).
  - ksmbd: fix FSCTL permission bypass by adding a permission
    check for FSCTL_SET_SPARSE (bsc#1258210).
  - ASoC: codecs: simple-mux: Fix enum control bounds check
    (bsc#1258210).
  - drm/xe: Restore IDLEDLY regiter on engine reset (bsc#1258210).
  - Bluetooth: 6lowpan: check skb_clone() return value in
    send_mcast_pkt() (bsc#1258210).
  - bonding: refuse to enslave CAN devices (bsc#1258210).
  - bridge: Fix sleep in atomic context in netlink path
    (bsc#1258210).
  - bridge: Fix sleep in atomic context in sysfs path (bsc#1258210).
  - ethtool: coalesce: cap profile updates at
    NET_DIM_PARAMS_NUM_PROFILES (bsc#1258210).
  - ethtool: tsconfig: fix reply error handling (bsc#1258210).
  - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on
    PHY lookup error (bsc#1258210).
  - ethtool: pse-pd: fix missing ethnl_ops_complete() (bsc#1258210).
  - ethtool: tsconfig: fix missing ethnl_ops_complete()
    (bsc#1258210).
  - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    (bsc#1258210).
  - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on
    prepare failure (bsc#1258210).
  - ethtool: strset: fix header attribute index in
    ethnl_req_get_phydev() (bsc#1258210).
  - ethtool: eeprom: add missing ethnl_ops_begin() / _complete()
    during fallback (bsc#1258210).
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    (bsc#1258210).
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    (bsc#1258210).
  - net/sched: Revert "net/sched: Restrict conditions for adding
    duplicating netems to qdisc tree" (bsc#1258210).
  - net: hibmcge: disable Relaxed Ordering to fix RX packet
    corruption (bsc#1258210).
  - net/handshake: Use spin_lock_bh for hn_lock (bsc#1258210).
  - nvme-tcp: store negative errno in queue->tls_err (bsc#1258210).
  - net/handshake: Pass negative errno through handshake_complete()
    (bsc#1258210).
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
    success (bsc#1258210).
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    (bsc#1258210).
  - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
    close (bsc#1258210).
  - Bluetooth: hci_sync: Reset device counters in
    hci_dev_close_sync() (bsc#1258210).
  - gpio: adnp: fix flow control regression caused by scoped_guard()
    (bsc#1258210).
  - gpio: virtuser: Fix uninitialized data bug in
    gpio_virtuser_direction_do_write() (bsc#1258210).
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    (bsc#1258210).
  - gpio: rockchip: teardown bugs and resource leaks (bsc#1258210).
  - net: mana: Add NULL guards in teardown path to prevent panic
    on attach failure (bsc#1258210).
  - net: mana: Skip redundant detach on already-detached port
    (bsc#1258210).
  - sctp: fix race between sctp_wait_for_connect and peeloff
    (bsc#1258210).
  - vsock/virtio: bind uarg before filling zerocopy skb
    (bsc#1258210).
  - ipv6: fix possible infinite loop in rt6_fill_node()
    (bsc#1258210).
  - ipv6: fix possible infinite loop in fib6_select_path()
    (bsc#1258210).
  - net: skbuff: fix pskb_carve leaking zcopy pages (bsc#1258210).
  - media: rc: fix race between unregister and urb/irq callbacks
    (bsc#1258210).
  - media: rc: ttusbir: fix inverted error logic (bsc#1258210).
  - smb: client: validate the whole DACL before rewriting it in
    cifsacl (bsc#1258210).
  - Revert "x86/fpu: Refine and simplify the magic number check
    during signal return" (bsc#1258210).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1258210).
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS
    DPCD register (bsc#1258210).
  - drm/i915/psr: Read Intel DPCD workaround register (bsc#1258210).
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior
    line used (bsc#1258210).
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575,
    VSC856X (bsc#1258210).
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    (bsc#1258210).
  - iio: imu: adis16550: fix stack leak in trigger handler
    (bsc#1258210).
  - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    (bsc#1258210).
  - usb: typec: ucsi: ccg: reject firmware images without a ':'
    record header (bsc#1258210).
  - usb: typec: tcpm: validate VDO count in Discover Identity ACK
    handlers (bsc#1258210).
  - usb: typec: tcpm: bound altmode_desc[] per iteration in
    svdm_consume_modes() (bsc#1258210).
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without
    a payload VDO (bsc#1258210).
  - usb: typec: altmodes/displayport: validate count before reading
    Status Update VDO (bsc#1258210).
  - usb: typec: wcove: don't write past struct pd_message in
    wcove_read_rx_buffer() (bsc#1258210).
  - usb: typec: tcpm/tcpci_maxim: validate header NDO against
    RX_BYTE_CNT (bsc#1258210).
  - usb: typec: ucsi: validate connector number in
    ucsi_connector_change() (bsc#1258210).
  - USB: serial: safe_serial: fix memory corruption with small
    endpoint (bsc#1258210).
  - media: rc: igorplugusb: fix control request setup packet
    (bsc#1258210).
  - Input: ims-pcu - fix usb_free_coherent() size in
    ims_pcu_buffers_free() (bsc#1258210).
  - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    (bsc#1258210).
  - Bluetooth: btusb: Allow firmware re-download when version
    matches (bsc#1258210).
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (bsc#1258210).
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    (bsc#1258210).
  - ipc: limit next_id allocation to the valid ID range
    (bsc#1258210).
  - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    (bsc#1258210).
  - memfd: deny writeable mappings when implying SEAL_WRITE
    (bsc#1258210).
  - mm/rmap: initialize nr_pages to 1 at loop start in
    try_to_unmap_one (bsc#1258210).
  - auxdisplay: line-display: fix OOB read on zero-length
    message_store() (bsc#1258210).
  - smb: client: fix uninitialized variable in smb2_writev_callback
    (bsc#1258210).
  - Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen() (bsc#1258210).
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
    on !conn (bsc#1258210).
  - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
    (bsc#1258210).
  - Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1258210).
  - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    (bsc#1258210).
  - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    (bsc#1258210).
  - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM
    loading (bsc#1258210).
  - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    (bsc#1258210).
  - Input: xpad - fix out-of-bounds access for Share button
    (bsc#1258210).
  - parport: Fix race between port and client registration
    (bsc#1258210).
  - rust_binder: Avoid holding lock when dropping delivered_death
    (bsc#1258210).
  - rust_binder: avoid calling pending_oneway_finished() on
    TF_UPDATE_TXN (bsc#1258210).
  - USB: cdc-acm: Fix bit overlap and move quirk definitions to
    header (bsc#1258210).
  - KVM: arm64: PMU: Preserve AArch32 counter low bits (bsc#1258210).
  - KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
    x2AVIC (bsc#1258210).
  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    (bsc#1258210).
  - KVM: SEV: Ignore Port I/O requests of length '0' (bsc#1258210).
  - KVM: SEV: Use the size of the PSC header as the minimum size
    for PSC requests (bsc#1258210).
  - KVM: SEV: WARN if KVM attempts to setup scratch area with
    min_len==0 (bsc#1258210).
  - KVM: SEV: Compute the correct max length of the in-GHCB scratch
    area (bsc#1258210).
  - KVM: SEV: Check PSC request indices against the actual size
    of the buffer (bsc#1258210).
  - KVM: SEV: Use READ_ONCE() when reading entries/indices from
    PSC buffer (bsc#1258210).
  - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    (bsc#1258210).
  - Disable -Wattribute-alias for clang-23 and newer (bsc#1258210).
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
    dual mux (bsc#1258210).
  - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    (bsc#1258210).
  - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    (bsc#1258210).
  - iio: dac: max5821: fix return value check in powerdown sync
    (bsc#1258210).
  - iio: dac: ad5686: fix ref bit initialization for single-channel
    parts (bsc#1258210).
  - iio: dac: ad5686: fix input raw value check (bsc#1258210).
  - iio: dac: ad5686: acquire lock when doing powerdown control
    (bsc#1258210).
  - iio: dac: ad5686: fix powerdown control on dual-channel devices
    (bsc#1258210).
  - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    (bsc#1258210).
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    (bsc#1258210).
  - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    (bsc#1258210).
  - iio: gyro: itg3200: fix i2c read into the wrong stack location
    (bsc#1258210).
  - iio: gyro: adis16260: fix division by zero in write_raw
    (bsc#1258210).
  - iio: ssp_sensors: cancel delayed work_refresh on remove
    (bsc#1258210).
  - iio: temperature: tsys01: fix broken PROM checksum validation
    (bsc#1258210).
  - iio: magnetometer: st_magn: fix default DRDY pin selection
    for LIS2MDL (bsc#1258210).
  - iio: light: veml6070: Fix resource leak in probe error path
    (bsc#1258210).
  - iio: Fix iio_multiply_value use in
    iio_read_channel_processed_scale (bsc#1258210).
  - iio: chemical: mhz19b: reject oversized serial replies
    (bsc#1258210).
  - iio: chemical: scd30: fix division by zero in write_raw
    (bsc#1258210).
  - iio: light: cm3323: fix reg_conf not being initialized correctly
    (bsc#1258210).
  - iio: buffer: hw-consumer: fix use-after-free in error path
    (bsc#1258210).
  - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    (bsc#1258210).
  - USB: serial: omninet: fix memory corruption with small endpoint
    (bsc#1258210).
  - usb: cdns3: gadget: fix request skipping after clearing halt
    (bsc#1258210).
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
    acquisition failure (bsc#1258210).
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
    permanently leaks the runtime PM usage counter across bind/unbind
    cycles (bsc#1258210).
  - usb: dwc2: Fix use after free in debug code (bsc#1258210).
  - Input: elan_i2c - validate firmware size before use
    (bsc#1258210).
  - i2c: davinci: fix division by zero on missing clock-frequency
    (bsc#1258210).
  - x86/ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines (bsc#1258210).
  - wireguard: send: append trailer after expanding head
    (bsc#1258210).
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    (bsc#1258210).
  - macsec: fix replay protection at XPN lower-PN wrap (bsc#1258210).
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    (bsc#1258210).
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and
    set_params (bsc#1258210).
  - ipv6: exthdrs: refresh nh after handling HAO option
    (bsc#1258210).
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1258210).
  - ipv6: validate extension header length before copying to cmsg
    (bsc#1258210).
  - xfrm: input: hold netns during deferred transport reinjection
    (bsc#1258210).
  - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    (bsc#1258210).
  - ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1258210).
  - net: skbuff: fix missing zerocopy reference in pskb_carve
    helpers (bsc#1258210).
  - spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
    (bsc#1258210).
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    (bsc#1258210).
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    (bsc#1258210).
  - nfc: hci: fix out-of-bounds read in HCP header parsing
    (bsc#1258210).
  - xfrm: route MIGRATE notifications to caller's netns
    (bsc#1258210).
  - xfrm: ipcomp: Free destination pages on acomp errors
    (bsc#1258210).
  - xfrm: ah: use skb_to_full_sk in async output callbacks
    (bsc#1258210).
  - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
    2417 (bsc#1258210).
  - ALSA: firewire-motu: Protect register DSP event queue positions
    (bsc#1258210).
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq
    RST without direction check (bsc#1258210).
  - ASoC: qcom: q6asm-dai: close stream only when running
    (bsc#1258210).
  - ASoC: qcom: q6asm-dai: do not set stream state in event and
    trigger callbacks (bsc#1258210).
  - xfrm: esp: restore combined single-frag length gate
    (bsc#1258210).
  - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    (bsc#1258210).
  - Input: xpad - add "Nova 2 Lite" from GameSir (bsc#1258210).
  - Input: xpad - add support for ASUS ROG RAIKIRI II (bsc#1258210).
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk
    loops (bsc#1258210).
  - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    (bsc#1258210).
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    (bsc#1258210).
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad
    E490 (bsc#1258210).
  - comedi: comedi_test: fix check for valid scan_begin_src in
    waveform_ai_cmdtest() (bsc#1258210).
  - comedi: comedi_test: Fix limiting of convert_arg in
    waveform_ai_cmdtest() (bsc#1258210).
  - counter: Fix refcount leak in counter_alloc() error path
    (bsc#1258210).
  - tty: serial: pch_uart: add check for dma_alloc_coherent()
    (bsc#1258210).
  - tty: serial: samsung: Remove redundant port lock acquisition
    in rx helpers (bsc#1258210).
  - usb: chipidea: core: convert ci_role_switch to local variable
    (bsc#1258210).
  - usb: core: Fix up Interrupt IN endpoints with bogus
    wBytesPerInterval (bsc#1258210).
  - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    (bsc#1258210).
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2
    hub controllers (bsc#1258210).
  - usb: storage: Add quirks for PNY Elite Portable SSD
    (bsc#1258210).
  - usbip: vudc: Fix use after free bug in vudc_remove due to race
    condition (bsc#1258210).
  - usb: usbtmc: check URB actual_length for interrupt-IN
    notifications (bsc#1258210).
  - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    (bsc#1258210).
  - usb: typec: tipd: Fix error code in tps6598x_probe()
    (bsc#1258210).
  - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    (bsc#1258210).
  - usb: typec: ucsi: Check if power role change actually happened
    before handling (bsc#1258210).
  - usb: typec: ucsi: Don't update power_supply on power role
    change if not connected (bsc#1258210).
  - USB: serial: option: add MeiG SRM813Q (bsc#1258210).
  - USB: serial: option: add missing RSVD(5) flag for Rolling
    RW135R-GL (bsc#1258210).
  - USB: serial: belkin_sa: validate interrupt status length
    (bsc#1258210).
  - USB: serial: cypress_m8: validate interrupt packet headers
    (bsc#1258210).
  - USB: serial: keyspan: fix missing indat transfer sanity check
    (bsc#1258210).
  - USB: serial: mxuport: fix memory corruption with small endpoint
    (bsc#1258210).
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity
    check (bsc#1258210).
  - usb: gadget: uvc: hold opts->lock across XU walks in
    uvc_function_bind (bsc#1258210).
  - usb: gadget: net2280: Fix double free in probe error path
    (bsc#1258210).
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    (bsc#1258210).
  - usb: gadget: composite: fix integer underflow in WebUSB GET_URL
    handling (bsc#1258210).
  - usb: gadget: dummy_hcd: Reject hub port requests for non-existent
    ports (bsc#1258210).
  - usb: gadget: f_fs: copy only received bytes on short ep0 read
    (bsc#1258210).
  - usb: gadget: f_fs: serialize DMABUF cancel against request
    completion (bsc#1258210).
  - thunderbolt: property: Reject u32 wrap in
    tb_property_entry_valid() (bsc#1258210).
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t
    underflow (bsc#1258210).
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL
    walker (bsc#1258210).
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    (bsc#1258210).
  - scsi: target: iscsi: Fix CRC overread and double-free in
    iscsit_handle_text_cmd() (bsc#1258210).
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends
    to rsp_buf (bsc#1258210).
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    (bsc#1258210).
  - drm/hyperv: validate resolution_count and fix WIN8 fallback
    (bsc#1258210).
  - drm/hyperv: validate VMBus packet size in receive callback
    (bsc#1258210).
  - drm/gem: fix race between change_handle and handle_delete
    (bsc#1258210).
  - drm/i915/psr: Block DC states on vblank enable when Panel
    Replay supported (bsc#1258210).
  - drm/i915: Fix potential UAF in TTM object purge (bsc#1258210).
  - drm/amd/pm/si: Disregard vblank time when no displays are
    connected (bsc#1258210).
  - serial: altera_jtaguart: handle uart_add_one_port() failures
    (bsc#1258210).
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position (bsc#1258210).
  - serial: qcom_geni: fix kfifo underflow when flush precedes
    DMA completion IRQ (bsc#1258210).
  - serial: sh-sci: fix memory region release in error path
    (bsc#1258210).
  - serial: zs: Fix swapped RI/DSR modem line transition counting
    (bsc#1258210).
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in
    start_rx_dma (bsc#1258210).
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    (bsc#1258210).
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd
    debugger (bsc#1258210).
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    (bsc#1258210).
  - drm/amdgpu: fix lock leak on ENOMEM in
    AMDGPU_GEM_OP_GET_MAPPING_INFO (bsc#1258210).
  - drm/amdgpu: fix calling VM invalidation in
    amdgpu_hmm_invalidate_gfx (bsc#1258210).
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    (bsc#1258210).
  - serial: dz: Fix bootconsole message clobbering at chip reset
    (bsc#1258210).
  - serial: dz: Fix bootconsole handover lockup (bsc#1258210).
  - serial: dz: Convert to use a platform device (bsc#1258210).
  - serial: zs: Fix bootconsole handover lockup (bsc#1258210).
  - serial: zs: Switch to using channel reset (bsc#1258210).
  - serial: zs: Convert to use a platform device (bsc#1258210).
  - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
    (bsc#1258210).
  - serial: 8250: dispatch SysRq character in serial8250_handle_irq()
    (bsc#1258210).
  - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    (bsc#1258210).
  - platform/x86/intel/vsec: Refactor base_addr handling
    (bsc#1258210).
  - platform/x86/intel/vsec: Make driver_data info const
    (bsc#1258210).
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe
    error recovery (bsc#1258210).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1258210).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1258210).
  - rxrpc: Fix RESPONSE packet verification to extract skb to a
    linear buffer (bsc#1258210).
  - serdev: Provide a bustype shutdown function (bsc#1258210).
  - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
    (bsc#1258210).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1258210).
  - selftests: mptcp: drop nanoseconds width specifier (bsc#1258210).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1258210).
  - mptcp: handle first subflow closing consistently (bsc#1258210).
  - mptcp: borrow forward memory from subflow (bsc#1258210).
  - mptcp: do not drop partial packets (bsc#1258210).
  - arm64: tlb: Flush walk cache when unsharing PMD tables
    (bsc#1258210).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1258210).
  - mptcp: cleanup fallback dummy mapping generation (bsc#1258210).
  - mptcp: reset rcv wnd on disconnect (bsc#1258210).
  - cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
    (bsc#1258210).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1258210).
  - xfrm: iptfs: reset runtime state when cloning SAs (bsc#1258210).
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    (bsc#1258210).
  - USB: serial: cypress_m8: fix memory corruption with small
    endpoint (bsc#1258210).
  - USB: serial: digi_acceleport: fix memory corruption with small
    endpoints (bsc#1258210).
  - USB: serial: mct_u232: fix memory corruption with small endpoint
    (bsc#1258210).
  - hwmon: (pmbus) Add support for guarded PMBus lock (bsc#1258210).
  - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read
    with pmbus_lock (bsc#1258210).
  - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with
    pmbus_lock (bsc#1258210).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1258210).
  - net: phy: micrel: fix LAN8814 QSGMII soft reset (bsc#1258210).
  - xhci: tegra: Fix ghost USB device on dual-role port unplug
    (bsc#1258210).
  - mailbox: Fix NULL message support in mbox_send_message()
    (bsc#1258210).
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank
    enable (bsc#1258210).
  - thunderbolt: property: Cap recursion depth in
    __tb_property_parse_dir() (bsc#1258210).
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (bsc#1258210).
  - tools: ynl: add scope qualifier for definitions (bsc#1258210).
  - KVM: arm64: vgic-its: Drop the translation cache reference
    only for the erased entry (bsc#1258210).
  - KVM: arm64: Reassign nested_mmus array behind mmu_lock
    (bsc#1258210).
  - Rename to
    patches.kernel.org/6.18.35-006-bcache-fix-uninitialized-closure-object.patch.
  - commit 46a8662

++++ kernel-vanilla:

  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    (git-fixes).
  - commit e3cc0a5

++++ libresidfp:

  - Update license to GPL-2.0-or-later
    * legaldb scan
    * see license at https://github.com/libsidplayfp/libresidfp

++++ msgpack-c:

  - Update to release 7.0.1
    * Some change to the build procedure only

++++ libnbd:

  - Update to version 1.25.5:
    * Version 1.25.5.
    * docs: Improve documentation for nbd_add_close_callback(3)
    * Rename nbd_set_close_callback to nbd_add_close_callback
    * python: Test nbd.set_close_callback method
    * ocaml: Add a test of NBD.set_close_callback
    * tests: Add a test of new nbd_set_close_callback function
    * lib: Add new API to call a close callback on nbd_close
    * ocaml: Extend generator to support no-argument closures
    * docs/nbd_create.pod: Introduce link to libnbd(3) early
    * Version 1.25.4.
    * golang: Rename more exported functions
    * Version 1.25.3.
    * tests/connect-tcp.c: Add trivial test of keepalive features
    * lib: Add a new API to allow setting TCP options on the socket
    * fuse: Add --keepalive flag
    * ublk: Add --keepalive flag
    * ublk/nbdublk.pod: Simplify duplicated sections of the synopsis
    * lib: Add new APIs to set and get keepalives on the socket
    * ci: Rebuild CI files
    * ci/manifest.yml: Skip Rust on some platforms
    * ci: Allow Rust to be skipped by setting variable $RUST == "skip"
    * ci/manifest.yml: Drop freebsd-13, add freebsd-15
    * ci/manifest.yml: Add Alpine 3.23
    * ci/manifest.yml: Drop Alpine 3.21
    * golang: Rename global freeCallbackId to nbd_internal_freeCallbackId
    * generator: Compile-time error if a reserved word is used
    * python/utils.c: Split up the long get_sockaddr function
    * dump/nbddump.pod: Link to nbdkit_debug_hexdump(3)
    * Version 1.25.2.
    * tests/socket-activation-name.c: Fix test for nbdkit >= 1.47.5
    * lib/utils.c: Fix whitespace
    * fuse/operations.c: Remove out of date comment
    * python: Check for URI support before running the new tests
    * Version 1.25.1.
    * python: Add new tests to EXTRA_DIST
    * python: Test h.aio_connect using an IP address
    * python: Test h.aio_connect with old and new Unix domain socket formats
    * python/utils.c: Implement parsing of IP addresses for nbd.aio_connect
    * tests/aio-connect-port.c: Delete this test
    * tests/aio-connect-port.c: Replace broken link in comment
    * configure.ac: Remove use of "which" command
    * info: Add nbdinfo --can open

++++ ncurses:

  - Add ncurses patch 20260608
    + amend *.map to put recent cookie-related functions in a new tinfo
    ".current" section (report by Sven Joachim).
    + add npc to kmscon, fixing flash -TD

++++ pcg-c:

  - pcg 0.94.2
  - Fix signed integer overflow UB in `pcg_advance_lcg_8` and
    `pcg_advance_lcg_16`: C's integer promotion rules convert `uint8_t`/`uint16_t`
    operands to signed `int` before arithmetic; large 16-bit products exceed
    `INT32_MAX`, triggering undefined behavior caught by UBSan. Cast through the
    next-wider unsigned type to keep all multiplications in unsigned arithmetic.
  - When built as a Meson subproject, install nothing and skip the tests/samples.
  - Honour `-Ddefault_library=static` on non-Windows builds (previously always shared).
  - Add a `build_samples` option (default off) to build the sample programs.
  - Raise the declared Meson minimum to 0.58.0 to match features already in use
    (silences a setup-time warning).

++++ python314-core:

  - Upgrade to 3.14.5:
  - Security
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts (bsc#1262132, CVE-2026-5713).
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.0.20.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping (bsc#1262654,
    CVE-2026-6019).
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098, CVE-2026-6100).
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method
    (bsc#1261969, CVE-2026-1502).
  - Core and Builtins
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148653: Forbid marshalling recursive code objects and
    slice objects which cannot be correctly unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.14 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - Library
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Build
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - Remove upstreamed patches:
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-6100-use-after-free-decompression.patch

++++ python314-nogil-nogil-core:

  - Upgrade to 3.14.5:
  - Security
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts (bsc#1262132, CVE-2026-5713).
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.0.20.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping (bsc#1262654,
    CVE-2026-6019).
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098, CVE-2026-6100).
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method
    (bsc#1261969, CVE-2026-1502).
  - Core and Builtins
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148653: Forbid marshalling recursive code objects and
    slice objects which cannot be correctly unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.14 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - Library
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Build
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - Remove upstreamed patches:
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-6100-use-after-free-decompression.patch

++++ libreoffice:

  - Update to 26.2.4.2:
    * Release notes:
    https://wiki.documentfoundation.org/Releases/26.2.4/RC1
    https://wiki.documentfoundation.org/Releases/26.2.4/RC2

++++ libtorrent-rasterbar:

  - Update to version 2.0.13
    * stricter basic auth handling for web seed
    * fix bug in tracker announcements involving i2p trackers
    * improve performance of disk job pool
    * fix race when removing an auto managed torrent
    * fix bug in post_download_queue() when a torrent complete
    * in create_torrent, store symbolic links according to BEP 47
    * strengthen peer encryption (obfuscation)
    * improve HTTP response parsing
    * optimize sanitization of symlinks when loading torrents
    * stricter checking of tracker URLs
    * fixed piece-picker accounting issue for filtered pieces
    * add setting for NAT-PMP lease duration
    * optimize v2 request sizes
    * fix socks5 issues
    * fix issue in loading v2 resume data merkle trees

++++ tvm:

  -  Update to 0.24.0:
    * Release notes: https://github.com/apache/tvm/releases/tag/v0.24.0
  - Skipped 0.23.0:
    * Release notes: https://github.com/apache/tvm/releases/tag/v0.23.0
  - Rebase patch:
    * lib-finder-python-cmake.patch

++++ limine:

  - Update to 12.3.3:
    * Fix several Multiboot relocation and staging edge cases.
    * Fix Linux arm64 loading of legacy kernels and validate initrd
    placement.
    * Fix assorted RISC-V issues, including Svpbmt PBMT_NC encoding, rv64g
    ISA detection, and ACPI table bounds checking.
    * Fix x86 SMP startup to ignore disabled APs.
    *  Fix BIOS and UEFI PXE booting when loading preloaded TFTP resources
    through URI handling.
    * Harden assorted parsers, loaders, and host/build-time tools against
    malformed inputs and arithmetic overflows.
    * Miscellaneous graphics, input, firmware-time, and entropy-handling
    fixes.

++++ matomo:

  - Update to 5.11.0
    * Core improvements
  - #24372 Standardise textarea styling across forms with compact textarea class.
  - #24375 Replace Custom Reports child report sorting with a local Vue draggable list.
  - #24416, #213 Campaign parameters now masked rather than removed with CNIL.
  - #24512 Make IP Anonymization setting clearer.
  - #24453, #24421 Allow double click on presets.
  - #24476, #24475 Fix language selector hover background.
  - #24488 “Send Report now” in schedule report fails when a period is a “date range”.
  - #24490 Fix Marketplace test leakage.
  - #24492 Improve scheduled report validation feedback.
  - #24494 Migrate panel to Vue.
  - #24495 Fix export – do not hide Flatten option when there is no subtables.
  - #24501 Add Description Fields and Change Helptexts.
  - #24503 Segment editor implement UI tweak.
  - #24508 Fix issue with scheduled reports not sending when expected.
  - #24513 Hide ‘Expand subtable’ option when HTML format is chosen from export.
  - #24514, #21610 Show goal revenue metric and sparkline when Ecommerce disabled.
  - #24518 Refactor add widget modal.
  - #24526 Migrate modal to Vue.
  - #24527, #22713 Refactor Ecommerce sparklines to use shared CoreVisualizations implementation.
  - #24528 Dashboard manager dropdown redesign.
  - #24529 Fix issue with widgetised map getting a negative height.
  - #24531 Fix Ecommerce abandoned cart sparkline context.
  - #24532 Make addwidget modal 3-column.
  - #24551 Update hover text for Visitor Profile export.
  - #24555 Redesign Addwidget Modal.
  - #24557 Fix WidgetPreview for Goals > Overview and other widgets with child/sub widgets.
  - #24559 Implement missing Helptext on Manage Measurables View.
  - #24562 UI Tweaks for top nav menu items.
  - #24571 Remove Carriage return from CSV/TSV values.
    * Matomo Tag Manager
  - #1108 Fix Tag Manager top controls.
  - #1112 Change Inline Helptexts and placeholders.
  - #1119, #24544 Move Tag Manager card higher under Websites > Tracking Code.

++++ maven-surefire:

  - Fold maven-surefire-provider-junit5 into the main spec file

++++ mcp-server-snapper:

  - minor improvements from review (bsc#1261988)
  - version 0.2.0

++++ mesheryctl:

  - update to 1.0.40:
    * General
  - Fix printf-style logging calls flagged by go vet @leecalcote
    (#19941)
  - update to 1.0.39:
    * General
  - [Server] Preserve credential ID when saving connections
    @chaitanyamedidar (#19883)
  - fix(designs): render imported designs misclassified as legacy
    v1alpha2 @leecalcote (#19934)
    * Meshery CLI
  - [mesheryctl] (fix) corrected mesheryctl design undeploy
    output when used without args @ishwar170695 (#19894)
    * Maintenance
  - Remove inputs parameter from notify-providers workflow
    @leecalcote (#19914)

++++ mockito:

  - Build all submodules for which we have dependencies: bom, proxy
    and subclass

++++ nbdkit:

  - Update to version 1.47.9:
    * Version 1.47.9.
    * New filter: xor
    * swab: Don't link with gnutls
    * server/password.c: Forbid password=- if stdio is not safe
    * docs/nbdkit.pod: Fix bold B<> around parameters
    * docs: Link to libnbd in a few more places
    * todo: Suggestions for improving nbdkit-blkio-plugin and tests
    * tests/test-blkio.sh: Skip the test if io_uring is not available
    * spinning: Add a link to study of physical hard disk characteristics
    * docs/nbdkit_read_password.pod: Rework documentation
    * common/replacements/readpassphrase.h: Use include_next for system header
    * Version 1.47.8.
    * server: Change password=- again to use readpassphrase(3)
    * server: Change password=- to read interactively from /dev/tty
    * Version 1.47.7.
    * cow: Enhance -D cow.verbose=1 to show file overlay offsets
    * cache, cow: Use uint64_t instead of off_t for offsets
    * cache: Make offset variables const
    * cow: Make some offset variables const
    * cow: Fix offsets when overlay is split
    * cow: Fix block -> fd calculation
    * cache, cow: Add prefix before more calls
    * Version 1.47.6.
    * tests: Add tests/test-go-nbd.d/go.sum to EXTRA_DIST
    * cow: Support overlays larger than 16T on ext4
    * cow: Add name of the temporary file to debug output
    * cow: Split out function to create temporary files
    * cow: Use a vector to store the overlay file descriptor
    * cow: Don't leak blk->lock and blk->bm on error paths
    * cache, cow: Prefix ftruncate error with filter name
    * server/quit.c: Rearrange includes into normal ordering
    * tests: Add interoperability test with go-nbd
    * ip: Move rules processing to a separate source file
    * ip: Remove include of cleanup.h
    * ip: Remove full stop at end of some examples
    * ip: Don't use 127.0.0.1 as an example IPv4 address
    * ip: Note that loopback name is only supported on nbdkit 1.48
    * ip: Add ability to filter on loopback addresses
    * docs: Add more authors
    * docs/nbdkit.pod: Improve the list of NBD servers
    * README: Add more links to the online documentation
    * Version 1.47.5.
    * server: Be more aggressive about cleaning LISTEN_* from environment
    * tests: Add test of socket activation with names
    * tests: Rewrite socket activation test as an nbdsh script
    * server: Parse and print LISTEN_FDNAMES
    * server: Modify get_socket_activation so it assembles a list of fds
    * tests: Fix missing backslash
    * extentlist: Suggest small script for reading extents from qemu-img map
    * common/include/human-size.h: Parse hex and octal sizes
    * common/include/human-size.h: Allow _ before scaling factor
    * server: Split up large server/public.c
    * server/nbdkit.syms: Add a comment about why we export nbdkit_debug_*
    * tests/test-sparse-random-blocksize.sh: Reduce maximum block size
    * vram: Cast cl_ulong to uint64_t before printing
    * Version 1.47.4.
    * todo: Allow extentlist filter to read hex extents
    * sparse-random: Parse runlength parameter using nbdkit_parse_size
    * tests/test-sparse-random-blocksize.sh: Enhance the test
    * sparse-random: Clamp preferred block size
    * sparse-random: Make block size configurable
    * vram: Link to blkdiscard(8)
    * Version 1.47.3.
    * server/sockets.c: Don't crash if TCP/IP selected without --port
    * docs: Update man pages for new OCaml bindings
    * Version 1.47.2.
    * tests/functions.sh.in: Remove obsolete comment
    * tests/test-ipv4-lo.sh, tests/test-ipv6-lo.sh: Remove pick_unused_port
    * tests/test-ip-filter.sh: Remove use of pick_unused_port
    * server: Partially fix --port=0
    * server/sockets.c: Print the actual bound addresses and ports in debug output
    * todo: Add item about nbdkit_timestamp on the main thread
    * ocaml: Add bindings for nbdkit_name and nbdkit_timestamp
    * docs/nbdkit_timestamp.pod: Fix copy and paste error in man page
    * docs/nbdkit-plugin.pod: Add a link to nbdkit_timestamp(3)
    * log: Use nbdkit_timestamp()
    * Add new nbdkit_timestamp() function
    * tests/test-name-plugin.c: Fix copy and paste errors
    * plugins/rust: add CHANGELOG entry for MR #138
    * plugins/rust: Clippy cleanup
    * wrapper: Allow NBDKIT_VALGRIND_MASSIF=1 to run massif
    * common/utils/utils.h: Add C++ boilerplate
    * map: Fix documentation about changing the size of the disk
    * server/test-public.c: Add process_name dummy variable
    * Add new nbdkit_name() function
    * configure.ac: Remove use of "which" command
    * vddk: Test with VDDK 9.0.1.0
    * qcow2dec: Don't pass flags from .extents through to .pread
    * file: Change calculations of block size hints for block devices
    * todo: Add note about problems with file plugin block_size
    * file: Don't advertise minimum_io_size > 64K (the max supported by NBD)
    * blocksize-policy: Fix assertion failure on unaligned block status
    * python: Sort documentation for module functions in order
    * python: Document some missing module functions
    * python: Link to C man pages for module functions
    * tests/test-ocaml-debug-hexdump.sh: Fix test that plugin was built
    * Version 1.47.1.
    * docs/nbdkit_read_password.pod: Fix typo in Python description
    * docs/nbdkit_debug_hexdump.pod: Add a link back to nbdkit-checkwrite-filter
    * docs/nbdkit_debug_hexdump.pod: Document when hexdiff was added to nbdkit
    * docs/nbdkit_debug_hexdump.pod: Update information about Rust binding
    * rust: Add a binding for nbdkit_debug_hexdiff
    * python: Add binding for nbdkit_debug_hexdiff
    * ocaml: Add binding for nbdkit_debug_hexdiff
    * ocaml: Add convenience functions for NBDKit.buf
    * checkwrite: Display differences if -D checkwrite.showdiffs=1 is used
    * server: Add nbdkit_debug_hexdiff function
    * server: Rewrite ugly macros in nbdkit_debug_hexdump
    * tests: Fix some copy/paste errors in debug_hexdump tests
    * file: Link to delay filter in the SEE ALSO section
    * file: Sort plugin names in SEE ALSO section
    * file: Improve flow of documentation of dir parameter
    * ssh: Describe this plugin versus nbd+ssh URIs
    * docs: Match all return value descriptions of nbdkit_parse_*
    * docs: Fix thinko and clarify description of nbdkit_parse_* functions
    * rust: Add a simple test of nbdkit_debug_hexdump
    * rust: Add binding for nbdkit_debug_hexdump
    * tests: ocaml errorcodes: Test additional exceptions
    * tests: ocaml errorcodes: Add future code to check the error string
    * tests: ocaml errorcodes: Refactor this test
    * ocaml: Handle Failure and Invalid_argument exceptions nicely
    * ocaml: Implement new NBDKit.Error exception
    * ocaml: Translate Unix_error exceptions to nbdkit_set_error + nbdkit_error
    * ocaml: Refactor exception to error handling
    * ocaml: Refactor documentation for error handling
    * tests/test-ocaml-errorcodes.c: Fix typo in error messages
    * ocaml: Fix comment about parse_* functions
    * ocaml: Implement OCaml binding for nbdkit_debug_hexdump
    * python: Implement nbdkit.debug_hexdump

++++ nekobox:

    Update to 5.11.19
  - Add AmneziaWG 2
    Update to 5.11.18
  - Fix group config fallback

++++ nelm:

  - Update to version 1.23.2:
    * Bug Fixes
  - goroutine leak in watch error channel consumer for
    ReleaseInstall, ReleaseUninstall and ReleaseRollback (#585)
    (9fd804c)
  - release had pending status after error instead of failed
    (#587) (ead2882)
  - Update to version 1.23.1:
    * Bug Fixes
  - accidental removal of unknown resource field managers (#580)
    (16b6e4c)
  - adopt managed fields after migration from helm to nelm (#582)
    (b9a9895)
  - pass option for yaml validator to allow duplicate map key
    (#584) (cd34ead)
  - Update to version 1.23.0:
    * Features
  - switch to goccy/go-yaml and improve parse error context
    (#572) (826a6f7)
    * Bug Fixes
  - --set-root-json not working (08c8522)
  - print engine.Render() result on debug level (#570) (9a7591e)
  - tracking absence for release namespace deletion (#571)
    (ed6e23e)

++++ neovim:

  - Fix  %lang_package, thanks to  Edwin Török (boo#1267905)

++++ netcfg:

  - Patch services file in %prep instead of in %install
  - Spec cleanup

++++ ntp:

  - Fix build against glibc 2.43:
    + Add ntp-glibc-2.43.patch: detect memchr presence in glibc. In
    the past, we did not check for it and duplictaed the function
    prototype in the local headers. This worked, as the glibc
    provided prototype and our own matched. With glibc 2.43, it was
    changed to a C11 _Generic macro, resultig in a conflict
    + Add libtool BuildRequires and call autoreconf to bootstrap the
    modified configure.ac

++++ open-vmdk:

  - Add Legal-Review-Notice for pytest/configs/EULA.txt, which is only
    pytest test fixture data and is not shipped in the binary RPM.

++++ pacemaker:

  - Update to version 3.0.2+20260608.b9d7133a:
  - liblrmd: Don't include internal header in lrmd.h

++++ pascube:

  - Fix 'nothing provides qt6-base' error by removing unused requires

++++ pinact:

  - Update to version 4.1.0:
    * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
    * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)

++++ pixelorama:

  - Update to 1.1.10
    * Added a license text field in the project properties
    * Added author information in the preferences,
    which are then stored in ".pxo" files
    * Added a shortcut to rename layers. By default, it's "F2".
    and more
  - Update to 1.1.9
    * It is now finally possible to split layers when exporting spritesheets
    * Implemented the ability to export tilesets as images or Godot "TileSet"
    resources from the Project Properties window
    * Duplicating cels is now possible, either from the cel button menu,
    or by using a shortcut, which is "Alt + D" by default
    * Search bar has been added in the Preferences
    * mimetype of pxo files has been changed to "application/x-pixelorama"
    * export file directory and name are stored inside pxo files
    * Undo/redo now works for layer properties
    * Improved idle GPU performance because the window was being constantly
    re-drawn, even if nothing was visibly changing
    and more

++++ pvirsh:

  - Use pyproject macros to build and install the macro.

++++ python-Django:

  - Update to 5.2.15
    * CVE-2026-6873: Signed cookie salt namespace collision (bsc#1267578)
    * CVE-2026-7666: Potential unencrypted email transmission via STARTTLS
    in the SMTP backend (bsc#1267579)
    * CVE-2026-8404: Potential exposure of private data via case-sensitive
    Cache-Control directives (bsc#1267580)
    * CVE-2026-35193: Potential exposure of private data via missing
    Vary: Authorization (bsc#1267576)
    * CVE-2026-48587: Potential exposure of private data via whitespace
    padding in Vary header (bsc#1267577)

++++ python-Django4:

  - Add security patches:
    * CVE-2026-6873: Signed cookie salt namespace collision (bsc#1267578)
    * CVE-2026-6873.patch
    * CVE-2026-7666: Potential unencrypted email transmission via STARTTLS
    in the SMTP backend (bsc#1267579)
    * CVE-2026-7666.patch
    * CVE-2026-8404: Potential exposure of private data via case-sensitive
    Cache-Control directives (bsc#1267580)
    * CVE-2026-8404.patch
    * CVE-2026-35193: Potential exposure of private data via missing
    Vary: Authorization (bsc#1267576)
    * CVE-2026-35193.patch
    * CVE-2026-48587: Potential exposure of private data via whitespace
    padding in Vary header (bsc#1267577)
    * CVE-2026-48587.patch

++++ python-Django6:

  - Update to 6.0.6
    * CVE-2026-6873: Signed cookie salt namespace collision (bsc#1267578)
    * CVE-2026-7666: Potential unencrypted email transmission via STARTTLS
    in the SMTP backend (bsc#1267579)
    * CVE-2026-8404: Potential exposure of private data via case-sensitive
    Cache-Control directives (bsc#1267580)
    * CVE-2026-35193: Potential exposure of private data via missing
    Vary: Authorization (bsc#1267576)
    * CVE-2026-48587: Potential exposure of private data via whitespace
    padding in Vary header (bsc#1267577)
    * Fixed a bug in Django 6.0 where an alert message on an admin changelist
    with ModelAdmin.list_editable referred to the “Run” button by its
    previous name

++++ python-azure-storage-blob:

  - New upstream release
    + Version 12.30.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-storage-file-datalake:

  - New upstream release
    + Version 12.25.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-storage-file-share:

  - New upstream release
    + Version 12.26.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-storage-queue:

  - New upstream release
    + Version 12.17.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-gnssanalysis:

  - update to 0.0.60
    * Introduced a framework for hashing and testing DataFrames
    against a baseline
    * Introduced ability to enter EarthData credentials (for CDDIS
    downloads) via environment variables rather the .netrc file
    * Fixed issue with downloading IGS FIN SP3 files from CDDIS -
    changed default to 15M for sampling rate rather than 05M
    * NPI-4453 Framework for DataFrame hashing & test baselining
    * NPI-4495 Earthdata creds via env var
    * Remove IGS from searching for 05M SP3 files

++++ python-numcodecs:

  - Don't test zarr on python311: No longer available (SPEC 0)

++++ python-smart-open:

  - Update to 7.6.1:
    * [hdfs] Make CliRawOutputBase.write return number of bytes written
    * Add support for `append` mode for Azure Blob Storage
    * Bump minimum supported version to Python 3.10
    * Fix pylance complaint
    * [s3] Support very large buckets in iter_bucket, add client_kwars
    * [http] Eliminate _read_iter and simplify read
    * [http] Re-introduce read optimization when buffer is empty
    * Simplify WHENCE_END logic
    * [http] Avoid using response.iter_content
    * [s3] Add lower version to boto3 requirement for tcp_keepalive
    * [s3] Improve handling of InvalidRange and seek on empty file
    * [s3] Optimize forward seeks within buffered data to avoid redundant GET
    * [s3] Add range_chunk_size param to read using multiple GET requests
    * Drop python 3.8, add python 3.14
    * Use compression.zstd (PEP-784)
    * Remove head_bucket call from s3.SinglepartWriter
    * Add buffer_size transport param to ssh.py
    * Make s3.SinglepartWriter seekable
    * Add support for prefetching to sftp transport

++++ python-ytmusicapi:

  - Update to 1.12.1
    * docs - add request body decode script to contributing
    * fix(oauth): Handle refresh token expiry field
    * fix(oauth): tolerate unexpected token fields when loading
    saved oauth.json
    * fix - search parse logic does not detect number of videos
    correctly
    * fix - parse all of artist description runs instead of just the
    first one
    * get_watch_playlist: fix KeyError when Comments tab is returned
    * default search: fix itemSection parsing
    * search: return categories as strings instead of run dicts

++++ python314:

  - Upgrade to 3.14.5:
  - Security
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts (bsc#1262132, CVE-2026-5713).
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.0.20.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping (bsc#1262654,
    CVE-2026-6019).
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098, CVE-2026-6100).
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method
    (bsc#1261969, CVE-2026-1502).
  - Core and Builtins
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148653: Forbid marshalling recursive code objects and
    slice objects which cannot be correctly unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.14 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - Library
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Build
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - Remove upstreamed patches:
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-6100-use-after-free-decompression.patch

++++ python314-documentation:

  - Upgrade to 3.14.5:
  - Security
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts (bsc#1262132, CVE-2026-5713).
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.0.20.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping (bsc#1262654,
    CVE-2026-6019).
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098, CVE-2026-6100).
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method
    (bsc#1261969, CVE-2026-1502).
  - Core and Builtins
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148653: Forbid marshalling recursive code objects and
    slice objects which cannot be correctly unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.14 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - Library
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Build
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - Remove upstreamed patches:
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-6100-use-after-free-decompression.patch

++++ python314-nogil:

  - Upgrade to 3.14.5:
  - Security
  - gh-148178: Hardened _remote_debugging by validating remote
    debug offset tables before using them to size memory reads
    or interpret remote layouts (bsc#1262132, CVE-2026-5713).
  - gh-149254: Update Android and iOS installer to use OpenSSL
    3.0.20.
  - gh-149017: Update bundled libexpat to version 2.8.0.
  - gh-90309: Base64-encode values when embedding cookies to
    JavaScript using the http.cookies.BaseCookie.js_output()
    method to avoid injection and escaping (bsc#1262654,
    CVE-2026-6019).
  - gh-148808: Added buffer boundary check when using nbytes
    parameter with
    asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
    relevant for Windows and the asyncio.ProactorEventLoop.
  - gh-148395: Fix a dangling input pointer in
    lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
    zlib._ZlibDecompressor when memory allocation fails with
    MemoryError, which could let a subsequent decompress() call
    read or write through a stale pointer to the
    already-released caller buffer (bsc#1262098, CVE-2026-6100).
  - gh-148169: A bypass in webbrowser allowed URLs prefixed
    with %action to pass the dash-prefix safety check
    (bsc#1262319, CVE-2026-4786).
  - gh-146581: Fix vulnerability in shutil.unpack_archive() for
    ZIP files on Windows which allowed to write files outside
    of the destination tree if the patch in the archive
    contains a Windows drive prefix. Now such invalid paths
    will be skipped. Files containing “..” in the name (like
    “foo..bar”) are no longer skipped.
  - gh-146333: Fix quadratic backtracking in
    configparser.RawConfigParser option parsing regexes (OPTCRE
    and OPTCRE_NV). A crafted configuration line with many
    whitespace characters could cause excessive CPU usage.
  - gh-146211: Reject CR/LF characters in tunnel request
    headers for the HTTPConnection.set_tunnel() method
    (bsc#1261969, CVE-2026-1502).
  - Core and Builtins
  - gh-146270: Fix a sequential consistency bug in
    structmember.c.
  - gh-137293: Fix SystemError when searching ELF Files in
    sys.remote_exec().
  - gh-149122: Fix a crash in optimized calls to all(), any(),
    tuple(), list(), and set() with an async generator
    expression argument (for example, tuple(await x for x in
    y)). These calls now correctly raise TypeError instead of
    crashing.
  - gh-113956: Fix a data race in sys.intern() in the
    free-threaded build when interning a string owned by
    another thread. An interned copy owned by the current
    thread is used instead when it is not safe to immortalize
    the original.
  - gh-148820: Fix a race in _PyRawMutex on the free-threaded
    build where a Py_PARK_INTR return from _PySemaphore_Wait
    could let the waiter destroy its semaphore before the
    unlocking thread’s _PySemaphore_Wakeup completed, causing
    a fatal ReleaseSemaphore error.
  - gh-148653: Forbid marshalling recursive code objects and
    slice objects which cannot be correctly unmarshalled.
  - gh-142516: Forward-port the generational cycle garbage
    collector to the default 3.14 build, replacing the
    incremental collector while leaving the free-threaded
    collector unchanged.
  - gh-148390: Fix an undefined behavior in memoryview when
    using the native boolean format (?) in cast(). Previously,
    on some common platforms, calling
    memoryview(b).cast("?").tolist() incorrectly returned
    [False] instead of [True] for any even byte b. Patch by
    Bénédikt Tran.
  - gh-148418: Fix a possible reference leak in a corrupted
    TYPE_CODE marshal stream.
  - gh-148393: Fix data races between PyDict_Watch()
    / PyDict_Unwatch() and concurrent dict mutation in the
    free-threaded build.
  - gh-148284: Fix high stack consumption in Python’s
    interpreter loop on Clang 22 by setting function limits for
    inlining when building with computed gotos.
  - gh-148037: Remove critical section from PyCode_Addr2Line()
    in free-threading.
  - gh-148222: Fix vectorcall support in types.GenericAlias
    when the underlying type does not support the vectorcall
    protocol. Fix possible leaks in types.GenericAlias and
    types.UnionType in case of memory error.
  - gh-148208: Fix recursion depth leak in PyObject_Print()
  - gh-137814: Fix the __qualname__ attribute of __annotate__
    functions on functions.
  - gh-147998: Fixed a memory leak in interpreter helper calls
    so cleanup works when an operation falls across interpreter
    boundaries. Patch by Maurycy Pawłowski-Wieroński.
  - gh-146455: Fix O(N²) compile-time regression in constant
    folding after it was moved from AST to CFG optimizer.
  - Library
  - gh-149388: Make asyncio.windows_utils.PipeHandle closing
    idempotent.
  - gh-149377: Update bundled pip to 26.1.1
  - gh-138907: Support RFC 9309 in urllib.robotparser.
  - gh-148615: Fix pdb to accept standard – end of options
    separator. Reported by haampie. Patched by Shrey Naithani.
  - gh-130750: Restore quoting of choices in argparse error
    messages for improved clarity and consistency with
    documentation.
  - gh-141449: Improve tests and documentation for non-function
    callables as annotate functions.
  - gh-149221: Catch rare math domain error for
    random.binomialvariate().
  - gh-149117: Fix runpy.run_module() and runpy.run_path() to
    set the name attribute on the ImportError they raise.
  - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
    version fixes the CVE 2026-3219 vulnerability. Patch by
    Victor Stinner.
  - gh-148093: Fix an out-of-bounds read of one byte in
    binascii.a2b_uu(). Raise binascii.Error, instead of reading
    past the buffer end.
  - gh-148914: Fix memoization of in-band PickleBuffer in the
    Python implementation of pickle. Previously, identical
    PickleBuffers did not preserve identity, and empty writable
    PickleBuffer memoized an empty bytearray object in place of
    b'', so the following references to b'' were unpickled as
    an empty bytearray object.
  - gh-148947: Fix crash in @dataclasses.dataclass with
    slots=True that occurred when a function found within the
    class had an empty __class__ cell.
  - gh-148680: ForwardRef objects that contain internal names
    to represent known objects now show the type_repr of the
    known object rather than the internal
    __annotationlib_name_x__ name when evaluated as strings.
  - gh-148801: xml.etree.ElementTree: Fix a crash in
    Element.__deepcopy__ on deeply nested trees.
  - gh-148735: xml.etree.ElementTree: Fix a use-after-free in
    Element.findtext when the element tree is mutated
    concurrently during the search.
  - gh-148740: Fix usage for uuid command-line interface to
    support a custom namespace be provided for uuid3 and uuid5.
  - gh-148651: Fix reference leak in
    compression.zstd.ZstdDecompressor when an invalid option
    key is passed.
  - gh-146553: Fix infinite loop in typing.get_type_hints()
    when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
  - gh-148508: An intermittent timing error when running SSL
    tests on iOS has been resolved.
  - gh-148518: If an email containing an address header that
    ended in an open double quote was parsed with
    a non-compat32 policy, accessing the username attribute of
    the mailbox accessed through that header object would
    result in an IndexError. It now correctly returns an empty
    string as the result.
  - gh-148464: Add missing __ctype_le/be__ attributes for
    c_float_complex and c_double_complex. Patch by Sergey
    B Kirpichev.
  - gh-148370: configparser: prevent quadratic behavior when
    a ParsingError is raised after a parser fails to parse
    multiple lines. Patch by Bénédikt Tran.
  - gh-148254: Use singular “sec” instead of “secs” in timeit
    verbose output for consistency with other time units.
  - gh-148192: email.generator.Generator._make_boundary could
    fail to detect a duplicate boundary string if linesep was
    not n. It now correctly detects boundary strings when
    linesep is rn as well.
  - gh-146313: Fix a deadlock in multiprocessing’s resource
    tracker where the parent process could hang indefinitely in
    os.waitpid() during interpreter shutdown if a child created
    via os.fork() still held the resource tracker’s pipe open.
  - gh-145831: Fix email.quoprimime.decode() leaving a stray \r
    when eol='\r\n' by stripping the full eol string instead of
    one character.
  - gh-145105: Fix crash in csv reader when iterating with
    a re-entrant iterator that calls next() on the same reader
    from within __next__.
  - gh-105936: Attempting to mutate non-field attributes of
    dataclasses with both frozen and slots being True now
    raises FrozenInstanceError instead of TypeError. Their
    non-dataclass subclasses can now freely mutate non-field
    attributes, and the original non-slotted class can be
    garbage collected.
  - gh-140287: The asyncio REPL now handles exceptions when
    executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
  - gh-132631: Fix “I/O operation on closed file” when parsing
    JSON Lines file with JSON CLI.
  - gh-70039: Fixed bug where smtplib.SMTP.starttls() could
    fail if smtplib.SMTP.connect() is called explicitly rather
    than implicitly.
  - gh-83281: email: improve handling trailing garbage in
    address lists to avoid throwing AttributeError in certain
    edge cases
  - Documentation
  - gh-148663: Document that calendar.IllegalMonthError is
    a subclass of both ValueError and IndexError since Python
    3.12.
  - gh-146646: Document that glob.glob(), glob.iglob(),
    pathlib.Path.glob(), and pathlib.Path.rglob() silently
    suppress OSError exceptions raised from scanning the
    filesystem.
  - Build
  - gh-149351: Avoid possible broken macOS framework install
    names when DESTDIR is specified during builds.
  - gh-146475: Block Apple Clang from being used to build the
    JIT as it ships without required LLVM tools.
  - gh-148535: No longer use the gcc -fprofile-update=atomic
    flag on i686. The flag has been added to fix a random GCC
    internal error on PGO build (gh-145801) caused by
    corruption of profile data (.gcda files). The problem is
    that it makes the PGO build way slower (up to 47x slower)
    on i686. Since the GCC internal error was not seen on i686
    so far, don’t use -fprofile-update=atomic on i686 anymore.
    Patch by Victor Stinner.
  - gh-146264: Fix static module builds on non-WASI targets by
    linking HACL dependencies as static libraries when
    MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
    symbol errors at link time.
  - Remove upstreamed patches:
  - CVE-2026-6019-Morsel-js_output.patch
  - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
  - CVE-2026-5713-validate-debug-load.patch
  - CVE-2026-4786-webbrowser-open-action.patch
  - CVE-2026-6100-use-after-free-decompression.patch

++++ restic:

  - update to 0.19.0 (boo#1266795 boo#1266211)
    For all the details see:
    https://github.com/restic/restic/releases/tag/v0.19.0
  - Fix #2034: Support serving a restic mount of a Windows system
    via Samba
  - Fix #4447: Use mode 0700 for repository directories created
    over SFTP
  - Fix #4467: Exit with code 3 when some backup source paths do
    not exist
  - Fix #4759: Error out when environment variables hold invalid
    values
  - Fix #5233: Return exit code 3 when failing to remove snapshots
  - Fix #5258: Exit with code 130 on SIGINT
  - Fix #5280: Reject impossible find time bounds immediately
  - Fix #5280: Make find --pack list blobs for tree packs
  - Fix #5354: Allow rclone and sftp backends when running in
    background
  - Fix #5427: Correctly restore ACL inheritance state on Windows
  - Fix #5477: Password prompt was sometimes not shown for backup
  - v
  - Fix #5487: Mark repository files read-only when using the SFTP
    backend
  - Fix #5586: Correctly handle snapshots --group-by with --latest
  - Fix #5595: Avoid spurious chmod errors on certain file backends
  - Fix #5683: Prevent backup --stdin-from-command from hanging
  - Fix #5757: Respect --user and --host in key passwd
  - Fix #21820: Correct handling of duplicate index entries
  - Fix #21820: Correctly handle pack files missing from the index
  - Chg #5293: Prune small packfiles more aggressively
  - Chg #5767: Prevent excluding paths explicitly passed to backup
  - Chg #21791: Update dependencies and require Go 1.25 or newer
  - Enh #3326: Limit check to snapshots selected by filters
  - Enh #3572: Support restoring ownership by name on UNIX systems
  - Enh #3738: Optional GitHub token for self-update API requests
  - Enh #4278: Support include filters in the rewrite command
  - Enh #4728: Support zstd compression levels fastest and better
  - Enh #4868: Include repository ID in the filesystem name used by
    mount
  - Enh #5175: Add status counters to copy in verbose text output
  - Enh #5352: Support excluding cloud-backed files on macOS
  - Enh #5383: Reduce progress bar refresh rates to decrease energy
    usage
  - Enh #5424: Enable Windows filesystem privileges before file
    access
  - Enh #5440: Make --host override environment variable
    RESTIC_HOST
  - Enh #5448: Support configuring nice and ionice in the Docker
    image
  - Enh #5453: Copy multiple snapshots in batches
  - Enh #5523: Add Open Container Initiative labels to release
    Docker image
  - Enh #5531: Reduce Azure storage costs by optimizing uploads
  - Enh #5562: Rewrite only changed status lines each frame
  - Enh #5588: Show timezone context in snapshots output
  - Enh #5610: Reduce check, copy, diff and stats memory usage
  - Enh #5689: Show more detailed progress for stats
  - Enh #5713: Significantly speed up index loading
  - Enh #5718: Stricter and earlier validation of the mount point
  - refresh disable-selfupdate.patch

++++ rocksndiamonds-data:

  - Update Emerald_Mine_Club to 3.3.0
  - This new release of the Emerald Mine Club level collection
    (which requires the latest R'n'D version 4.4.2.0) adds full
    support for all 35 "Emerald Dash" level sets in this
    collection.

++++ rsync:

  - Add missing python3-base BR

++++ rubygem-agama-yast:

  - Avoid running DASD formatting in a separate thread (related to
    bsc#1266276).

++++ rumdl:

  - Update to version 0.2.10:
    * Added
  - config: warn when multiple rumdl configs shadow each other in
    a directory (49cd393)
    * Fixed
  - config: apply inline --config overrides to subdirectory
    config groups (45800e8)
  - config: anchor multi-path config discovery at the common
    ancestor of the target paths (5b0d3c7)
  - config: discover global config from cwd for multi-path runs
    (#660) (3c28327)
  - config: show shadowed-config warning paths relative to their
    directory (37358a1)

++++ scons:

  - Add missing python3-base BR

++++ semaphore:

  - Update to version 2.18.12 (no releases between .9 and this one):
    * Features
  - Checkbox Skip Galaxy install

++++ telegram-desktop:

  - Updated tg_owt to git20250512.
    * Fixed LLVM 20+ build error.
  - Updated td to git20260516.
    * No changes provides.
  - Updated telegram-desktop to 6.9.1
    * https://github.com/telegramdesktop/tdesktop/releases/tag/v6.9.1

++++ termscp:

  - Update to version 1.1.1:
    * Fixed
  - build: drop vergen-git2 build dependency
    vergen-git2 reads git metadata at build time, but the
    crates.io source tarball ships no .git, so the published
    1.1.0 fails on cargo install.  crates.io versions are
    immutable (no overwrite) and Chocolatey's moderation queue
    blocks a fast re-push, so a clean 1.1.1 without vergen is the
    only fix.
  - Update to version 1.1.0:
    * Added
  - new website
  - install: add Windows PowerShell installer and copy buttons on site
    Add install.ps1 mirroring install.sh for Windows: arch
    detection, release zip download, binary extraction, user PATH
    update.
  - copy install.ps1 to site public/ at build time
    (copy-install.mjs)
  - serve /install.ps1 with text/plain Content-Type
    (vercel.json)
  - add PowerShell one-liner to install page and README
  - bump install.ps1 default version in bump_version.sh
  - add CopyButton component next to every install command line
  - config: move config dir to ~/.config/termscp on macOS and
    %USERPROFILE%.termscp on Windows
    Resolve the config directory through a single per-platform
    config_dir() function instead of relying on dirs::config_dir
    everywhere:
  - macOS: ~/.config/termscp (was ~/Library/Application
    Support/termscp)
  - Windows: %USERPROFILE%.termscp (was roaming
    %APPDATA%\termscp)
  - Linux/other: /termscp (unchanged)
    Existing users are migrated automatically on first run: when
    the new directory is absent and the legacy location exists,
    the whole config directory is moved to the new path. The
    cache directory stays at the platform-native location.
    * Changed
  - site: type-safe i18n keys derived from en
  - site: drop in-site manual, link to external docs.termscp.rs
  - site: english-only, remove i18n machinery
    * Fixed
  - install: quote vars, fix set -e cargo check and rustup tmpfile cleanup
  - silence SC3043 by declaring dash dialect (local is
    supported)
  - quote unquoted vars (SC2086/SC1090)
  - fix set -e aborting arch install before cargo check
  - fix install_cargo removing unset $archive instead of
    $rustup
  - make brew upgrade fallback a real if-then-else (SC2015)
  - drop leftover starship BASE_URL and debug echo $1
  - progress: rework transfer progress panel (#424)
    Migrate the transfer progress UI to tuirealm 4, where the
    stdlib ProgressBar widget was dropped, by rebuilding the
    dual-bar panel on top of Gauge.
  - Restore the unified two-bar look: the full bar (top) and
    partial bar (bottom) draw joined borders so they read as a
    single panel; a single file shows one fully-bordered bar.
  - Redraw on every file boundary in the send/recv queue loops
    so the full bar's (N/total) counter advances even for small
    files that finish within one in-loop redraw interval.
  - Track progress with a single TransferProgress (exact file
    count from the pre-scan, lazy partial/full computation) and
    consolidate the theme progress-bar fields.
  - progress: equalize dual progress bar heights
    The bottom (partial) bar carried a block title (the current
    filename), which forces a 1-row top inset in ratatui's
    Block::inner even though its top border is dropped to join
    the seam with the full bar. That left the partial bar with
    one inner row while the full bar kept two, so the two gauges
    rendered at unequal heights.
  - Move the filename from the partial bar's title into its
    gauge label.
  - Skip setting an empty title so no phantom top-positioned
    title triggers the inset.
  - Put the panel title on the top (full) bar for multi-file
    transfers.
  - Bump the two-bar popup height to fit the joined panel.
    Also bump Cargo.lock and adapt the embedded terminal to the
    new vt100 screen_mut() API.
  - copy: prevent emptying file when copy destination is empty
    (#421)
    An empty copy destination resolved to the source file's own
    path, so std::fs::copy truncated the original file to 0
    bytes.
  - localhost::copy now refuses to copy a file onto itself,
    returning an error instead of truncating it (root cause).
  - action_copy treats an empty/whitespace destination as a
    cancel.
  - transfer: enqueue full destination path instead of directory
    Queued transfers stored only the destination directory as the
    target path. Downstream upload logic treats the queued
    destination as the full file path and passes it straight to
    create_file, so transfers failed with a Failure error when
    the remote target resolved to a directory.  Append each
    entry's file name to the destination directory at enqueue
    time in both enqueue_file and enqueue_all, matching the
    single-file transfer path which already builds the full
    target path.

++++ transactional-wrapper:

  - initial version

------------------------------------------------------------------
------------------  2026-6-8  -  Jun 8 2026  -------------------
------------------------------------------------------------------

++++ ART:

  - Update to 1.26.5 (no changelog).

++++ ImageMagick:

  - version update to 7.1.2.25
    * validate argument count for polynomial distortion #8780
    * fix oob read of gps rationals in GetEXIFProperty #8782
    * reject hdr files with a negative width or height #8765
    * reject pgx files with invalid dimensions or precision #8764
    * reject rla files with an inverted active window #8770
    * build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 #8775
    * reject fits files with an invalid bits per pixel #8760
    * reject sgi files with zero columns or rows #8761
    * reject dds files with zero columns or rows #8762
  - fixes following GH security advisories:
    * GHSA-q62c-h75r-2xhc
    * GHSA-g22q-f7gc-5jhr
    * GHSA-px7q-ggqj-hcf2
    * GHSA-p9rq-q46c-g4x6
    * GHSA-j989-f892-2335
    * GHSA-44cp-c3ww-9rv5
  - fixes CVE-2026-53465 [bsc#1268100]
    CVE-2026-53463 [bsc#1268105]
    CVE-2026-53462 [bsc#1268106]

++++ QLog:

  - Update to version 0.51.0:
    * Add a simple QSL Card printing
    * Add virtual column Mode/Submode to Logbook
    * BandMap shows IBP frequencies
    * Added Bandmap Guide
    * Tune rig from IBP and SOS markers
    * Added Bandmap Guide Setting
    * Added user defined colors for DXCC Statuses
    * Added StartUp ADI file Import
    * Added Emergency, IBP and Bandmap Guide Labels
    * Added Bandmap Guide selection
    * Added QSL Sent Status default
    * Added WAAC and WAIP
    * Added Open Rule Button
    * Added LoTW DXCC credits import
    * Added civil, nautical, and astronomical twilight
    * Added more built-in macOS TQSL search paths
    * Clock - Improved timing
    * IBP - Updated Beacon statuses, enabled ZL6B 5Z4B, disabled
    4S7B OH2B YV5B
    * New Contact - Elide member list label and add tooltip with
    Member IDs
    * bug fixes

++++ SDL2_sound:

  - Update to release 2.0.6
    * The Ogg Vorbis decoder now caches small reads, for significant
    speedups.
    * Fixed seeking in MP3 files.
    * Fixed Ogg Vorbis decoding when there are "deferred" samples at
    the start of a file.
    * Made playsound work on platforms that need to render something
    every frame to function properly.
    * Fixed modplug looping.
    * Make modplug song fadeout at end optional.
    * Let most other decoders consider data before the MP3 decoder,
    to reasonably avoid false positives.

++++ SDL3_sound:

  - New package based on SDL2_sound specfile
  - Update to release 3.2.0
    * This release breaks API and ABI in small ways from SDL2_sound,
    largely to accommodate SDL3 changes. SDL3_sound is not an API
    redesign. Migration to the new API does not require drastic
    changes, and there is a migration guide on
    <https://wiki.icculus.org>.
    * One new API was added: Sound_SetDesiredFormat(), which was made
    possible because SDL3's SDL_AudioStream is more flexible.
  - Update to release 2.0.6
    * The Ogg Vorbis decoder now caches small reads, for significant
    speedups.
    * Fixed seeking in MP3 files.
    * Fixed Ogg Vorbis decoding when there are "deferred" samples at
    the start of a file.
    * Made playsound work on platforms that need to render something
    every frame to function properly.
    * Fixed modplug looping.
    * Make modplug song fadeout at end optional.
    * Let most other decoders consider data before the MP3 decoder,
    to reasonably avoid false positives.

++++ ack:

  - ack 3.10.0:
    * CVE-2026-49147: filename ANSI escape sequences
    * CVE-2026-49146: project .ackrc -A -B -C memory exhaustion
    * CVE-2026-49145: project .ackrc --follow / --files-from file exfiltration
    * Fixed a bug where types set in the .ackrc could not be overridden from the
    command line. Thanks, Dmitri Vereshchagin. (GH #393)

++++ apko:

  - Update to version 1.2.16:
    * build(deps): bump github/codeql-action from 4.35.5 to 4.36.0
    (#2246)
    * build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    (#2254)
    * build(deps): bump imjasonh/setup-crane from 0.5 to 0.6 (#2260)

++++ apptainer:

  - Update apptainer to version v1.5.1
    * Security fix (bsc#1267982):
    Fix for CVE-2026-48785 / GHSA-cr2j-534f-mf3g. Incorrect path
    matching for limit container paths directive. This is only
    applicable to SUID installations that have paths listed in
    limit container paths that are string prefixes of other paths
    which are not desired to be included in the list. For example,
    if /scratch is in the list but `/scratch2` also exists and contains
    container images, previously the latter would match but now
    only images under the exactly matching `/scratch` are included.
    * Security fix for CVE-2026-2303 (bsc#1270529):
    Heap Out-of-Bounds Read in GSSAPI Error Handling in
    go.mongodb.org/mongo-driver. The dependency on mongo-driver
    has been removed with this version of apptainer.
    Other changes:
    * Work around segmentation fault sometimes seen while `mksquashfs`
    under proot is creating a SIF file.
    * Update bundled PRoot to version 5.4.0-rootless.3 in order to
    fix a problem where SIF files could be corrupted when
    `mksquashfs` died with a signal. The proot command was not
    passing back an error exit code.
    * Updated bundled `squashfuse_ll` to version 0.6.2 in order to
    fix a crash sometimes seen with apptainer in unprivileged
    docker.
    * Update bundled fuse2fs to version 1.47.4 instead of patching
    the bugs in 1.47.3.
    * Fix a crash that happened when `/etc/resolv.conf` was a
    symlink while building from a definition file using the
    localimage bootstrap.
    * Support hosts that have an /etc/resolv.conf symlink pointing
    to `../run` in addition to `/run`.
    * Change the download-dependencies script to skip downloading
    the PRoot source code on architectures that it is known to
    not support (that is: ppc*, s390*, and riscv*).
    In those situations Apptainer will skip trying to compile
    and run proot. As a result original owners and groups of
    files will not be preserved in SIF images built by
    unprivileged users, as was the case for all architectures
    prior to 1.5.0.
    * Fix panic encountered during progress bar update while
    pulling image.
    * Fix fakeroot overwriting root's username in `/etc/passwd`
    with the host user's name, a regression introduced in v1.5.0.
    * Add nonested flag for --mount specifications to prevent
    individual bind mounts from being passed to nested containers
    via `APPTAINER_BIND`.
    Example: `--mount type=bind,source=/data,destination=/mnt,nonested`.
  - Changes from version v1.5.0:
    New Features & Functionalities
    * Add support for a subset of the Container Device Interface
    (CDI) standard through new `--device` and
    `--cdi-dirs run/shell/exec` options. Honors environment
    variable settings, bind mounts, and device files listed in
    CDI specification files.
    * Add support for selective mounting of Intel(R) Gaudi
    accelerators. This feature is only for use in combination
    with a minimal /dev directory, selected either with the
    `--contain` flag or by configuring mount dev with the minimal
    option; otherwise all the devices are available anyway. This
    feature is enabled via the `--intel-hpu option` and by
    specifying the HABANA_VISIBLE_DEVICES environment variable,
    which should contain a comma-separated list of device IDs
    (e.g., "1,2,3") or "all" to import all of them.
    The default if `HABANA_VISIBLE_DEVICES` is not set is "all".
    * Add support for downloading SIF images from an IPFS
    peer-to-peer cluster using an HTTP gateway (similar to the
    existing support for IPFS in the curl tool). The address of
    the gateway can be set in the `IPFS_GATEWAY` environment
    variable or read from ~/.ipfs/gateway or /etc/ipfs/gateway.
    * Add `--no-env` action and instance option and corresponding
    `APPTAINER_NOENV` environment variable that can provide a
    comma-separated list of environment variables to skip
    importing from the host environment into the container.
    * Add `--data` build option which creates a SIF file with
    a squashfs data partition instead of a code partition,
    given an existing squashfs file as the source.
    * If `PREPEND_LD_LIBRARY_PATH` is set in the container
    environment (through an `--env` option, an `APPTAINERENV_`
    prefix from the host, or in the container definition)
    then prepend that string to `:$LD_LIBRARY_PATH`. Likewise
    if `APPEND_LD_LIBRARY_PATH` is set in the container
    environment then append that string to `$LD_LIBRARY_PATH:`.
    This is only done when `LD_LIBRARY_PATH` is set, although
    if the container is based on glibc, when `LD_LIBRARY_PATH`
    is not set it will first be filled with the default
    library search path as found through ldconfig.
    * Create reproducible SIF images, if the environment variable
    `SOURCE_DATE_EPOCH` has been set (as a Unix timestamp given
    as seconds since the beginning of 1970, in the UTC timezone).
    Also add `--reproducible` flag to build and pull from
    `oras://` sources. This sets `SOURCE_DATE_EPOCH`
    automatically from the image "created" time.
    * Support hosts that have `/etc/resolv.conf` pointing to a
    symlink under /run, such as those hosts that are running
    systemd-resolved. In this case, the symlink is copied into
    the container and the parent directory of the target of the
    symlink is bind-mounted from the host. The result is that
    even if the target of the symlink is replaced with a new file,
    the container sees the update in `/etc/resolv.conf`.
    * Add `/etc/resolv.conf` to the list of host paths that can be
    prevented from automatic import into the container with the
    `--no-mount` option.
    * Preserve owner and group information on files in containers
    downloaded from OCI registries when building SIF files, even
    for unprivileged users. This takes advantage of the fact that
    the library (umoci) that downloads containers preserves owner
    and group information in an extended attribute. Adds bundled
    tool proot which is modified from the upstream tool by the
    rootless-containers project to make the owner and group appear
    to be in the ordinary `stat()` information. That tool is now
    used when invoking mksquashfs to create the filesystem
    partition in a SIF file. It can be disabled with the hidden
    build option `--ignore-proot`.
    * When unsquashing an image while running under a root-mapped
    user namespace (such as when using fakeroot without subuid
    mapping), insert another namespace mapping back to the
    original user so unsquashfs doesn't try (and fail) to change
    the owner and group information on the unpacked files.
    * Record image digest metadata (sha256 from RepoDigests), for
    OCI registry images. Also add the image name (ref) of the
    image from "docker", with registry and tag. This is useful
    for traceability, when using docker.io or a tag like latest.
    Unfortunately the feature does not work with "docker-archive"
    or "docker-daemon".
    * Apptainer now supports the `loong64` architecture.
    Changed defaults / behaviours
    * If libraries are bound in to `/.singularity.d/libs` (such as
    with GPU options like `--nv`) and the container is based on
    glibc and `LD_LIBRARY_PATH` is not already set, it is now set
    to the default library search path. Since `/.singularity.d/libs`
    is appended to `LD_LIBRARY_PATH`, this makes libraries
    installed in the container take precedence over libraries
    bound in from the host. This reduces the chances of mismatched
    glibc versions. However, if there are indeed libraries on the
    host that need to take precedence over libraries in the
    container, that can be forced with
    `PREPEND_LD_LIBRARY_PATH=/.singularity.d/libs`.
    * Change the default arm variant to v7, and stop using the GOARM
    environment variable. The variables GOOS, GOARCH and GOARM
    are only used when building.
    * The oras transport now supports architectures beyond amd64.
    Images downloaded from oras without using the cache are now
    checksummed. A progress bar is shown during the process.
    Add support for APPTAINER_TMPDIR to the commands apptainer
    overlay create and apptainer plugin compile.
    Bug Fixes:
    * Make the root default capabilities configuration option apply
    only to the real root user as documented and not to a
    fakeroot user.
    * Fix long-time bug in importing environment variables from oci
    containers (defined by `ENV` in their definition file) with
    shell characters in them. It now escapes them with single
    backslashes instead of double backslashes so they behave
    like they do in podman and docker.
    * The username in `/etc/passwd` inside a container now always
    corresponds to the username of the user on the host even if
    an entry with the same UID is found in the container.
    * When apptainer reinvokes itself on behalf of the run-help
    command, it passes through `LD_LIBRARY_PATH`. This makes it
    work correctly when it was installed with
    `install-unprivileged.sh` on a host operating system that's
    different than the one the installed binaries were built on.

++++ ashell:

  - Updated to version 0.9.0:
    + Notification system: optionally works as a notification daemon.
    + OSD system: optionally show OSD information through the new
    IPC system.
    + IPC over a Unix socket: a way to control ashell externally.
    + Internationalization: the foundation for localized formatting
    and translations.
    + Experimental animations: work-in-progress animation support.
    + Official iced: thanks to iced_layershell, we now use the
    official upstream iced instead of the custom pop-os fork.
    + Relicensed from MIT to GPL-3.0-or-later.
    + See CHANGELOG.md for more details.

++++ asl:

  - Update to version 142-bld308
    * Add support for S390X, IA64 and HPPA as host.

++++ aws-c-common:

  - Update to 0.14.0
    * base64 decode fix by @TingDaoK in (#1248)

++++ aws-c-io:

  - Update to version 0.27.0
    * Interleave threads in serialized scheduling test by @sfod in (#797)
    * builder -> v0.9.92 and clang-latest by @sbSteveK in (#800)
    * Support s2n-tls on macOS by @sfod in (#799)

++++ aws-c-s3:

  - Update to version 0.12.5
    * Add gpu instance platform info by @azkrishpy in (#637)

++++ boost-base:

  - Force remove boost_atomic directory to fix the failing build
    with GCC 16

++++ boost-extra:

  - Force remove boost_atomic directory to fix the failing build
    with GCC 16

++++ calibre:

  - Skip test_recipe_browser_webengine in qemu emulation

++++ cheat:

  - CVE-2026-41506: HTTP authentication credential leak (bsc#1264943)
    Bump go-git to 5.18.0
  - CVE-2026-1229: Fix incorrect value (bsc#1265539)
    Bump circl to 1.6.3
  - CVE-2026-39827,CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831,
    CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832,CVE-2026-46597,
    CVE-2026-46598,CVE-2026-46595,CVE-2026-39835: Fix multiple issues (bsc#1266184)
    Bump crypto to 0.52.0
  - CVE-2026-44740: Improper input handling (bsc#1267330)
    Bump go-billy to 5.9.0

++++ lagrange:

  - update to 1.20.6
  - Improve legibility of text after a wrapped paragraph by adding a small
    first-line indent if the next text line follows immediately.
  - Use a smaller font for plain text documents to fit more content in the
    window, matching the font used in preformatted blocks.
  - Fixed: Prevent overlapping identity activations by removing any existing
    ones before activating a new identity on a given URL. (To conveniently
    switch between previously used identities, use the menu that appears when
    clicking the navbar Identity button. That preserves the current activation
    scope.)
  - Gopher: Detect an unexpected binary response to a type 0 selector.
  - Gopher: Detect when the response is a gophermap even if we requested type 0.
  - Gopher: Plain text now respects the "expand to long lines" option, avoiding
    wrapping when there is room in the window.
  - Gopher: Fixed handling the .\r\n terminator in text responses.
  - Updated UI translations.

++++ cpp-httplib:

  - Update to 0.46.1:
    * Fix Expect: 100-continue over TLS: the client decided whether to withhold the request body based on raw socket readability, but post-handshake TLS 1.3 records (e.g. session tickets) make the socket readable without any HTTP response, causing the body to be withheld and the request to fail with Failed to read connection. The client now decides by attempting to read the status line within the 100-continue timeout, and sends the body if none arrives
    * Fix -Wmissing-field-initializers warnings on Windows by using {} instead of {0} for OVERLAPPED and ADDRINFOEXW initialization
  - 0.46.0:
    * Fix proxy digest credential leak when an HTTPS origin returns 407 inside a CONNECT tunnel. The 401/407 retry is now gated on the response actually coming from a proxy hop
    * Add Client::set_no_proxy() for per-host proxy bypass. Accepts *, hostname suffix (dot-boundary rule), IPv4/IPv6 CIDR, and bare IP literals. Proxy-Authorization is suppressed for bypassed hosts, including across redirects
  - 0.45.1:
    * Fix iOS build break caused by TARGET_OS_MAC being true on all Apple platforms (iOS, tvOS, watchOS). The Keychain enumeration path and Security.h include guards are now narrowed to TARGET_OS_OSX, and defining CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN on a non-macOS Apple platform now emits an explicit #error directing users to set_ca_cert_path() with a bundled CA file. Addresses #2454 (#2455)
    * Fix zstd detection in the installed httplibConfig.cmake so downstream projects that depend on the installed package correctly pick up zstd (#2453)
    * Replace the deprecated SecTrustCopyAnchorCertificates (deprecated in macOS 13) with SecTrustSettingsCopyCertificates, iterating over the System, Admin, and User trust domains to retain equivalent anchor-certificate coverage (#2455)
    * Declare Server::stop() as noexcept, reflecting that the implementation does not throw (#2451)
    * Add a best-effort BoringSSL CI job (Ubuntu and macOS) that builds BoringSSL from source and exercises cpp-httplib's existing OpenSSL backend path. SSLClientServerTest.TlsVerifyHostname is now backend-aware (BoringSSL is SAN-only per RFC 6125 §6.4.4), and the README notes BoringSSL as a best-effort variant with the C++14 and SAN-only caveats (#2456)
    * Add an iOS header parse check to CI to catch accidental use of macOS-only APIs or guards (e.g. TARGET_OS_MAC vs TARGET_OS_OSX) that would silently break iOS builds
  - 045.0:
    * Fix crash on empty / comma-only X-Forwarded-For when set_trusted_proxies() is configured. get_client_ip() previously called front() on a vector that was empty whenever the header tokenized to zero segments ("", ",", ", , ,"); it now returns an empty string so process_request() falls back to the connection-level remote address instead of crashing (5c92857)
    * Fix keep-alive corruption on requests without a framed body (#2450). The post-response drain ran for any request that expect_content() accepted, so a method like DELETE /items/1 with no Content-Length and no Transfer-Encoding would, on a persistent connection, let read_content consume bytes belonging to the next pipelined request — making the second request appear to vanish. The drain now only runs when the request actually has a framed body (Content-Length or chunked). The non-SSL "stray-bytes → 413" payload-limit check is likewise limited to non-persistent connections, since on keep-alive any pending bytes may be the next request rather than an unframed body (91271c0)
    * Extract detail::has_framed_body() and detail::is_connection_persistent() helpers used by the keep-alive fix above
  - 0.44.0:
    * Stop percent-decoding HTTP request header values. parse_header() previously applied decode_path_component() to every header value (except Location / Referer) after is_field_value() validation, so wire sequences like %0D%0A passed validation and expanded into literal CR/LF inside stored values — enabling response splitting, log injection, and proxy smuggling. %3D / %2C / %3B likewise flipped Cookie and X-Forwarded-For boundaries against WAFs inspecting the wire form. RFC 9110 §5.5 specifies header values as opaque octets, so the auto-decode (and the Location / Referer workarounds for the same misbehavior) has been removed. Applications that need URI semantics on a header value should now call decode_uri_component() or decode_path_component() on the result explicitly. Fixes the long-standing Referer-with-%0A
    * Make ThreadPool constructor exception-safe on partial thread creation. If std::thread construction throws partway through (e.g. pthread_create returns EAGAIN under thread-resource pressure), the partially-built threads_ vector would destruct joinable std::thread objects and call std::terminate(). The spawn loop now signals shutdown to the workers already created, joins them, and rethrows.
    * scripts/release.sh gains a --minor flag to force a minor bump even when abidiff reports no ABI break, for behavioral breaking changes like the header-decoding fix above (e8e6528)
  - 0.43.4:
    * Reject malformed chunk-size in chunked decoder: strtoul silently accepted a leading - and wrapped via unsigned arithmetic, so chunk-size -2 produced ULONG_MAX-1, bypassing the ULONG_MAX guard and letting a client drive the server toward unbounded allocation. Replaced with a manual hex parser that requires at
    least one hex digit, detects size_t overflow per digit, and accepts only chunk-ext or end-of-line after the digits (RFC 9112 §7.1) (87d62db)
    * Fix #2441: only invoke setarch on Linux in test/Makefile so the test build works on FreeBSD and other non-Linux systems where setarch is unavailable (a9bfe59)
    * Use vswhere to locate the Visual Studio install in the 32-bit Windows CI workflow, so it keeps working as windows-latest migrates from VS 2022 to VS 2026
    * Guard nullptr res in the KeepAliveTest proxy template so a transient upstream failure to httpbingo.org produces a clean test failure instead of a SEGV under ASan
  - Upstream release includes fixes for:
    CVE-2026-45372 (bsc#1267004)
    CVE-2026-46527 (bsc#1267006)

++++ crmsh:

  - Update to version 5.1.0+20260608.2b1f0461:
    * Dev: ui_sbd: Call SBDUtils.verify_sbd_device in multiple places
    * Dev: sbd: Introduce function sbd.SBDUtils.get_sbd_device_metadata_raw
    * Dev: sbd: Compare SBD device UUID optionally
    * Dev: sbd: Call SBDUtils.verify_sbd_device when doing sbd health check
    * Dev: bootstrap: Call join_sbd before changing corosync.conf
    * Fix: sbd: Verify sbd devices on all nodes

++++ debhelper:

  - update to 13.32
    * autoscripts: enable update-rc.d and deb-systemd-helper with $DPKG_ROOT
    * autoscripts/postrm-systemd{,-user}: stop testing for deb-systemd-helper
    * autoscripts/postinst-systemd-restart: do not do a daemon-reload when DPKG_ROOT
    is non-empty.
    Thanks to Helmut Grohne <helmut@subdivi.de>
    * dh_installtmpfiles: reproducible tmpfiles order for postrm scripts
    * filedoublearray: do not resolve symlink when converting to absolute paths
    * dh_clean: remove obsolete `compat` check
    * dh_installtmpfiles: Remove note that `tmpfiles.d` is for `systemd`-only
    (Closes: 1134898)
    * dh_installdocs: Remove mention of where doc-base files are installed.
    Thanks to Jay Burstin <jayburstinau@gmail.com> (Closes: #1138620)
    * Dh_Lib.pm: Fix a (consistent) typo in a var name and fix some state resetting
    * upgrade-checklist: Avoid implying `X-DH-Compat` is the new default.
    (Closes: #1072698)
    * Fix doubling of word in man page
    * Fix meaning of "ahead of time"
    * Fix header for `dh_computeautosubstvars`
    * dh_computeautosubstvars: process next package instead of returning in parallel
    build
    * Do not compute `Commands` for `udeb` (Closes: #1136120)
    * Do not compress R data files.
    * autoconf: export standard build tools
    * Add function get_build_tools to Dh_Lib.
    * Update on Portuguese translation of the man pages (Closes: #1132737)
    * dh_installsystemd: Remove note that `tmpfiles.d` is for `systemd`-only
    * dh_installtmpfiles: add dependency on tmpfiles implementation
    * Document dh_qmldeps changes with v14.  (Closes: #1133692)

++++ fast_float:

  - Update to release 8.2.7
    * Skip materializing `parsed_number_string_t` spans
    on the hot path.

++++ file:

  - Update to 5.48:
    * add landlock support (valoq)
    * add BE/LE GUID
    * multiple fixes to prevent integer overflow in 32 bits (kerwin)
    * PR/745: bitstreamout: Don't flush when trying to set negative offsets
    on pipes, just continue, fixes 'cat file.zip | file -'
    * PR/753: vmihalko: Fix race is magic_getpath()
    * PR/728: Anton Monroe: Reinstate regex/c
  - Port patch file-5.47.dif and rename it to file-5.48.dif
  - Port patches
    * file-4.21-xcursor.dif
    * file-5.19-biorad.dif
    * file-5.19-printf.dif
    * file-5.22-elf.dif
    * file-5.28-btrfs-image.dif
    * file-secure_getenv.patch
  - Remove patches now upstream
    * file-5.47-regression.dif
    * file-5.47-s390x.patch
    * file-5.47-stanza.patch

++++ firecracker:

  - Update to version 1.16.0:
    * Added
  - #5786: Added developer preview support for hotplugging and
    hot-unplugging PCI virtio devices (block, pmem, net) on a
    running microVM. The guest must manually rescan the PCI bus
    after hotplug and remove the device before unplug since no
    automatic notification mechanism is implemented yet. More
    information can be found in the Device Hotplugging
    documentation page.
  - #5323: Add support for Vsock Unix domain socket path
    overriding on snapshot restore. More information can be found
    in the docs.
  - #5824: Add optional rate limiting to serial console output,
    configurable via the rate_limiter field on PUT /serial. A new
    metric is exposed under uart: rate_limiter_dropped_bytes.
  - #5799: Add per-callsite rate limiting for error, warn, and
    info level log messages. Each callsite independently allows
    up to 10 messages per 5-second window. When logging resumes
    after suppression, a warn-level summary reports the count of
    suppressed messages. A new rate_limited_log_count metric
    tracks the total number of suppressed messages.
  - #5789: Add rate-limiter support to virtio-pmem device to
    allow control over I/O bandwidth generated by the FLUSH
    requests from the guest.
  - #5872: Add notification suppression support in the
    virtio-vsock device via the EVENT_IDX virtio feature to
    reduce device overhead.
  - #5828: Advertise MTU to the guest via VIRTIO_NET_F_MTU using
    a new optional mtu field in the network-interfaces API. When
    set, a compatible guest driver will configure the interface
    with the specified MTU.
  - #5906: Add rng-seed FDT node for aarch64 guests which
    provides an initial random seed for the guest to use. This
    helps older aarch64 machines which do not have hardware
    random generators.
  - Added support for Linux 6.18 host kernels alongside the
    existing 5.10 and 6.1 host kernels. See the kernel support
    policy for details.
    * Fixed
  - #5762: Cap virtio-rng per-request entropy to 64 KiB.
    Previously, a guest could construct a descriptor chain that
    caused Firecracker to allocate more host memory than the
    guest actually provided, potentially leading to excessive
    host memory consumption.
  - #5760: Fixed HID (Hardware ID) of VMGenID device so that it
    aligns with the upstream Linux kernel. This caused the driver
    not to be bound correctly to the device prior to Linux kernel
    6.10.
  - #5764: Fixed a bug that caused the guest UART driver to get
    stuck and stop transmitting after snapshot restore. The bug
    was triggered by taking a snapshot while a serial
    transmission was taking place. On restore the driver would
    wait for a TX interrupt that would never arrive and no output
    would appear in the serial console.
  - #5780: Fixed missing /sys/devices/system/cpu/cpu*/cache/* in
    aarch64 guests when running on host kernels >= 6.3 with guest
    kernels >= 6.1.156.
  - #5793: Fixed virtio-mem plug/unplug skipping KVM slot updates
    for memory blocks not aligned to a slot boundary. On plug,
    this could leave hotplugged memory inaccessible to the guest.
    On unplug, the guest could retain access to memory that
    Firecracker considered freed.
  - #5794: Bound balloon statistics descriptor length to prevent
    a guest-controlled oversized descriptor from temporarily
    stalling the VMM event loop. Only affects microVMs with
    stats_polling_interval_s > 0.
  - #5809: Fixed a bug on host Linux >= 5.16 for x86_64 guests
    using the kvm-clock clock source causing the monotonic clock
    to jump on restore by the wall-clock time elapsed since the
    snapshot was taken. Users using kvm-clock that want to
    explicitly advance the clock with KVM_CLOCK_REALTIME can opt
    back in using the new clock_realtime flag in LoadSnapshot
    API.
  - #5738: Fixed x86_64 snapshot serialization to cover the full
    KVM custom MSR range (0x4b564d00-0x4b564dff) instead of a
    small subset. Previously, some KVM MSRs such as
    MSR_KVM_ASYNC_PF_INT and MSR_KVM_ASYNC_PF_ACK were missing
    from snapshots, which could cause issues on restore.
  - #5818: Enforce the virtio device initialization sequence in
    the PCI transport, matching the existing MMIO transport
    behavior. The PCI transport now validates device status
    transitions, rejects queue configuration writes outside the
    FEATURES_OK to DRIVER_OK window, rejects feature negotiation
    outside the DRIVER state, blocks re-initialization after a
    failed reset, and sets DEVICE_NEEDS_RESET when device
    activation fails.
  - #5818: Reject device status writes that clear previously set
    bits in the MMIO transport, except for reset.
  - #5884: Corrected the OpenAPI spec for PATCH
    /balloon/hinting/start and PATCH /balloon/hinting/stop to
    declare 204 No Content instead of 200, matching the actual
    runtime response.
  - #5882: Fixed a race in the vsock device where, after snapshot
    restore, the RX queue could deliver data to the guest before
    it had acknowledged the TRANSPORT_RESET event, causing
    established connections to break.

++++ flannel:

  - Update to version 0.28.5:
    * Bump docker/login-action from 4.1.0 to 4.2.0
    * Bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    * Bump docker/metadata-action from 6.0.0 to 6.1.0
    * Bump github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common (#2456)
    * Bump the etcd group with 4 updates (#2455), includes fix for CVE-2026-44283 (bsc#1265337)
    * Bump github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common (#2448)
    * Bump golang.org/x/sys in the other-go-modules group (#2449)
    * Bump docker/build-push-action from 7.1.0 to 7.2.0 (#2451)
    * Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#2453)
    * Bump github/codeql-action from 4.35.3 to 4.36.0 (#2450)
    * Update iptables-wrapper to v3 to fix zombie child process
    * Bump docker/setup-buildx-action from 4.0.0 to 4.1.0
    * Bump github/codeql-action from 4.35.2 to 4.35.3 (#2441)
    * Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 (#2436)
    * fix(vxlan): drop slices, use scalar IPs for v4/v6 (review feedback)
    * fix(vxlan): guard ifaceAddrsV6[0] on IPv4-only setups
    * Bump the tencent group with 2 updates (#2430)
    * BUmp k8s deps to v0.33.11 (#2432)
    * Bump github/codeql-action from 4.35.1 to 4.35.2 (#2431)
    * Fail early in e2e tests and remove unnecessary step (#2429)
    * Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#2421)

++++ flatpak:

  - Update to version 1.18.0:
    + Enhancements:
  - Improve error handling and printed output of
    flatpak-coredumpctl
  - Support the AMD vendor specific compute interface (/dev/kfd)
    via the DRI device permission
  - Improve the output of flatpak update with failure causes
  - Improve startup time for fish shell integration
    + Bug fixes:
  - Fix building when HAVE_LIBSYSTEMD but not USE_SYSTEM_HELPER
    is defined
  - Ignore system bus failures in parental controls check
  - Fix some return values and replace deprecated GTimeVal with
    g_get_real_time()
  - Suppress an unused-result warning in the tests
    + Updated translations.
  - Stop passing http_backend=curl to meson setup, no longer needed,
    nor recognized.
  - Drop patch fixed upstream:
    + 1262051-selinux-flatpak.if-should-be-installed-in-distribute.patch

++++ freeipmi:

  - Update to version 1.6.18:
    * Fix bsc#1267605 - CVE-2026-50031:
    + ipmi-oem/ipmi-oem-dell.c
    (ipmi_oem_dell_get_active_directory_config): Fix potential stack
    corruption.
    + ipmi-oem/ipmi-oem-fujitsu.c
    (ipmi_oem_fujitsu_get_sel_entry_long_text): Fix potential buffer
    overflow.

++++ gearlever:

  - Update to version 4.5.4:
    * version bump
    * version bump
    * updated pot file
    * Revert workflow image changes, update only Flatpak manifest
    * Update GNOME SDK to version 50
    * Distinguish "release file not found" from "no updates available"
    * Strip whitespace from update config form fields
    * Change logging location to XDG_STATE_HOME
    * update es.po
  - Update to version 4.5.3:
    * version bump
    * prefent custom updarte config to be overwritten after update
    * show the default update model
    * fixed issues with forejo updater
    * show more interactive download status
    * fixed metainfo file
  - Update to version 4.5.2:
    * added return type
    * fixed errors with cli
    * updated screenshots
    * fixed issue with backgroup update checker
    * version bump
  - Update to version 4.5.1:
    * version bump
    * fixed save button not activating
    * fixed update manager allow prereleases toggle
  - Update to version 4.5.0:
    * version bump
    * fixed issues revealed by automated tests
    * update test suite
    * updated tests
    * updated test suite
    * allow static updater to support http url as embedded url
    * fixed an issue with invalid property
    * fixed version number string
    * meson: rollback version number
    * fixed issue in static file updater
    * updated metainfo
    * version bump
    * run workflow only on master branch
    * updated settings.json
    * updated static file manager check
    * bug fixes
    * removed meson old function
    * fixed cli code
    * gitlab: fix
    * updated gitlab configuration
    * updated deps
    * delete app update config leftover on uninstall
    * improved app uninstall
    * removed old code
    * version bump
    * removed leftover file
    * restored main file
    * fix ftp updater
    * updated min meson version
    * updated row titles
    * removed old code
    * wip codeberg
    * check if new config already exists
    * wip refactoring
    * wip
    * removed old code
    * wip new config
    * wip
    * wip
    * wip ini configuration
    * wip
    * wip rewrite update system
    * updated settings.json
    * wip refactor gitlab
    * fix syntax error
    * removed old functions
    * updated squashfs
    * wip
    * wiè
    * updated libs
    * wip
    * wip
    * wip remove update_url
    * wip
    * wip

++++ ghc-crypto-token:

  - Update crypto-token to version 0.1.2 revision 1.
    Upstream has revised the Cabal build instructions on Hackage.

++++ ghc-xmonad-contrib:

  - Update xmonad-contrib to version 0.18.2 revision 1.
    Upstream has edited the change log file since the last release in
    a non-trivial way, i.e. they did more than just add a new entry
    at the top. You can review the file at:
    http://hackage.haskell.org/package/xmonad-contrib-0.18.2/src/CHANGES.md

++++ git-town:

  - Update to version 23.0.2:
    * Bug Fixes
  - Fixed breadcrumb rendering for Bitbucket-based forges
    (#6228).
  - Added an extra safety check to prevent Git Town from deleting
    the main branch on the remote (#6220).
  - Fixed handling of worktrees backed by bare repositories
    (#6220).

++++ glab:

  - Update to version 1.102.0:
    * Features
  - 044e5b03: feat(api): forward DUO_WORKFLOW_WORKFLOW_ID as
    X-Gitlab-Duo-Workflow-Id header (Eduardo Bonet
    ebonet@gitlab.com)
  - 12cfcf44: feat(api): forward GITLAB_DUO_SESSION_ID as
    X-Gitlab-Duo-Session-Id header (Eduardo Bonet
    ebonet@gitlab.com)
  - d64700ce: feat(repo): add prune command to delete merged
    local branches (Kai Armstrong karmstrong@gitlab.com)
  - e1cd4cf0: feat(skills): notify when installed skills have
    updates (Kai Armstrong karmstrong@gitlab.com)
  - fadd3939: feat(whatsnew): add command and post-upgrade banner
    (Kai Armstrong karmstrong@gitlab.com)
    * Bug Fixes
  - d914d050: fix(api): URL-encode magic placeholder
    substitutions (Kai Armstrong karmstrong@gitlab.com)
  - 98a00775: fix(binarymgr): sort packages by semver client-side
    (Kai Armstrong karmstrong@gitlab.com)
    * Documentation
  - 65169664: docs(duo): expand MR review instructions from 3 to
    17 blocks (Kai Armstrong karmstrong@gitlab.com)
  - 38602dd2: docs(iteration): add synopsis and examples to
    iteration commands (Brendan Lynch blynch@gitlab.com)
  - 2f6cb6d5: docs(mr): add synopsis and examples to mr commands
    (Brendan Lynch blynch@gitlab.com)
  - 40d9474f: docs(opentofu): add synopsis and examples to
    opentofu commands (Brendan Lynch blynch@gitlab.com)
  - a9fe77fd: docs(release): add synopsis and examples to release
    commands (Brendan Lynch blynch@gitlab.com)
  - ecd623cb: docs(repo): add synopsis and fix usage notation in
    repo commands (Brendan Lynch blynch@gitlab.com)
  - d788de5e: docs(snippet): add synopsis and examples to snippet
    commands (Brendan Lynch blynch@gitlab.com)
  - 49f80867: docs(todo): add synopsis and examples to todo
    commands (Brendan Lynch blynch@gitlab.com)
  - 42fb614b: docs: Format quoted command references as code in
    env vars table (Ben Bodenmiller bbodenmiller@gmail.com)
  - c9507bbf: docs: add synopsis and examples to issue and
    incident commands (Brendan Lynch blynch@gitlab.com)
  - eb4fec3f: docs: add synopsis and examples to misc standalone
    commands (Brendan Lynch blynch@gitlab.com)
  - 5f87ec4c: docs: document GLAB_NO_PROMPT and mark NO_PROMPT
    deprecated (Ben Bodenmiller bbodenmiller@gmail.com)
  - f4b2593b: docs: fix flag punctuation and example formatting
    (quick wins) (Brendan Lynch blynch@gitlab.com)
  - d9a6681e: docs: update AGENTS.md with comprehensive agent
    instructions (Brendan Lynch blynch@gitlab.com)
  - 2e64fa29: docs: update README environment variables (Brendan
    Lynch blynch@gitlab.com)
  - 6734e7ab: docs: update env vars table to use GLAB_ prefixed
    names (Kate Grechishkina khrechyshkina@gitlab.com)
    * Dependencies
  - d8ca77c7: chore(deps): update dependency
    @commitlint/config-conventional to ^21.0.2 (GitLab Renovate
    Bot gitlab-bot@gitlab.com)
  - 21f186ce: chore(deps): update dependency @commitlint/read to
    ^21.0.2 (GitLab Renovate Bot gitlab-bot@gitlab.com)
    * Maintenance
  - d4a4afeb: chore(lint): enable 19 new linters and address
    violations (Kai Armstrong karmstrong@gitlab.com)
  - 19c91cc9: refactor(config): canonical schema with config set
    validation (Kai Armstrong karmstrong@gitlab.com)
  - 98cbeebf: refactor(config): do not use StubConfig in tests
    (Timo Furrer tfurrer@gitlab.com)
  - 1e5735ef: refactor(config): follow ups (Timo Furrer
    tfurrer@gitlab.com)
  - bced871c: refactor(config): give each Config its own
    persistence directory (Timo Furrer tfurrer@gitlab.com)
  - a95fae2a: refactor(config): remove global config stubbers
    (Timo Furrer tfurrer@gitlab.com)
  - 769e47ec: refactor(glrepo): inject config instead of reaching
    for the global (Timo Furrer tfurrer@gitlab.com)
  - refactor patch glab-disable_update_check.patch to have it apply
    to the current code base

++++ gn:

  - Update to version 0.20260605:
    * Introduce --format-width option (and format_width .gn variable).
    * Resolve suggest inputs relative to target include directories.
    * Consider target outputs as existing files in `gn suggest`.
    * Reland "Fix toolchain dependencies not triggering rebuilds in Ninja"
    * Fix build with GCC 16 on musl by adding missing <cstdint>
    * Add module_deps[_no_self] to the default test toolchain
    * Implement cycle detection and circular dependency handling in `gn suggest`.
    * Reduce ResolvedTargetData lock contention by sharding targets map
    * Implement visibility checks in `gn suggest`.
    * Refactor `OutputSuggestions` to make it testable.
    * Format with c++23 standard
    * Enhance quiet mode.
    * Fix pretty printing of string literals.
    * Fix PointerSet and BuilderRecordMap iterators under C++23
    * Don't print the request when there's only one.
    * Bypass group targets for order-only deps in source set stamp files
    * Fix complete_static_lib to include Rust libraries.
    * Exports group's target "data" property
    * Optimize OrderOnlyDeps computation using ResolvedTargetData caching
    * Format gn src with run_formatter.sh
    * gn format: 80-character comment wrapping and reflowing improvements
    * Build with C++23
    * Revert "Fix toolchain dependencies not triggering rebuilds in Ninja"
    * Roll windows toolchain
    * Fix C++23 compilation errors
    * Fix toolchain dependencies not triggering rebuilds in Ninja
    * [gn] Bypass groups in order-only deps to use source set linkdeps
    * Update reference.md

++++ onboard:

  - Update to version 1.4.4-3:
    * Fixes:
  - fix: prevent crash on shutdown caused by BadWindow X error
  - fix: suppress Gdk-CRITICAL on exit, cancel pending idle
    handler
  - fix: use malloc/free instead of PyMem in PoolAllocator to
    prevent SIGSEGV on exit

++++ golang-github-prometheus-alertmanager:

  - update to 0.32.2:
    * [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup
    swap. #5241

++++ goreleaser:

  - Update to version 2.16.0:
    * chore: skip one more docker test on windows
    * chore: auto-update generated files
    * docs: updates
    * docs: updates
    * chore: update schema
    * feat(dockers_v2): pre/post hooks (#6634)
    * chore(deps): bump the gomod group with 2 updates (#6635)
    * ci(deps): bump the actions group with 5 updates (#6636)
    * chore(deps): bump the docker group across 1 directory with 2 updates (#6637)
    * chore: auto-update generated files
    * chore: fmt
    * chore(deps): update go-github to v88
    * fix: run script resolves nightly tags
    * feat(deps): update docker in docker image
    * chore(deps): update go-github to v87
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#6632)
    * docs: better install page (#6631)
    * docs: cleanup install
    * docs: improve install page
    * chore(www): update hextra
    * fix: handle secondary rate limits on github (#6630)
    * docs: add RWX CI guide (#6597)
    * ci(deps): update goreleaser-action
    * chore: auto-update generated files
    * feat(dockers_v2): remove experimental warn
    * feat: proper deprecate brews
    * docs: update
    * feat(nix): support meta.mainProgram (#6627)
    * feat(dockers_v2): set extra.platforms in the artifact (#6628)
    * test: fix golden file
    * fix: change keyword color
    * chore: gofumpt
    * chore: remove unused struct
    * feat(dockers_v2): baseimage and baseimagedigest template variables (#6625)
    * chore: auto-update generated files
    * test: disable gc auto (#6624)
    * fix(srpm): set format and extension in extra (#6623)
    * ci(deps): bump the actions group with 2 updates (#6619)
    * chore(deps): bump docker/buildx-bin from 0.33.0 to 0.34.0 in the docker group across 1 directory (#6620)
    * chore(deps): bump the gomod group with 3 updates (#6622)
    * chore: auto-update generated files
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#6614)
    * chore(deps): update docker
    * chore: update golang.org/x/
    * ci: check with goreleaser pro
    * docs: update
    * feat: go1.26.3
    * ci(deps): bump the actions group with 4 updates (#6607)
    * chore(deps): bump the gomod group with 4 updates (#6606)
    * chore(deps): bump the docker group across 1 directory with 2 updates (#6608)
    * docs: add slack to users list (#6605)
    * chore: auto-update generated files
    * chore: auto-update generated files
    * docs: fix invalid 'neq' template function in pkg example (#6604)
    * chore: auto-update generated files
    * docs: update users.md
    * fix(github): remove author lookup by email (#6601)
    * chore: auto-update generated files
    * chore(deps): bump github.com/distribution/distribution/v3 from 3.1.0 to 3.1.1 (#6598)
    * ci: cleanup old nightly releases
    * chore: update
    * docs: parallax effect on homepage (#6596)
    * ci: fix full changelog link for nightlies
    * ci: simplify goreleaser config
    * docs: missing required version
    * ci: fix notification url
    * ci: fix version template
    * docs: update link
    * feat(builders): add node sea support (#6579)
    * ci: fix goreleaser config
    * ci: fix discord notification
    * chore: auto-update generated files
    * docs: fix rendering issue inside tabs
    * ci: fix goreleaser config
    * fix(cask): emit generate_completions_from_executable after postflight (#6594)
    * chore(deps): bump the gomod group with 4 updates (#6595)
    * docs: rm old docs instructions
    * fix(github): preserve prerelease publish fields
    * docs: dont include nightlies in releases.json
    * chore: auto-update generated files
    * fix(github): preserve prerelease on publish (#6591)
    * ci(deps): bump the actions group across 1 directory with 3 updates (#6588)
    * chore(deps): bump the gomod group with 3 updates (#6587)
    * chore(deps): bump the docker group across 1 directory with 2 updates (#6589)
    * fix(xz): rm unused field
    * docs: fix logos
    * docs(actions): note immutable nightly resolution (#6590)
    * ci: ign nightly tags
    * ci(deps): update goreleaser action
    * ci: goreleaser config
    * ci: fix config
    * ci: prerelease
    * chore: auto-update generated files
    * docs: updat
    * feat(archive): xz format (#6520)
    * ci: nightly unique tag name
    * fix: wrong goreleaser URL  (#6584)
    * fix: webhook error handling improvements
    * fix:linkedin error handling improvements
    * chore: auto-update generated files
    * chore: auto-update generated files

++++ gosec:

  - Update to version 2.27.1:
    * Downgrade google lib to avoid min Go version bump (#1687)
    * Downgrade the jsonschema dep to v0.13.0 due to incompatibility with anthropick-sdk-go (#1686)
    * Update all dependencies (#1685)
    * Downgrade the github.com/invopop/jsonschema v0.13.0 to solve incopatibility with anthropic-sdk (#1683)
    * Update all dependencies (#1682)
    * Update vulnerabilities alerts for indirect dependencies
    * Pin dependencies (#1681)
    * Skip pining for my repos
    * Update renovate configuration
    * Fix typo
    * Update branch config in renovate config
    * Migrate config renovate.json (#1678)
    * Update renovate to refresh the branch creation
    * Update the renovate branch prefix
    * Update renovate config to pin the actions dependencies by digests (#1676)
    * Migrate the html remport to react v19. (#1675)
    * Manually update version to fix renovate (#1674)
    * feat: integrate Atlas Cloud provider (#1672)
    * Refactor error position parsing to support path with colon. (#1673)
    * Add two options to require rule ID and justificaiton for inline annotations (#1671)
    * Fix false positive in G118 when cancel is stored in a slice/map (#1670)
    * chore(go): update supported Go versions to 1.25.10 and 1.26.3 (#1669)
    * Harden the github workflows and action (#1665)
    * Fix justification delimiter in annotation format doc (#1661)
    * Update all dependencies (#1664)
    * Update action to use gosec version v2.26.1 (#1660)

++++ grant:

  - Update to version 0.6.7:
    * chore(deps): update anchore dependencies (#518)
    * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)

++++ grype:

  - Update to version 0.114.0:
    * Added Features
  - Add ability to scan zarf packages [#3329 #3366 @brandtkeller]
    * Additional Changes
  - respect withdrawn status of Go Vuln DB OSV records [#3495
    @willmurphyscode]
  - Govulndb OSV transformer [#3485 @willmurphyscode]
    * Dependencies
  - chore(deps): update anchore dependencies (#3487)
  - chore(deps): update quality gate database (#3478)
  - chore(deps): update tool versions (#3488)

++++ homebank:

  - Update to 5.10.1
    * change: the input field helper icon + fixed some spacing
    inconsistency
    * change: transaction, added some missing input tooltips and
    reworked existing
    * change: category, payee and tag window add input now have a
    tooltip and button
    * change: split window, refactored the layout
    * change: split window, add display of memo and date
    * wish  : lp#2106800 budget report option to exclude transfers
    from unbudgeted line
    * bugfix: prevent deletion of non pending transaction when
    rejecting
    * bugfix: transaction warning for no rate faultly showing
    in transfer
    * bugfix: report missing space for filter tooltip icon
    * bugfix: budget report missing filter tooltip
    * bugfix: manage account closed icon was hidding budget icon
    * bugfix: lp#2154771 view transcations requires hitting
    Escape or X twice to close dialog
    * bugfix: lp#2154337 transfer to/from closed account with
    different currency don't show the amount
    * bugfix: lp#2154234 scheduled transaction recurring pattern
    daily value limited to 100
    * bugfix: lp#2149897 view split for closed accounts
    * bugfix: lp#2148561 global time chart do not shows current
    period by default
    * bugfix: lp#2148456 the main screen Total Chart is no longer
    showing an overall total
    * bugfix: lp#2147497 editing a transaction resets scroll
    position
    * bugfix: lp#2147377 balance mixup with transaction same day
    sort by amount
    * bugfix: lp#2147052 quarter are wrong when fiscal year is
    jan 1
    * bugfix: lp#2147048 all events for the month are late but
    today is only the 1st
    * bugfix: lp#2144993 impossible to search for transactions
    by value for values >999,99
    * bugfix: lp#2144698 adding new Category/Payee/Tags requires
    hitting -Enter-
    * bugfix: lp#2144419 QIF Account name detection fail on import
    * bugfix: lp#2142349 can't delete account groups
    * bugfix: lp#2139409 account maximum limit is not fully used
    (example credit card)
    * bugfix: lp#2133783 transfers shouldn't add to dashboard top
    spending reports
  - Drop Leap 15 workarounds because Leap 15 is EOL

++++ hubble:

  - Update to version 1.19.4:
    * chore(deps): update golang to v1.26.4
    * chore(deps): update dependency cilium/cilium to v1.19.4
    * chore(deps): update dependency helm/helm to v4.2.0
    * chore(deps): update golang to v1.26.3
    * chore(deps): update dependency helm/helm to v4
    * chore(deps): update module go.opentelemetry.io/otel to v1.41.0
    [security]
    * chore(deps): update azure/setup-helm action to v5
    * .github: Fix GitHub release workflow when triggered by
    workflow_dispatch
    * .github: Add workflow_dispatch to release.yml
    * .github: Add permissions for release workflow

++++ hyprland:

  - Update to version 0.55.3:
    + A small (or maybe not that small) patch release backporting some
    fixes from main onto 0.55.2.
    + Fixes backported:
  - hyprctl: add config full-reload for performing a ground-up
    reload (#14748)
  - meta/lua: add missing notification text field and make timeout
    required (#14665)
  - binds/submap: fix submap enter bind == bind inside submap
    (#14856)
  - compositor: fix monitor re-enabling on hotplug when dpms is off
    (#14818)
  - compositor: fix render unfocused for subsurfaces (#14718)
  - config/actions: fix null derefs in pin dispatcher (#14914)
  - config: fix VRR not applying on runtime change (#14744)
  - config: fix decoration values to refresh on runtime
    eval/keyword change (#14590)
  - core: fix a few fd leaks (#14870)
  - decoration/glow: fix visibility when no decorate is set
    (#14602)
  - desktop/popup: fix reposition artifacts (#14820)
  - desktop/window: fix wrong scale being applied after workspace
    rules (#14832)
  - internal: fix null deref in setWindowFullscreenInternal when
    fullscreen state stale (#14725)
  - jeremy: fix auto-generating hyprlang instead of lua config file
    by default (#14944)
  - renderer: fix cursor:zoom_rigid being ignored with detached
    camera (#14995)
  - renderer: fix screenshader with fp16 (#14918)
  - renderer: minor shader fixes (#14584)
  - screencopy: fix screenshare copyfb pending frames (#14837)
  - xwayland: fix ICCCM synthetic event comparison (#14827)
  - algo/master: guard target in remove (#14756)
  - compositor: give preference to same-workspace windows in
    getWindowInDirection (#14941)
  - config/lua: improve error handle-ability with Lua require
    (#14937)
  - config/lua: report errors better without check* (#14695)
  - config/monitor: refresh splash texture on monitor reload
    (#14632)
  - config/propRefresher: schedule frames on screen shader refresh
    (#14874)
  - desktop/rule: optimize mapping rule properties to strings and
    engines (#14945)
  - desktop/window: allow focus while held to non-OR X11 windows
    (#14821)
  - input: aggregate modifier states from all keyboards on focus
    enter (#14633)
  - internal: replace O_CLOEXEC with FD_CLOEXEC for file descriptor
    flags (#14909)
  - keybinds: set a fallback releasePending flag for special lua
    binds (#14600)
  - keybinds: store hit binds first, then execute callbacks
    (#14743)
  - layersurface: inform layer surfaces of scale changes (#14771)
  - layout/dragController: reset floating offset on ended drag
    (#14940)
  - layout/scrolling: check if cursor overlaps with target in
    focusOnInput (#14687)
  - main: gain SCHED_RR and drop CAP_SYS_NICE earlier (#14897)
  - meta/lua: Gestures can accept a lua function (#14649)
  - monitor: move floating windows with layout changes (#14928)
  - monitor: retry transient mode selection failures (#14927)
  - protocols/fractional-scale: track if scale is known and send
    scales eagerly when known (#14798)
  - protocols: bump xdg-decoration to rev 2 (#14869)
  - renderer/gl: release failed fence syncs (#14956)
  - renderer/gl: skip invalidation clear on empty damage (#14921)
  - renderer: reduce per-frame heap allocations (#14932)
  - renderer: send frame callbacks on presented if no change
    (#14849)
  - texture: cache G and A swizzle channels aswell (#14605)

++++ k9s:

  - update to 0.51.0:
    * #4026 fix(xray): disable edit/delete actions in XRay view when
    readonly mode is enabled
    * #4024 Fix 'J'umping to owner of cluster scoped resources
    * #4005 Fix pod status for sidecar init containers
    * #4001 Adjust namespace handling for RBAC checks in
    CanForResource and CanForInstance
    * #3997 chore: fix wrong function name in comment
    * #3993 fix(browser): show syncing status instead of spurious
    no-resources warning
    * #3989 perf: skip reconcile cycle when informer data is
    unchanged
    * #3988 perf: raise default client QPS from 5 to 50
    * #3987 fix: paginate metrics API calls to prevent timeout on
    large clusters
    * #3986 perf: batch Hydrate workers to eliminate per-item
    goroutine overhead
    * #3917 Respect wide columns in default view
    * #3911 fix: reset styles before loading skin on context switch
    * #3908 fix: populate pod count in Node.Get() for single-node
    view
    * #3902 Add OSC52 clipboard backend with native fallback
    * #3888 feat: add One Light skin
    * #3879 feat: allow users to cycle pulse grid selection forwards
    and backwards
    * #3873 feat: enhance pvc-shell configuration with dynamic inputs
    and RWO support
    * #3872 Add default confirm:true for plugins with inputs
    * #3871 internal/render: prevent index out of range panic in
    initContainerStats
    * #3865 Handle blank PVC capacities for the purpose of sorting
    * #3854 feat: enhance debug container configuration with input
    fields
    * #3851 Use *grey instead of grey in black-and-wtf.yaml
    * #3839 fix: optimize context switching to reduce redundant API
    calls
    * #3823 feat: add resize PVC plugin for dynamic storage resizing
    * #3821 feat: add support for plugin input fields
    * #3817 Fix Readme: Ubuntu installation command not working
    * #3798 Fix boom on Jumping Owner in rare cases
    * #3797 feat: add extra hints for column navigation in table view
    * #3792 fix: adjust resource access checks for namespace
    resources
    * #3783 fix: avoid logging errors when no context is configured
    * #3780 feat: add selected color to table header
    * #3736 feat: add custom resource jump support

++++ kernel-default:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-source:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-docs:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-kvmsmall:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-obs-build:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-obs-qa:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-syms:

  - update to 7.1-rc7
  - commit f7dda10

++++ kernel-vanilla:

  - update to 7.1-rc7
  - commit f7dda10

++++ kstars:

  - Update to 3.8.3:
    * https://invent.kde.org/education/kstars/-/blob/stable-3.8.3/ChangeLog

++++ kubectl-view-allocations:

  - Update to version 3.0.1:
    * No changes, only release fix for krew
  - Update to version 3.0.0:
    * Refactoring
  - [breaking] Shrink public API surface, add #[non_exhaustive]
    (1bf24d6)
  - Split lib.rs into modules, fix async, rename enums, harden
    CSV (873b50d)
  - Update to version 2.0.0:
    * Bug Fixes
  - Update (7447c2a)
    * Documentation
  - Update and rework README & SKILL (0486caa)
    * Features
  - Add multi-column local sibling sort via --sort (50bf067)
  - Add kubectl-view-allocations AI coding skill (#333) (847843e)
    * Refactoring
  - Rename .mise.toml into mise.toml (66117db)
  - Format (259773d)
    * Dependencies
  - Bump mozilla-actions/sccache-action from 0.0.9 to 0.0.10
    (#332)

++++ kumactl:

  - Update to version 2.13.8:
    * chore(deps): update Envoy to 1.36.7 (#16870)
    * chore(deps): security update (#16866)
  - github.com/docker/docker to 28.5.1
  - golang to 1.26.4 (GO-2026-5037, GO-2026-5038, GO-2026-5039)

++++ less:

  - Update to 704:
    * Fix possibly passing unsafe options to man when opening an OSC
    8 link
    * Fix possibly sending unsafe OSC sequence to terminal when file
    contains an unterminated OSC sequence
    * In Examine and Shell commands, expand % and # to shell-escaped
    filenames

++++ lftp:

  - Revert changes to "lftp-4.9.2-cdefs.patch" from 2025-08-06. The
    updated patch does not apply to our code and breaks the build on
    ppc64le. We'll stick to our local copy for the time being instead
    of following src.fedoraproject.org.

++++ sdl2-compat:

  - Update to release 2.32.70
    * Fixed showing the on-screen keyboard at application startup.

++++ liquid-dsp:

  - Update to version 1.8.0
    * logging: introduced embedded logging functionality.
    + supports global and custom logs with minimal computational
    overhead.
    + selectable level at run-time to increase/decrease verbosity
    as needed.
    + support for logging to files.
    + color output for enhanced visibility (optionally disabled).
    + compile time configurations for enhanced customization.
    * autotest
    + refactored testing infrastructure to include test-specific
    metadata, estimated 'cost' (execution time), description,
    and keywords
    + overhauled all tests to use new harness; tests now
    thread-safe and statically defined.
    + increased testing: 1,300+ tests, 716,000+ checks, covering
    82% of entire project.
    * build
    + performed a static memory analysis test to substantially
    reduce memory used on the stack in favor of dynamically
    allocating it on the stack; improves stability for
    multi-threaded processing
    + introduced new argument parsing header to simplify creating
    variables, parsing command-line options, printing help, and
    validating results;
    + refactored examples and removed over 2,000 lines of redundant
    code.
    + added CMake rules to create exportable interface, option for
    building.shared vs. static library, and simplified directory
    inclusion.
    + fixed annoying deprecation warnings.
    + added generated pkg-config file.
    + added support for building either/both static and shared
    libraries.
    + adding separate option to find SIMD vs. use it with explicit
    options cleaned up descriptions for most interfaces in header
    file.
    + removed gentab (generated tables) from build environment;
    added pre-generated source to version control.
    + fixed cmake x86 SIMD detection.
    + fixed many typos via codespell.
    * core
    + new module to include core functionality to liquid-dsp
    including logging and error-handling.
    + error-handling macros moved to global header to allow global
    use.
    * fft
    + asgram: adding option for auto-scaling output.
    * filter
    + rresamp: fixed aliasing issue with default operation.
    + symsync: added methods to explicitly get/set rate and del
    values.
    + firdespm: devising halfband filter design with desired stop
    band firfilt: fix recreate() storing coefficients in reverse
    order.
    * framing
    + fskframe: refactored object to allow for dynamically-sized
    payload, but removed ability to specify CRC and FEC for now.
    + added ability to initialize qdsync on cpfsk.
    + framesync64: adding option to set detection range.
    + qdetector: improved reliability, speed, interface
    * vector
    + added more SIMD methods for AVX, NEON extensions.
    + added more benchmarks to identify areas for speed improvement
  - Drop patch:
    * fix-chromosome-32bit.patch
  - Add patch:
    * liquid-dsp-libsuffix.patch

++++ ncurses:

  - Add ncurses patch 20260607
    + actually add kmscon (report by Branden Robinson)
  - Add ncurses patch 20260606
    + add kmscon (report by Jocelyn Falempe) -TD
    + fix a minor regression in infocmp -g option.
    + fixes for compiler warnings/cppcheck.

++++ openssl-3:

  - Security fixes:
    * CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
    * CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356)
    * CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353)
    * CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355)
    * CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350)
    * CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351)
    * CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352)
    * CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349)
    * CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345)
    * CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
    * CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
    * CVE-2026-9076:  Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341)
    * CVE-2026-7383:  Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340)
    * CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342)
    * Add patches:
    openssl-CVE-2026-45447.patch
    openssl-CVE-2026-45446.patch
    openssl-CVE-2026-42770.patch
    openssl-CVE-2026-45445.patch
    openssl-CVE-2026-42767.patch
    openssl-CVE-2026-42768.patch
    openssl-CVE-2026-42769.patch
    openssl-CVE-2026-42766.patch
    openssl-CVE-2026-34183.patch
    openssl-CVE-2026-42764.patch
    openssl-CVE-2026-34182.patch
    openssl-CVE-2026-9076.patch
    openssl-CVE-2026-7383.patch
    openssl-CVE-2026-34180.patch

++++ profanity:

  - Update to 0.18.2:
    Bug Fixes:
    * Guard terminal writes while suspended (#2167)
    * Prevent OTR handshake from leaking presence to strangers (#2168)
    * Silence 'no key' error for key transport messages (#2171)
    Build System:
    * Add configurable docdir option for documentation (#2174)

++++ radcli:

  - Update to version 1.5.2
    * tls: defer TCP connect and TLS handshake to first use. This
    addresses the issue of radcli connecting to TLS server
    during rc_read_config().

++++ libstorage-ng:

  - Translated using Weblate (Danish) (bsc#1149754)
  - 4.5.329

++++ python-torch:

  - Update to v2.12.0 which uses _service and so does the vendoring via
    git submodules, this leads to the removal of following previosly vendored
    sources and patches:
    * FP16-4dfe081.tar.gz
    * FXdiv-b408327.tar.gz
    * XNNPACK-51a0103.tar.gz
    * add-cstdint.patch
    * cpp-httplib-3b6597b.tar.gz
    * cpuinfo-1e83a2f.tar.gz
    * flatbuffers-01834de.tar.gz
    * fmt-1239137.tar.gz
    * gemmlowp-3fb5c17.tar.gz
    * gloo-5354032.tar.gz
    * gloo-gcc15-fix.patch
    * kineto-a054a4b.tar.gz
    * kleidiai-cca02c2.tar.gz
    * libnop-910b558.tar.gz
    * onnx-b8baa84.tar.gz
    * opentelemetry-cpp-a799f4a.tar.gz
    * pocketfft-9d3ab05.tar.gz
    * psimd-072586a.tar.gz
    * pthreadpool-4fe0e1e.tar.gz
    * pybind11-a2e59f0.tar.gz
    * pytorch-2.7.1.tar.gz
    * sleef-56e1f79.tar.gz
    * tensorpipe-52791a2.tar.gz
    * fix-setup.patch
  - Added disable-py312-intrinsics.patch which disables test for incomaptible python3.12
  - increased limits for build machines
  - Highlights of v2.12.0:
    * Batched linalg.eigh on CUDA is up to 100x faster due to updated cuSolver
    backend selection
    * Added new torch.accelerator.Graph API to unify graph capture and replay
    across CUDA, XPU, and out-of-tree backends
    * Added torch.export.save support for Microscaling (MX) quantization formats
    * Adagrad optimizer now supports fused=True for a single-kernel optimizer
    * torch.cond control flow can now be captured and replayed inside CUDA Graphs
    * ROCm improvements include expandable memory segments, rocSHMEM symmetric
    memory collectives, and FlexAttention pipelining
    * Python 3.14 support: Added experimental support for torch.compile()
  - Backwards Incompatible & Breaking Changes in v2.12.0:
    * C++20 minimum is now enforced in CMake build files
    * SVE Compile Checks strictly validated in FindARM.cmake
    * torch.distributed.nn.functional ops now raise RuntimeError under torch.compile
    (users should migrate to functional collectives API)
    * torchrun port default is now dynamically assigned (OS-allocated free port)
    instead of static port 29500
    * Deprecated CUDA 12.8 builds in favor of CUDA 13.0
    * MAGMA backend deprecated for some operators, dispatching to cuSolver or cuBLAS
  - Summarized highlights and breaking changes from intermediate versions (v2.8.0 to v2.11.0):
    * Highlights from v2.11.0:
  - Differentiable Collectives support for functional collectives in distributed
    training
  - Expanded operator support for Metal Performance Shaders (MPS) on XPU Graph support
    for Intel XPU backends
    * Backwards Incompatible & Breaking Changes from v2.11.0:
  - DLPack objects updated to align with the latest DLPack release,
    potentially breaking low-level integrations using torch.utils.dlpack
    * Highlights from v2.10.0:
  - Full support for torch.compile() on Python 3.14, with experimental support
    for free-threaded builds (Python 3.14t)
  - New DebugMode tool for tracking dispatched calls and debugging numerical
    divergence; horizontal fusion of combo-kernels to reduce launch overhead
    in torchinductor
    * Backwards Incompatible & Breaking Changes from v2.10.0:
  - Sampler data_source argument removed from DataLoader, and legacy grouping
    datapipes imports removed (use sharding datapipes instead)
  - fallback=False is now the default in torch.onnx.export (defaults to
    dynamo=True without fallback)
  - Nested Jagged Tensor support removed from flex_attention
  - TorchScript (torch.jit) is officially deprecated and not guaranteed to work
    on Python 3.14
    * Highlights from v2.9.0:
  - Symmetric Memory feature enabling high-performance programming of multi-GPU
    kernels
  - Stable libtorch ABI updates with torch::stable::Tensor APIs and device/stream
    utilities
  - Arbitrary toggle between error or resume on graph breaks in torch.compile for
    debuggability
    * Backwards Incompatible & Breaking Changes from v2.9.0:
  - Minimum supported Python version updated to 3.10 (Python 3.9 support dropped)
  - DLPack upgraded to 1.0, breaking torch.utils.dlpack low-level APIs
  - Outputs of custom operators registered via torch.library are no longer allowed
    to share storage with input Tensors (can cause undefined behavior under compile)
  - Exception type changes where torch.cat and unsupported dtypes raise specific
    errors (e.g., ValueError, IndexError, NotImplementedError) instead of RuntimeError
    * Highlights from v2.8.0:
  - Introduced limited stable libtorch ABI subset for third-party extensions
  - Native support for high-performance quantized LLM inference on Intel CPUs
  - Inductor CUTLASS backend support for torch.compile and AOTInductor
    * Backwards Incompatible & Breaking Changes from v2.8.0:
  - Dropped Maxwell (sm50) and Pascal (sm60, sm61) GPU support in CUDA 12.8+ builds
    (older GPUs must use CUDA 12.6)
  - Stricter SVE validation in CMake and header cleanup removing implicit
    torch/types.h from Dispatcher.h
  - Error triggered if custom autograd.Function mutates a view of a leaf requiring
    gradients

++++ python-torch-openmpi4:

  - Update to v2.12.0 which uses _service and so does the vendoring via
    git submodules, this leads to the removal of following previosly vendored
    sources and patches:
    * FP16-4dfe081.tar.gz
    * FXdiv-b408327.tar.gz
    * XNNPACK-51a0103.tar.gz
    * add-cstdint.patch
    * cpp-httplib-3b6597b.tar.gz
    * cpuinfo-1e83a2f.tar.gz
    * flatbuffers-01834de.tar.gz
    * fmt-1239137.tar.gz
    * gemmlowp-3fb5c17.tar.gz
    * gloo-5354032.tar.gz
    * gloo-gcc15-fix.patch
    * kineto-a054a4b.tar.gz
    * kleidiai-cca02c2.tar.gz
    * libnop-910b558.tar.gz
    * onnx-b8baa84.tar.gz
    * opentelemetry-cpp-a799f4a.tar.gz
    * pocketfft-9d3ab05.tar.gz
    * psimd-072586a.tar.gz
    * pthreadpool-4fe0e1e.tar.gz
    * pybind11-a2e59f0.tar.gz
    * pytorch-2.7.1.tar.gz
    * sleef-56e1f79.tar.gz
    * tensorpipe-52791a2.tar.gz
    * fix-setup.patch
  - Added disable-py312-intrinsics.patch which disables test for incomaptible python3.12
  - increased limits for build machines
  - Highlights of v2.12.0:
    * Batched linalg.eigh on CUDA is up to 100x faster due to updated cuSolver
    backend selection
    * Added new torch.accelerator.Graph API to unify graph capture and replay
    across CUDA, XPU, and out-of-tree backends
    * Added torch.export.save support for Microscaling (MX) quantization formats
    * Adagrad optimizer now supports fused=True for a single-kernel optimizer
    * torch.cond control flow can now be captured and replayed inside CUDA Graphs
    * ROCm improvements include expandable memory segments, rocSHMEM symmetric
    memory collectives, and FlexAttention pipelining
    * Python 3.14 support: Added experimental support for torch.compile()
  - Backwards Incompatible & Breaking Changes in v2.12.0:
    * C++20 minimum is now enforced in CMake build files
    * SVE Compile Checks strictly validated in FindARM.cmake
    * torch.distributed.nn.functional ops now raise RuntimeError under torch.compile
    (users should migrate to functional collectives API)
    * torchrun port default is now dynamically assigned (OS-allocated free port)
    instead of static port 29500
    * Deprecated CUDA 12.8 builds in favor of CUDA 13.0
    * MAGMA backend deprecated for some operators, dispatching to cuSolver or cuBLAS
  - Summarized highlights and breaking changes from intermediate versions (v2.8.0 to v2.11.0):
    * Highlights from v2.11.0:
  - Differentiable Collectives support for functional collectives in distributed
    training
  - Expanded operator support for Metal Performance Shaders (MPS) on XPU Graph support
    for Intel XPU backends
    * Backwards Incompatible & Breaking Changes from v2.11.0:
  - DLPack objects updated to align with the latest DLPack release,
    potentially breaking low-level integrations using torch.utils.dlpack
    * Highlights from v2.10.0:
  - Full support for torch.compile() on Python 3.14, with experimental support
    for free-threaded builds (Python 3.14t)
  - New DebugMode tool for tracking dispatched calls and debugging numerical
    divergence; horizontal fusion of combo-kernels to reduce launch overhead
    in torchinductor
    * Backwards Incompatible & Breaking Changes from v2.10.0:
  - Sampler data_source argument removed from DataLoader, and legacy grouping
    datapipes imports removed (use sharding datapipes instead)
  - fallback=False is now the default in torch.onnx.export (defaults to
    dynamo=True without fallback)
  - Nested Jagged Tensor support removed from flex_attention
  - TorchScript (torch.jit) is officially deprecated and not guaranteed to work
    on Python 3.14
    * Highlights from v2.9.0:
  - Symmetric Memory feature enabling high-performance programming of multi-GPU
    kernels
  - Stable libtorch ABI updates with torch::stable::Tensor APIs and device/stream
    utilities
  - Arbitrary toggle between error or resume on graph breaks in torch.compile for
    debuggability
    * Backwards Incompatible & Breaking Changes from v2.9.0:
  - Minimum supported Python version updated to 3.10 (Python 3.9 support dropped)
  - DLPack upgraded to 1.0, breaking torch.utils.dlpack low-level APIs
  - Outputs of custom operators registered via torch.library are no longer allowed
    to share storage with input Tensors (can cause undefined behavior under compile)
  - Exception type changes where torch.cat and unsupported dtypes raise specific
    errors (e.g., ValueError, IndexError, NotImplementedError) instead of RuntimeError
    * Highlights from v2.8.0:
  - Introduced limited stable libtorch ABI subset for third-party extensions
  - Native support for high-performance quantized LLM inference on Intel CPUs
  - Inductor CUTLASS backend support for torch.compile and AOTInductor
    * Backwards Incompatible & Breaking Changes from v2.8.0:
  - Dropped Maxwell (sm50) and Pascal (sm60, sm61) GPU support in CUDA 12.8+ builds
    (older GPUs must use CUDA 12.6)
  - Stricter SVE validation in CMake and header cleanup removing implicit
    torch/types.h from Dispatcher.h
  - Error triggered if custom autograd.Function mutates a view of a leaf requiring
    gradients

++++ libzypp:

  - A .repo files "path=" entry must not refer to a location
    outside the repo (bsc#1267874, CVE-2026-44942)
    A "path=" entry may solely denote a sub-directory of the baseurl
    where the metadata are located. A relative path trying to access
    data outside the baseurl is reported and sanitized.
  - version 17.38.13 (35)

++++ linkerd-cli-edge:

  - Update to version 26.6.1:
    * build(deps): bump github.com/prometheus/common from 0.68.0 to
    0.68.1 (#15350)
    * build(deps): bump github.com/go-openapi/spec from 0.22.4 to
    0.22.5 (#15349)
    * build(deps): bump launch-editor from 2.6.1 to 2.14.1 in
    /web/app (#15347)
    * build(deps): bump bitflags from 2.11.1 to 2.12.1 (#15352)
    * build(deps): bump query-string from 9.3.1 to 9.4.0 in /web/app
    (#15334)
    * build(deps-dev): bump webpack-cli from 7.0.2 to 7.0.3 in
    /web/app (#15333)
    * build(deps): bump hyper from 1.10.0 to 1.10.1 (#15341)
    * build(deps): bump zerocopy from 0.8.49 to 0.8.50 (#15342)
    * build(deps): bump cc from 1.2.62 to 1.2.63 (#15340)
    * build(deps): bump typenum from 1.20.0 to 1.20.1 (#15339)
    * build(deps): bump github.com/mattn/go-runewidth from 0.0.23 to
    0.0.24 (#15337)
    * build(deps): bump github.com/prometheus/common from 0.67.5 to
    0.68.0 (#15338)

++++ linux-npu-driver:

  - Fix _service info

++++ melange:

  - Update to version 0.52.1:
    * build(deps): bump actions/checkout in the actions group (#2560)
    * chore(pipelines/xcover): add scope parameter (#2558)
    * build(deps): bump the actions group across 1 directory with 4
    updates (#2554)
    * git-checkout: guard branch+expected-commit against
    stale/diverged commits (#2555)

++++ mesheryctl:

  - update to 1.0.38:
    * General
  - [Chore] update go.mod for wasm policy @leecalcote (#19913)
    * Meshery CLI
  - [Server] Fix typos in error messages @shivv23 (#19868)
    * Maintenance
  - [Server] Fix typos in error messages @shivv23 (#19868)
    * Documentation
  - [Server] Fix typos in error messages @shivv23 (#19868)
  - update to 1.0.37:
    * General
  - chore/upgrade/meshery schemas @CodeAhmedJamil (#19912)
    * Meshery CLI
  - [Performance] Recreate schema-native performance refactor
    @PragalvaXFREZ (#19909)
  - update to 1.0.36:
    * General
  - Revert deletion of install/deployment_yamls (970902f)
    @copilot-swe-agent[bot] (#19864)
  - docs: reverse ROADMAP.MD version order @Annonnymmousss
    (#19816)
  - server: return structured MeshKit errors for workspace input
    validation @YASHvardhanVashistha (#19842)
  - fix(docker): ship policy-engine wasm and wasm_exec.js in
    server image @marblom007 (#19851)
  - Update adopters list with F5 and Mario Arriaga @hamza-mohd
    (#19832)
    * Meshery CLI
  - [Chore] Bump Go version to 1.26.4 @PragalvaXFREZ (#19876)
  - [Chore] Upgrade to go 1.26 @CodeAhmedJamil (#19906)
  - [CI] Makefile: Enhance names of remote provider targets
    @arjunmehta-git (#19879)
  - Revert "refactor(performance): drop service-mesh-performance
    for schemas-native types" @PragalvaXFREZ (#19878)
  - refactor(performance): drop service-mesh-performance for
    schemas-native types @leecalcote (#19605)
  - Stop updating k8s deployment in provider sync script
    @NSTKrishna (#19861)
  - [Server] Add OD10 Ventures remote provider @chaitanyamedidar
    (#19858)
  - [mesheryctl] model: fix typos, misspelled function names, and
    corrupted license header @somaz94 (#19835)
    * Maintenance
  - [Chore] Bump Go version to 1.26.4 @PragalvaXFREZ (#19876)
  - [Chore] Upgrade to go 1.26 @CodeAhmedJamil (#19906)
  - [CI] Makefile: Enhance names of remote provider targets
    @arjunmehta-git (#19879)
  - Revert "refactor(performance): drop service-mesh-performance
    for schemas-native types" @PragalvaXFREZ (#19878)
  - refactor(performance): drop service-mesh-performance for
    schemas-native types @leecalcote (#19605)
  - Bump @rjsf/utils from 6.5.3 to 6.6.1 in /provider-ui
    @dependabot[bot] (#19850)
  - Bump start-server-and-test from 3.0.5 to 3.0.6 in
    /provider-ui @dependabot[bot] (#19849)
  - Bump @sistent/sistent from 0.21.14 to 0.21.18 in /provider-ui
    @dependabot[bot] (#19844)
  - Bump start-server-and-test from 3.0.5 to 3.0.6 in /ui
    @dependabot[bot] (#19845)
  - Bump next from 16.2.6 to 16.2.7 in /provider-ui
    @dependabot[bot] (#19848)
  - Bump react-moment from 1.2.2 to 2.0.2 in /ui @dependabot[bot]
    (#19843)
  - Bump @sistent/sistent from 0.21.15 to 0.21.18 in /ui
    @dependabot[bot] (#19847)
    * Documentation
  - Bump Go version to 1.26.4 @Junnygram (#19907)
  - [Chore] Bump Go version to 1.26.4 @PragalvaXFREZ (#19876)
  - [Chore] Upgrade to go 1.26 @CodeAhmedJamil (#19906)
  - docs: Improve Artifact Hub publishing tutorial @Bhumikagarggg
    (#19886)
  - Remove unsupported versions from version select dropdown
    (v0.8) @Katotodan (#19839)
  - Remove unsupported versions from version select dropdown
    (v0.9) @Katotodan (#19838)
  - [Docs] Incomplete migration to npm-managed Hugo in
    docs/Makefile @hebypaul (#19576)

++++ nekobox:

    Update to 5.11.17
  - Add extra parameters for subscriptions

++++ opa:

  - Update to version 1.17.1:
    This release uses the latest version of Go (1.26.4) to build OPA,
    fixing stdlib vulnerabilities in code that OPA's HTTP handler and
    crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
    It is otherwise the same code as v1.17.0.
    * Miscellaneous
  - build: bump go 1.26.3 -> 1.26.4 (authored by @srenatus)

++++ pascube:

  - Fix source URL link

++++ percona-toolkit:

  - Fix build on non x86_64 archs

++++ perl-Cpanel-JSON-XS:

  - updated to 4.420.0 (4.42)
    see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes
    4.42 2026-06-27 (rurban)
  - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
  - Fix -e docs: "written" → "read" (GH #239, reported by Ron Savage).
  - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
    Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal
    to false because undef stringifies to "". Added defined() guard.
  - Fix error messages showing overloaded stringification for blessed
    objects (GH #191, reported by karenetheridge). Error messages now
    use ClassName=TYPE(addr) format, bypassing any "" overload.
  - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,
    reported by alpha6). With type_all_string + allow_blessed, blessed
    objects are now encoded as null (not stringified as HASH address).
  - Fix infinite recursion when encode is called from a "" overload
    (GH #128, reported by pbrthemaster). The recursion guard temporarily
    clears convert_blessed and allow_stringify flags on the JSON object
    before calling the overload, preventing re-entrant encode loops.
  - Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
    When new() is called on an existing object (e.g. $json->new->new),
    the class name is now extracted from the object's stash rather than
    using the stringified reference.
  - Change allow_nonref default to true (GH #241, matching JSON::PP and
    JSON::XS 4.0+ and the insecure RFC 7159).
    encode and decode now accept non-reference values by default.
    decode_json() with an explicit 0/1 second argument still works.
    allow_nonref(0) to disable scalars-only for secure JSON.
  - Fix minor t/12_blessed.t typo.
  - Fix GH #112: encode large whole-number NV values without .0 on
    32-bit Perl (values exceeding UV_MAX that Perl stores as float).
  - Fix GH #197: prefer IOK over pNOK when encoding values where
    IV is accurate but NV is imprecise (SvNOK not set).

++++ perl-DateTime-Format-Natural:

  - updated to 1.270.0 (1.27)
    see /usr/share/doc/packages/perl-DateTime-Format-Natural/Changes
    1.27  2026-06-07  <schubiger@cpan.org>
  - Merged development version to stable.
    1.26_02  2026-06-01  <schubiger@cpan.org>
  - Minor tweak/removals.
    1.26_01  2026-05-30  <schubiger@cpan.org>
  - Improve use of string/block eval.

++++ perl-HTTP-Tiny:

  - updated to 0.096
    see /usr/share/doc/packages/perl-HTTP-Tiny/Changes
    0.096     2026-06-08 11:21:49+02:00 Europe/Brussels
  - No changes from 0.095-TRIAL
    0.095     2026-06-03 13:10:05+02:00 Europe/Brussels (TRIAL RELEASE)
    [!!! SECURITY !!!]
  - Caller-supplied C<Authorization>, C<Cookie>, and C<Proxy-Authorization>
    headers are now stripped on cross-origin redirects by default. Use
    allow_credentialed_redirects to opt out.
  - Redirects are no longer automatically followed when going from https to http.
    Use allow_downgrade to revert to the original behaviour.

++++ perl-Protocol-HTTP2:

  - updated to 1.130.0 (1.13)
    see /usr/share/doc/packages/perl-Protocol-HTTP2/Changes
    1.13 2026-06-07T09:19:24Z
  - security fix: CVE-2026-10725 - HTTP/2 Bomb, a remote denial-of-service
    (reported by Robert Rothenberg, CPAN Security Group)
    bsc#1267857

++++ php8-xdebug:

  - Update to Xdebug 3.5.3
    * Fixed bug #2404: Xdebug outputs a message to stderr when path
    mapping is enabled, and a directory is present
    * Fixed bug #2405: Handle minimum path in .xdebug directory discovery
    * Fixed bug #2411: Native Path Mapping is not applied to the initial
    fileuri in the init packet
    * Fixed bug #2421: Crash with wrong option letter in DBGP and socket
    commands
    * Fixed bug #2422: No limit on DBGP read buffer
    * Fixed bug #2423: Don't follow symlinks with file creation
    * Fixed bug #2424: Control-socket buffer crashes
    * Fixed bug #2426: xdebug_get_tracefile_name incorrectly throws notice
    * Fixed bug #2427: Crash when file_link_format setting is wrong
    * Fixed bug #2429: Crash when trace_output_name setting is wrong
    * Fixed bug #2430: Variable fetching may crash with `::` if there is
    no active stack
    * Fixed bug #2431: Crash when trying to retrieve Windows-style URL
    with not enough characters
    * Fixed bug #2433: Refactor finding variable names in trace files with
    assignments

++++ policycoreutils:

  - Reintroduce sandbox package (bsc#1266226) and a couple quality of life
    improvements:
    add policycoreutils-sandbox-fix-cleanup.patch
    add sandbox-sandbox-fix-saving-file-changes.patch

++++ postsrsd:

  - Update to release 2.0.12
    * PostSRSd will give a proper diagnostic instead of crashing if
    no SRS domain is configured.

++++ profanity-mini:

  - Update to 0.18.2:
    Bug Fixes:
    * Guard terminal writes while suspended (#2167)
    * Prevent OTR handshake from leaking presence to strangers (#2168)
    * Silence 'no key' error for key transport messages (#2171)
    Build System:
    * Add configurable docdir option for documentation (#2174)

++++ prometheus-blackbox_exporter:

  - Do not build for SLE 12

++++ python-oslo.messaging:

  - update to 18.1.0 (bsc#1267828, CVE-2026-44393):
    * Fix RabbitMQ TLS hostname verification (bsc#1267828,
    CVE-2026-44393)
    * Deprecate version module
    * tox: Use new constraints option
    * Remove deprecated heartbeat_in_pthread option from RabbitMQ
    driver
    * Update master for stable/2026.1
    * Replace deprecated datetime.datetime.utcnow

++++ python-awscrt:

  - Update to version 0.34.1
    * Drop python 3.8 and 3.13t in manylinux2014 by @sfod in (#745)

++++ python-google-api-core:

  - Update to 2.31.0
    * fix FAQ grammar in httplib2 example
    * same block as other sections
    * Bump github/codeql-action from 4.33.0 to 4.34.1
    * Bump github/codeql-action from 4.32.0 to 4.33.0
    * exclude Response.is_permanent_redirect from API docs
    * clarify Quickstart POST example (#6960)
    * Additional commits viewable in compare view
    * bump protobuf from 4.25.8 to 5.29.6 (#17021)
    * drop support for Python 3.9 (#16980)

++++ python-google-resumable-media:

  - Update to 2.10.0
    * update incorrect urls in setup.py to point at monorepo vs splitrepo (#17237)

++++ python-jupyter-server:

  - Update to 2.19.0 (CVE-2026-5422, bsc#1267357):
    [#] Enhancements made
  - Return `unresolved` stanza when kernel scope is unavailable for
    `resolvePath` (instead of failing with 404) [#1641]
    [#] Bugs fixed
  - Recreate notary store on failure to prevent save deadlock and data
    loss [#1640]
    [#] Maintenance and upkeep improvements
  - Restore the test skip marks with updated compatibility reason [#1646]
  - Drop Python 3.9 [#1644]
  - Bump minimatch from 3.1.2 to 3.1.5 [#1606]
    [#] Other merged PRs
  - Update pytest requirement from \<9,>=7.0 to >=7.0,\<10 [#1647]
  - fix: use percent-placeholder args in HTTPError to prevent Tornado
    from doubling percent signs in gateway URLs [#1642]
  - 2.18.2:
    [#] Bugs fixed
  - Fix saving user avatar URL [#1637]
  - Fix path resolution if `root_dir` is a filesystem root [#1636]
    [#] Maintenance and upkeep improvements
  - Add Zulip notification when a release is complete [#1634]
  - chore: update pre-commit hooks [#1633]

++++ python-paramiko:

  - Update to 5.0.0 (fixes CVE-2026-44405, bsc#1264225)
    * [Feature]: Added a new, optional file_format keyword argument to
    PKey.write_private_key and PKey.write_private_key_file to allow writing
    out OpenSSH-style private key files in addition to the legacy PEM format.
    * [Bug]: Added a password kwarg to PKey.from_type_string so it can handle
    encrypted keys like most other PKey constructors already could.
    * [Bug]: Fix Ed25519Key’s internals such that it no longer throws
    AttributeError during calls to __repr__ when only partly initialized. This
    isn’t a normal runtime problem (it only happens inside error handling for
    fatal errors like “not a valid private key”) but was perennially
    complicating test failure diagnosis and similar scenarios.
    * [Support]: Removed the demos/ folder; they’ve become too big a support
    burden and we’ve wanted to remove them for years.
    * [Support]: Renamed PKey.from_path’s passphrase argument to password so
    it’s consistent with all the other methods of instantiating PKey objects.
    * [Support]: Removed support for verifying/signing with RSA keys using SHA-1
    hashing. Generally, this means most cases where "ssh-rsa" was used as an
    algorithm identifier (as opposed to a key material identifier) will no
    longer accept that string as valid, and the relevant code that actually
    used eg hashes.SHA1 no longer does.
    * [Support]: Removed support for key exchange using SHA-1, meaning the kex
    methods diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1,
    and diffie-hellman-group1-sha1 are now gone. Implementing classes have
    been removed/merged/shuffled as required.
    * [Support]: Removed GSSAPI support, as the current (buggy, no longer easily
    testable in CI, poorly understood and not used by the core team)
    implementation is SHA-1 based and no SHA-256 upgrade appeared to be
    forthcoming from contributors.
    * [Support]: Raised the minimum modulus size in
    diffie-hellman-group-exchange-sha256 key exchange from 1024 (the original
    spec’s minimum) to 2048 (the contemporary minimum according to RFC 9142,
    and matching a similar change by OpenSSH ten years ago in 7.2 / 2016).
    * [Support]: The PKey class family tree reorganized the write_private_key and
    write_private_key_file methods; with other recent changes, having individual
    implementations on the child classes made no sense, so key writing is now
    implemented in PKey itself and the included child classes such as ECDSAKey
    no longer define their own such methods, instead simply exposing their
    underlying cryptographic private key objects as .private_key.
  - drop python-paramiko-doc subpackage as demos are no longer included

++++ python-pypdf:

  - Update to 6.13.0
    (CVE-2026-48155, bsc#1266823, CVE-2026-48156, bsc#1266822,
    CVE-2026-48735, bsc#1266821)
    [#] Security (SEC)
  - Avoid infinite loops for outlines and text extraction (#3830)
    [#] New Features (ENH)
  - Add Japanese predefined CMaps (#3800)
  - Font: Collect all character widths, not only those that can be
    unicode mapped (#3798)
    [#] Robustness (ROB)
  - Recover a corrupt trailing startxref pointer (closes #3238) (#3826)
  - Handle /Pages node without /Kids during flattening (#3825)
  - Accept inline image EI marker at the end of a content stream (#3827)
    [#] Maintenance (MAINT)
  - Type the always-raising deprecation helpers as `NoReturn` (#3819)
  - 6.12.2:
    [#] Security (SEC)
  - Optimize _decode_png_prediction regarding memory and speed (#3806)
  - Improve loop control in text extraction (#3805)
  - 6.12.1:
    [#] Security (SEC)
  - Limit input size and element count for XMP metadata (#3796)
    [#] Robustness (ROB)
  - Prevent cyclic parent hierarchies for inherited dictionaries (#3795)
  - Deal with invalid first code in LZW decoder (#3794)
  - 6.12.0:
    [#] Security (SEC)
  - Disallow cross-reference streams with zero-only width values (#3791)
  - Avoid excessive whitespace in layout mode text extraction (#3790)
    [#] New Features (ENH)
  - Implement SASLprep (RFC 4013) for AES-256 password normalization (#3780)
  - CID font resource from font file to encode more characters (#3652)
    [#] Performance Improvements (PI)
  - Optimize retrieval of named destinatinos in reader (#3442)
    [#] Bug Fixes (BUG)
  - Fix TreeObject.insert_child KeyError on fresh children (#3786)
    [#] Robustness (ROB)
  - AppearanceStream: Also honor user-set font name when not
    flattening annotations (#3781)
    [#] Documentation (DOC)
  - Block encrypting writer in incremental mode (#3789)
  - 6.11.0:
    [#] New Features (ENH)
  - Initialise a Font from an embedded font file (#3704)
    [#] Robustness (ROB)
  - Allow to fix AES padding length in non-strict mode (#3742)
    [#] Developer Experience (DEV)
  - Enable PyPy testing again (#3752)
  - Align mypy Makefile target with strict mode (#3690)

++++ salt:

  - Fix deprecation warnings when running on Python 3.13
  - Added:
    * fix-deprecation-warnings-when-running-on-python-3.13.patch

++++ salt-test:

  - Fix deprecation warnings when running on Python 3.13
  - Added:
    * fix-deprecation-warnings-when-running-on-python-3.13.patch

++++ qgis:

  - Update to 3.44.11
    * https://github.com/qgis/QGIS/compare/final-3_44_10...final-3_44_11
  - Changes from 3.44.10
    * https://github.com/qgis/QGIS/compare/final-3_44_9...final-3_44_10
  - Changes from 3.44.9
    * https://github.com/qgis/QGIS/compare/final-3_44_8...final-3_44_9
  - Changes from 3.44.8
    * https://github.com/qgis/QGIS/compare/final-3_44_7...final-3_44_8

++++ remind:

  - VERSION 06.02.07 - 2026-06-05
  - IMPROVEMENT: tkremind: Make tooltip colors configurable.  Patch courtesy
    of Paolo Donadeo.
  - IMPROVEMENT: remind: Allow a tdelta to cross day boundaries.  In the
    past, a reminder such as this:
    REM Tue AT 00:05 +10 *5 MSG foo
    would not be triggered at 23:55 on a Monday.  Now it will.  Similarly,
    reminders using a SCHED function to schedule queued reminders can
    cross day boundaries if the result of calling sched_func(1)
    is a sufficiently-large negative number.
  - MINOR FIXES: Some man page clarifications and typo fixes.

++++ rocksndiamonds:

  - Update to version 4.4.2.0
    additions to improve Boulder Dash support
    * fixed importing certain native BD levels.
    * fixed hatching delay when playing native old Krissz BD engine
    caves
    additions to improve Emerald Mine support
    * added improved random number generator for native EM game
    engine.
    * added raising previously missing scores for some EM engine game
    elements.
    * added checkbox to use EM/DC style duration in "moves" instead
    of seconds.
    * added pause element for EMC magic ball switch to improve
    switching.
    * added support for native EM sounds when using native EM game
    engine.
    * fixed amoeba growth speed for native EM game engine.
    * fixed alien (robot) movement behavior for native EM game
    engine.
    * fixed bug with dead, but growing amoeba for native EM game
    engine.
    additions to improve Emerald Dash support
    * added support for Emerald Dash style behavior for magic walls.
    * added support for Emerald Dash style behavior for bugs and
    tanks.
    * added support for Emerald Dash style behavior for amoeba when
    growing.
    * added support for Emerald Dash style behavior for amoeba when
    changing.
    * added support for Emerald Dash style behavior for exploding
    bugs.
    * added support for Emerald Dash style behavior for magic walls.
    * added support for Emerald Dash style behavior for voodoo player
    * added support for Emerald Dash style behavior for player
    explosion.
    * added level editor checkbox for Emerald Dash EM engine
    compatibility.
    additions to improve Diamond Caves support
    * changed growing EM/DC style amoeba for Diamond Caves style
    behavior.
    * added newly grown EM/DC style amoeba killing player if on top
    of him.
    * added checkbox to handle EM/DC style amoeba differently for DC
    levels.
    * added support for decoding old DC level files.
    * added support for old (packed) DC level files.
    * added support for old (single) DC level files.
    * added checkbox to use DC style behavior when digging traps and
    landmines.
    * added support for reading certain non-standard DC level files.
    * added checkbox to use classic BD/EM/DC style behavior for
    magic walls.
    * added setting classic BD style behavior for magic walls in
    EM/DC levels.
    * improved classic BD/EM/DC style behavior for magic walls.
    * changed counting DC style shield time in “moves” instead of
    seconds.
    * changed shield time from seconds to “moves” for old DC level
    files.
    * added checkbox to use classic BD/DC style behavior for slipping
    down.
    * added checkbox to keep content of DC style walls in enemy
    explosions.
    * added checkbox to let player survive level timeout when using
    shield.
    * added dropping EM/DC style dynamite using snap key.
    * added checkbox to reset shield time instead of adding when
    collecting.
    * added checkbox to flash the playfield when the exit is opening.
    additions to improve Supaplex support
    * fixed zigzag diagonal movement with gravity for SP game engine.
    other game engine changes
    * fixed old bug when two adjacent yamyams are exploding at the
    same time.
    * fixed tape desync after quick save/load caused by intermediate
    key state.
    graphical changes and fixes
    * added improved player graphics.
    * added improved graphics for some BD elements.
    * fixed not displaying single-step mode after loading tape
    snapshot.
    * fixed drawing player entering and/or leaving explosion.
    * fixed drawing animation of explosion for player leaving
    explosion.
    * fixed drawing explosion on field player is just leaving
    * fixed drawing field exploding one frame after player is
    entering.
    * fixed potential drawing bug in level editor when using MM game
    engine.
    * fixed bugs when centering the playfield when using the MM game
    engine.
    level and artwork customization changes
    * added level config option to use Emerald Dash engine for EM
    level sets.
    * added sound config option to use native EM sound engine.
    * added configurability of menu scrollbar and scrollbar button
    sizes.
    * added configurability of menu scrollbar border size.
    * added separate graphics config options for editor playfield
    scrollbars.
    * added graphics config options for background graphics for
    scrollbars.
    * added support for gadget on main screen to toggle team mode.
    * added support for gadget on main screen to toggle sound set.
    * added support for indicators for played and solved games to
    main menu.
    * added support for key navigation with custom main menu
    positions.
    * added graphics config options for shifted text and elements on
    gadgets.
    * added level config option to always skip intro screens
    * added support for player graphics to be used when player uses
    shield.
    * added support for twinkling animations for gem style game
    elements.
    * added support for sound played one second before shield is
    deactivated.
    * added support for custom window/viewport sizes for info/setup
    screens.
    other changes
    * added build script to create R’n’D packages for all platforms.
    * added support for level intros (limited to R’n’D engine levels)
    * added support for level intro template
    "docs/intros/template.txt".
    * added support for level story template
    "docs/stories/template.txt".
    * added disabling team mode for levels containing only one
    player.
    * added team mode flag for API action to get scores.
    * added forcing program restart after each addition of new level
    sets.
    * added hiding toolbox gadgets not usable with current level
    editor mode.
    * fixed navigating to previous page on credits info screen.
    * fixed bug when selecting and immediately un-selecting brush in
    editor.
    * fixed bug with request door opening and closing without user
    input.

++++ rspamd:

  - Disable hyperscan on sles 15. The library seems missing
  - Disable ix86 builds

++++ rumdl:

  - Update to version 0.2.9:
    * Added
  - md030: align ordered list text to a column with
    ol-align-column (#658) (221cdaa) - thanks @chandlerc
    * Fixed
  - md022: keep the blanks-around-headings fix idempotent when a
    heading sits between a list and a list marker
  - md030: reject out-of-range ol-align-column values (3620545)
  - md030: keep nested content attached when a marker widens
    (#657) (3bcc4c4) - thanks @chandlerc

++++ sbcl:

  - Update to 2.6.5
    * minor incompatible change: the condition signalled when an accessed slot
    is missing from an object is no longer a TYPE-ERROR.
    * minor incompatible change: the condition signalled when accessing an
    uninitialized structure slot is no longer a TYPE-ERROR.
    * minor incompatible change: the implementations of standardized functions
    treating lists as sets, such as INTERSECTION and UNION, take more
    advantage of the freedom to return the elements of the result in any
    order.
    * platform support:
    * * add low-level support for floating point state manipulation on
    PPC64/FreeBSD.  (thanks to Piotr Kubaj)
    * * improve the software emulation of displaced instructions on ARM64.
    * * restore building the system using the musl C library.  (lp#2153432,
    reported by Tom Gillespie)
    * * fix some SB-SIMD shifting instructions on AVX2.  (lp#2152791, reported
    by Willem Broekema)
    * enhancement: definition sources for alien callbacks are now findable by
    name in SB-INTROSPECT.
    * bug fix: the SYMBOL restart for finding packages now actually performs a
    non-local exit.  (lp#2153092, reported by Zach Shaftel)
    * bug fix: TYPEP on large disjoint numeric union types compiles faster using
    fewer resources.  (lp#2151818, reported by James McDonald)
    * bug fix: strings of arbitrary size with fill-pointer set to 1 are
    character designators.  (reported by _death)
    * bug fix: the KEEP-OLD restart established by ADD-PACKAGE-LOCAL-NICKNAME
    keeps the old nickname instead of going ahead with the change (and the
    restart report function no longer returns from ADD-PACKAGE-LOCAL-NICKNAME).
    * bug fix: when EXPORT results in a conflict between symbols exported by
    different used packages, the TAKE-NEW restart now shadowing-imports the
    new symbol instead of doing nothing and leaving the package in an
    inconsistent state.
    * bug fix: the SB-EVAL interpreter checks program syntax more thoroughly.
    * bug fix: compiler cross-reference data is decoded correctly for a
    functional with more than one entry for a given name.
    * bug fix: TYPE-ERRORs signalled by SBCL are more likely to have a DATUM
    that is not of the condition's EXPECTED-TYPE.
    * bug fix: the code walker no longer uses the stack to walk PROGN bodies.
    * optimization: in various situations, INTERSECTION and UNION will use
    hash-tables to perform the operation more quickly.

++++ seadrive-fuse:

  - update to 3.0.23 (no changelog).

++++ seadrive-gui:

  - update to 3.0.23 (no changelog).

++++ sigil:

  - Update to 2.8.0
    * New Features
  - create a separate Change Reading Order dialog for those who can not use drag and drop
  - create a Drop Zone for users who want to use drag and drop to add files to their epub
  - rewrite ImageTab to allow for basic image adjustments: rotate right, rotate left, crop, resize
  - allow users more control over Prettify using prettyprint.xml created in Sigil prefs.
  - update all CI github actions to the latest versions
  - add cability to de-nest the newly native nested CSS so that it will work with e-readers
  - in ImageViewer move image description to the top
  - make ImageView open images fitted to its window automatically
  - recognize more core mediatypes for image/jxl and imaage/avif from epub 3.4 spec
  - recognize json as a mediatype in Sigil in prep for epub 3.4 spec
  - support json syntax highlighting in CodeView to support epub 3.4 spec
  - add new epb3 tool menu items to safely add and remove the nav from the OPF spine
    * Bug Fixes
  - make sure assigned clip number is not editable in ClipEditor
  - greatly speed up All Files report generation in epub3s with manifest properties
  - greatly speed up Delete Used Media by caching current cover image
  - greatly speed up adding bulk resources to the OPF to speed up Add Existing ...
  - fix bug in Open With on MacOS not properly parsing arguments
  - fix bug in refreshing plugin toolbars
  - fix bug in GetInfo not using the proper times symbol
  - fix stripping out of css selectors with non properites (empty)
  - use resizeColumnsToContents to set DeleteUnunsedMedia and DeleteUnusedStyles column width
  - prevent user created custom metadata elements from breaking the lxml parser badly
  - fix bug that stripped out custom metadata from epub before a save
  - use more standard shortcuts for for Previous and Next tab
  - stop Sigil tools from implicitly adding back nav to spine if not present

++++ snapraid:

  - Update to 14.6:
    * Fix stack overflow in deep directory trees on platforms with a small
    stack like Alpine.
    * Log errors as "fatal" only if the execution is stopped early.
    * This ensures SnapRAID Daemon correctly identifies the alert level of
    each message (e.g., treating non-terminating issues as warnings).

++++ steampipe:

  - Update to version 2.4.4:
    * v2.4.4 (#5003)
    * Bump FdwVersion to 2.2.3 (FDW security release for CVE-2026-41889) (#4996)
    * Bump go-jose/v4 + otel/sdk for CVEs; add v2.4.3 CHANGELOG (#4995)
    * Bump github.com/jackc/pgx/v5 to v5.9.2 (CVE-2026-41889) (#4990)
    * Add CHANGELOG.md entry for v2.4.2 (#4984)

++++ strongswan:

  - Update to release 6.0.7
    * Fixed a vulnerability in libstrongswan related to the cloning
    of certain identities that can result in an double-free and
    potentially remote code execution. [CVE-2026-47895]
    * The validity (notBefore/notAfter) of the last certificate in
    the incomplete trust chain of a pre-trusted certificate is now
    enforced. The validity of pre-trusted, self-signed certificates
    is now also enforced.
    * Enable mixed-family IPComp configs with Linux kernel 6.3 and
    newer.
    * charon-cmd does not default to IPv4 anymore and allows
    configuring the local endpoint via --host-local option.
    * The swanctl --list-conns command now accepts an --ike option to
    filter connections by name.

++++ syft:

  - Update to version 1.45.1:
    * Bug Fixes
  - bump stereoscope to pull in fix for registry client hanging
    [#4934 @anchore-oss-update-bot]
    * Dependencies
  - chore(deps): bump the go-minor-patch group across 1 directory
    with 3 updates (#4957)
  - chore(deps): update tool versions (#4724)
  - chore(deps): bump the go-minor-patch group across 2
    directories with 14 updates (#4947)
  - chore: bump golang.org/x/crypto (#4955)

++++ telegraf:

  - Update to version 1.39.0:
    * Telegraf v1.39.0
    * Update changelog for v1.39.0
    * chore(inputs.system): Undeprecate the 'legacy' option (#19049)
    * chore: Update go to v1.26.4 (#19047)
    * docs(outputs.sql): Document oracle driver support (#19048)
    * feat(outputs.sql): Add oracle driver (#19036)
    * chore(inputs.opcua): Add trace logging for gather cycle timing diagnostics (#18607)
    * chore(outputs.influxdb_v2): Migrate unix socket dialing from Dial to DialContext (#19045)
    * feat(parsers.prometheusremotewrite): Implement ParserTimeFuncPlugin interface (#19043)
    * chore(deps): Bump github.com/bluenviron/gomavlib/v3 from 3.3.4 to 3.3.5 (#19015)
    * chore(deps): Bump github.com/prometheus/prometheus from 0.311.3 to 0.312.0 (#19025)
    * chore(ci): Disable Windows HNS excluded port ranges in test job (#19037)
    * chore(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/monitor/armmonitor from 0.11.0 to 0.12.0 (#19030)
    * feat(inputs.kafka_consumer): Add consumer_fetch_min and consumer_fetch_max_wait options (#19038)
    * feat(parsers.prometheus): Implement ParserTimeFuncPlugin interface (#19042)
    * chore(inputs.azure_monitor): Remove dependency on github.com/logzio/azure-monitor-metrics-receiver (#19034)
    * chore(deps): Bump github.com/vmware/govmomi from 0.54.0 to 0.54.1 (#19027)
    * chore(inputs.system): Wrap errors in legacy gather path (#19039)
    * chore(inputs.system): Restore previous 'legacy' metrics (#19007)
    * fix(inputs.docker_log): Restore following the log-stream and keep the state (#19006)
    * chore(deps): Bump github.com/IBM/sarama from 1.49.0 to 1.50.1 (#19031)
    * fix(circleci): Fix destination of nightly build artifact uploads (#19033)
    * feat(parsers.openmetrics): Implement ParserTimeFuncPlugin interface (#18998)
    * feat(parsers.value): Implement ParserTimeFuncPlugin interface (#19008)
    * feat(parsers.wavefront): Implement ParserTimeFuncPlugin interface (#19009)
    * feat(parsers.xpath): Implement ParserTimeFuncPlugin interface (#19011)
    * test(processors.parser): Check output timestamp more strictly (#19012)
    * chore(deps): Bump the aws-sdk-go-v2 group across 1 directory with 11 updates (#19014)
    * chore(deps): Bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 (#19019)
    * chore(deps): Bump github.com/pion/dtls/v3 from 3.1.2 to 3.1.3 (#19022)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.8 to 1.16.11 (#19028)
    * chore(deps): Bump github.com/mdlayher/vsock from 1.2.1 to 1.3.0 (#19024)
    * chore(deps): Bump github.com/redis/go-redis/v9 from 9.19.0 to 9.20.0 (#19029)
    * chore(deps): Bump modernc.org/sqlite from 1.50.1 to 1.51.0 (#19026)
    * chore(deps): Bump github.com/emiago/sipgo from 1.3.1 to 1.4.0 (#19023)
    * chore(deps): Bump go.step.sm/crypto from 0.81.0 to 0.81.1 (#19021)
    * chore(deps): Bump github.com/prometheus/common from 0.67.5 to 0.68.1 (#19018)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.14.1 to 2.14.2 (#19020)
    * chore(deps): Bump github.com/aws/smithy-go from 1.25.1 to 1.27.0 (#19016)
    * chore(deps): Bump google.golang.org/api from 0.280.0 to 0.283.0 (#19017)
    * test(outputs.prometheus_client): Fix round-trip test (#19010)
    * feat(inputs.prometheus): Add per-URL statistics on gather cycles (#18944)
    * feat(parsers.json): Implement ParserTimeFuncPlugin interface (#18990)
    * feat(parsers.parquet): Implement ParserTimeFuncPlugin interface (#19000)
    * fix(inputs.docker_log): Read only new entries if from_beginning is false (#19004)
    * fix(inputs.docker_log): Guard concurrent access to the state map (#19001)
    * chore(deps): Bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 (#18997)
    * feat(parsers.nagios): Implement ParserTimeFuncPlugin interface (#18996)
    * feat(parsers.logfmt): Implement ParserTimeFuncPlugin interface (#18995)
    * test(common.opcua): Cover ua.ByteArray array decoding (#18993)
    * test(common.tls): Use TLSMinVersionDefault constant in expectation (#18992)
    * test(config): Add regression test for empty secret string (#18991)
    * fix(inputs.docker_log): Don't use follow when tailing docker logs (#18988)
    * feat(parsers.json_v2): Implement ParserTimeFuncPlugin interface (#18994)
    * feat(inputs.http_response): Add secret token support (#18987)
    * fix(outputs.influxdb_v2): Capture unix socket path before URL mutation (#18984)
    * test(inputs.aerospike): Use shared testutil ulimit helper (#18986)
    * fix(config): Reject invalid tagpass and tagdrop types (#17664)
    * feat(parsers.graphite): Implement ParserTimeFuncPlugin interface (#18948)
    * chore(parsers.influx): Cleanup code (#18951)
    * test(outputs.mongodb): Fix integration tests (#18965)
    * fix(input.temp): Ignore EAGAIN on unavailable thermal-zones (#18913)
    * feat(inputs.socket_listener): Add SSM/IGMPv3 support (#18915)
    * feat(inputs.directory_monitor): Allow to preserve timestamps when moving file (#18921)
    * chore(parsers.grok): Cleanup code (#18949)
    * fix(inputs.system): Restore n_cpu field name (#18982)
    * feat(outputs.opentelemetry): Add support for token authentication (#18980)
    * chore(deps): Bump github.com/bluenviron/gomavlib/v3 from 3.3.3 to 3.3.4 (#18974)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.58.0 to 1.59.0 (#18975)
    * chore(deps): Bump golang.org/x/net from 0.54.0 to 0.55.0 (#18969)
    * chore(deps): Bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#18971)
    * chore(deps): Bump github.com/gopacket/gopacket from 1.5.0 to 1.6.0 (#18976)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.14.0 to 2.14.1 (#18972)
    * chore(deps): Bump github.com/apache/inlong/inlong-sdk/dataproxy-sdk-twins/dataproxy-sdk-golang from 1.0.7 to 1.0.8 (#18970)
    * chore(deps): Bump golang.org/x/sys from 0.44.0 to 0.45.0 (#18973)
    * chore(deps): Bump google.golang.org/api from 0.279.0 to 0.280.0 (#18968)
    * chore(deps): Bump github.com/hashicorp/consul/api from 1.34.2 to 1.34.3 (#18967)
    * chore(deps): Bump the aws-sdk-go-v2 group with 5 updates (#18966)
    * test(inputs.aerospike): Fix integration tests (#18964)
    * chore(ci): Adapt latest Ubuntu image (#18962)
    * feat(outputs.mongodb): Allow specifying metadata fields (#18826)
    * fix(inputs.ping): Use deterministic packet IDs to prevent collisions (#18870)
    * feat(outputs.kafka): Add support for custom record headers (#18829)
    * feat(parsers.form_urlencoded): Implement ParserTimeFuncPlugin interface (#18947)
    * feat(parsers.dropwizard): Implement ParserTimeFuncPlugin interface (#18946)
    * chore(ci): Limit permissions to read-only on suitable workflows (#18920)
    * feat(parsers.grok): Implement ParserTimeFuncPlugin interface (#18950)
    * feat(inputs.opcua_listener): Wire browse-based node discovery (#18941)
    * feat(parsers.binary): Implement ParserTimeFuncPlugin interface (#18945)
    * chore: Update go to v1.26.3 (#18942)
    * feat(inputs.gnmi_listener): Add plugin (#18790)
    * test(cmd): Fix unit test after PR #18906
    * feat(inputs.opcua): Discover nodes by browse-path glob patterns (#18831)
    * fix(inputs.system): Demote missing utmp debug log to trace (#18911)
    * docs(linter): Disable table-style check MD060 (#18940)
    * feat(inputs.temp): Add setting to force thermal-zones gathering on linux (#18906)
    * fix(agent): Skip output buffer initialization in test mode (#18918)
    * fix(inputs.webhooks.github): Restore secret field in configuration (#18923)
    * chore(inputs.docker): Migrate to maintained github.com/moby/moby library (#18879)
    * chore(deps): Bump github.com/IBM/sarama from 1.48.1 to 1.49.0 (#18929)
    * chore(deps): Bump google.golang.org/api from 0.278.0 to 0.279.0 (#18931)
    * chore(deps): Bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.9.0 (#18912)
    * docs: Fix remaining line-length issues (#18939)
    * feat(parsers.avro): Implement ParserTimeFuncPlugin interface (#18904)
    * chore(deps): Bump go.step.sm/crypto from 0.79.0 to 0.81.0 (#18935)
    * chore(deps): Bump github.com/bluenviron/gomavlib/v3 from 3.3.1 to 3.3.3 (#18938)
    * chore(deps): Bump google.golang.org/grpc from 1.81.0 to 1.81.1 (#18937)
    * chore(deps): Bump github.com/google/cel-go from 0.28.0 to 0.28.1 (#18930)
    * chore(deps): Bump srebhan/label-milestone-action from 1.0.2 to 1.1.0 (#18933)
    * chore(deps): Bump cloud.google.com/go/storage from 1.62.1 to 1.62.2 (#18928)
    * chore(deps): Bump k8s.io/client-go from 0.36.0 to 0.36.1 (#18927)
    * chore(deps): Bump the aws-sdk-go-v2 group with 2 updates (#18926)
    * docs: Unify secret store term (#18924)
    * chore(inputs.gnmi): Factor out common GNMI functions (#18867)
    * feat(inputs.system): Add hardware information (#18868)
    * test(inputs.cisco_telemetry_mdt): Rework tests to case-based tests (#18864)
    * feat(inputs.modbus): Add workaround for devices with smaller batch size (#18871)
    * feat(outputs.opensearch): Implement startup-error-behavior options (#18784)
    * feat(inputs.azure_monitor): Support secrets for client_secret (#18744)
    * feat(agent): Accept TELEGRAF_CONTROLLER_TOKEN environment variable (#18909)
    * fix(inputs.netflow): Parse all counter records (#18902)
    * fix(secrets): Avoid panic with empty content (#18908)
    * fix(common.tls): Explicitly set default minimum TLS version (#18910)
    * feat(parsers.csv): Implement ParserTimeFuncPlugin interface (#18903)
    * chore(deps): Bump golang.org/x/tools from 0.44.0 to 0.45.0 (#18882)
    * chore(deps): Bump github.com/IBM/sarama from 1.48.0 to 1.48.1 (#18889)
    * feat(parsers): Add time-setting interface (#18901)
    * chore(deps): Bump modernc.org/sqlite from 1.50.0 to 1.50.1 (#18893)
    * chore(deps): Bump golang.org/x/crypto from 0.50.0 to 0.51.0 (#18885)
    * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.300.0 to 1.301.0 in the aws-sdk-go-v2 group (#18880)
    * chore(deps): Bump golang.org/x/term from 0.42.0 to 0.43.0 (#18886)
    * chore(deps): Bump golang.org/x/mod from 0.35.0 to 0.36.0 (#18890)
    * chore(deps): Bump golang.org/x/text from 0.36.0 to 0.37.0 (#18891)
    * chore(deps): Bump github.com/nats-io/nats.go from 1.51.0 to 1.52.0 (#18894)
    * chore(deps): Bump github.com/vmware/govmomi from 0.53.1 to 0.54.0 (#18888)
    * chore(deps): Bump go.step.sm/crypto from 0.77.9 to 0.79.0 (#18887)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.57.0 to 1.58.0 (#18884)
    * chore(deps): Bump google.golang.org/api from 0.277.0 to 0.278.0 (#18883)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.7 to 1.16.8 (#18881)
    * chore(deps): Bump github.com/tidwall/gjson from 1.18.0 to 1.19.0 (#18898)
    * chore(deps): Bump cloud.google.com/go/monitoring from 1.28.0 to 1.29.0 (#18897)
    * chore(deps): Bump golang.org/x/sys from 0.43.0 to 0.44.0 (#18896)
    * Update changelog for v1.38.4
    * chore(deps): Bump github.com/apache/thrift from 0.22.0 to 0.23.1-0.20260429145742-d2acd3c49e58 (#18877)
    * fix(inputs.docker): Lock stats cache before reading (#18878)
    * chore(inputs.docker): Cleanup code (#18874)
    * fix(inputs.kinesis_consumer): Acquire lock before saving shard consumers (#18875)
    * feat(inputs.nvidia_smi): Add schema v13 support (#18690)
    * fix(inputs.upsd): Enforce string type for vendor and product IDs (#18626)
    * docs(inputs.kubernetes): Document required RBAC permissions (#18865)
    * chore(inputs.docker): Convert tests to use mock server (#18869)
    * feat(outputs.opentelemetry): Add proxy support (#18823)
    * chore(inputs.ping): Cleanup code (#18866)
    * test(inputs.docker): Refactor unit-tests (#18814)
    * feat(inputs.system): Add operating-system information (#18834)
    * chore(inputs.cisco_telemetry_mdt): Add data dump trace message for debugging (#18859)
    * chore(inputs.gnmi): Cleanup code (#18863)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.12.8 to 2.14.0 (#18857)
    * fix(secretstores.googlecloud): Handle public GCP service account keys correctly (#18785)
    * chore(testutil): Allow specifying a log-level (#18860)
    * fix(agent): Reset secret-counter on reload (#18839)
    * chore(common.tls): Refactor code into server and client (#18838)
    * chore(inputs.gnmi): Move internal test function to bottom (#18837)
    * test(inputs.elasticsearch_query): Refactor unit-tests (#18836)
    * fix(agent): Make sure the log-file directory exists (#18818)
    * chore(deps): Bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 (#18854)
    * chore(deps): Bump github.com/redis/go-redis/v9 from 9.18.0 to 9.19.0 (#18856)
    * chore(deps): Bump cloud.google.com/go/bigquery from 1.76.0 to 1.77.0 (#18843)
    * chore(deps): Bump github.com/apache/arrow-go/v18 from 18.5.2 to 18.6.0 (#18853)
    * chore(deps): Bump github.com/ClickHouse/clickhouse-go/v2 from 2.45.0 to 2.46.0 (#18855)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.6 to 1.16.7 (#18852)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.56.0 to 1.57.0 (#18851)
    * chore(deps): Bump github.com/microsoft/go-mssqldb from 1.9.8 to 1.10.0 (#18850)
    * chore(deps): Bump google.golang.org/api from 0.276.0 to 0.277.0 (#18848)
    * chore(deps): Bump google.golang.org/grpc from 1.80.0 to 1.81.0 (#18849)
    * chore(deps): Bump github.com/IBM/nzgo/v12 from 12.0.11 to 12.0.12 (#18847)
    * chore(deps): Bump go.step.sm/crypto from 0.77.7 to 0.77.9 (#18846)
    * chore(deps): Bump github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0 (#18845)
    * chore(deps): Bump cloud.google.com/go/monitoring from 1.27.0 to 1.28.0 (#18844)
    * chore(deps): Bump github.com/shirou/gopsutil/v4 from 4.26.3 to 4.26.4 (#18842)
    * chore(deps): Bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#18841)
    * chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (#18840)
    * fix(common.opcua): Support byte arrays in decoding (#18825)
    * test(logging): Fix flaky test (#18835)
    * chore(common.adx): Drop redundant ToLower in getMetricIngestor (#18828)
    * fix(common.adx): Make Close safe to call multiple times (#18827)
    * feat(inputs.x509_cert): Add field for public-key length (#18819)
    * chore(deps): Bump github.com/Azure/azure-kusto-go from 0.16.1 to 1.2.2 (#18802)
    * feat(inputs.system): Add option to specify collected information (#18533)
    * fix(inputs.lustre2): Expose explicit cache sample and page fields (#18820)
    * fix(outputs.timestream): Return errors from write factory (#18821)
    * fix(inputs.opcua): Disable auto-reconnect to fix session flood (#18813)
    * fix(agent): Log Windows service startup errors to configured logger (#18816)
    * chore(deps): Bump github.com/IBM/sarama from 1.47.0 to 1.48.0 (#18797)
    * chore(deps): Bump the aws-sdk-go-v2 group with 2 updates (#18794)
    * fix(inputs.diskio): Honor host path environment variables on Linux (#18682)
    * chore(deps): Bump modernc.org/sqlite from 1.49.1 to 1.50.0 (#18807)
    * chore(deps): Bump github.com/rabbitmq/amqp091-go from 1.10.0 to 1.11.0 (#18810)
    * chore(deps): Bump github.com/emiago/sipgo from 1.3.0 to 1.3.1 (#18812)
    * feat(secretstores.vault): Add token authentication (#18786)
    * test(secretstores.vault): Use string comparison for readable failure output (#18793)
    * chore(inputs.docker_log): Cleanup plugin code (#18779)
    * chore(inputs.mem): Clean up extended memory follow-up nits (#18791)
    * chore(deps): Bump github.com/aws/smithy-go from 1.25.0 to 1.25.1 (#18795)
    * chore(deps): Bump github.com/vmware/govmomi from 0.53.0 to 0.53.1 (#18796)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.12.7 to 2.12.8 (#18811)
    * chore(deps): Bump github.com/bluenviron/gomavlib/v3 from 3.3.0 to 3.3.1 (#18809)
    * chore(deps): Bump go.step.sm/crypto from 0.77.2 to 0.77.7 (#18804)
    * chore(deps): Bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to 6.7.10 (#18803)
    * chore(deps): Bump github.com/hashicorp/consul/api from 1.34.1 to 1.34.2 (#18801)
    * chore(deps): Bump github.com/leodido/go-syslog/v4 from 4.4.0 to 4.5.0 (#18800)
    * chore(deps): Bump github.com/prometheus/prometheus from 0.311.2 to 0.311.3 (#18799)
    * chore(deps): Bump k8s.io/client-go from 0.35.4 to 0.36.0 (#18798)
    * chore(inputs.huebridge): Tidy up after go-hue v1.2.0 upgrade (#18792)
    * chore(inputs.huebridge): Plumb gather timeout into go-hue calls (#18777)
    * chore(deps): Bump the aws-sdk-go-v2 group across 1 directory with 11 updates (#18750)
    * chore(deps): Bump github.com/apache/iotdb-client-go from 1.3.5 to 1.3.7 (#18758)
    * docs(telegraf): Fix typo (#18722)
    * feat(inputs.mem): Add extended memory statistics (#18532)
    * chore(deps): Bump github.com/Azure/go-ntlmssp from 0.1.0 to 0.1.1 (#18789)
    * chore(deps): Bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#18781)
    * fix(outputs.graylog): Reconnect transparently when TCP peer closes connection (#18774)
    * test(inputs.docker_log): Factor out mocking and switch to mocking docker daemon (#18775)
    * fix(inputs.huebridge): Repair CI after go-hue v1.2.0 upgrade (#18778)
    * feat(inputs.fritzbox): Add support for fiber lines (#18740)
    * chore(deps): Bump github.com/tdrn-org/go-hue from 0.3.0 to 1.2.0 (#18742)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.12.6 to 2.12.7 (#18755)
    * chore(deps): Bump github.com/moby/moby/client from 0.4.0 to 0.4.1 (#18753)
    * chore(deps): Bump cloud.google.com/go/monitoring from 1.26.0 to 1.27.0 (#18754)
    * chore(deps): Bump github.com/hashicorp/consul/api from 1.34.0 to 1.34.1 (#18756)
    * chore(deps): Bump github.com/tinylib/msgp from 1.6.3 to 1.6.4 (#18757)
    * chore(deps): Bump k8s.io/client-go from 0.35.3 to 0.35.4 (#18759)
    * feat(inputs.exec): Convert 'commands' to already parsed argument lists (#18338)
    * chore(deps): Bump github.com/aws/smithy-go from 1.24.3 to 1.25.0 (#18752)
    * chore(deps): Bump cloud.google.com/go/storage from 1.62.0 to 1.62.1 (#18751)
    * chore(deps): Bump tj-actions/changed-files from 47.0.5 to 47.0.6 (#18749)
    * chore(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.0 to 1.21.1 (#18766)
    * chore(deps): Bump github.com/moby/moby/api from 1.54.1 to 1.54.2 (#18765)
    * chore(deps): Bump software.sslmate.com/src/go-pkcs12 from 0.7.0 to 0.7.1 (#18764)
    * chore(deps): Bump github.com/pborman/ansi from 1.0.0 to 1.1.0 (#18763)
    * chore(deps): Bump github.com/alitto/pond/v2 from 2.7.0 to 2.7.1 (#18762)
    * chore(deps): Bump k8s.io/api from 0.35.3 to 0.35.4 (#18760)
    * chore(deps): Bump github.com/nats-io/nats.go from 1.50.0 to 1.51.0 (#18772)
    * chore(deps): Bump modernc.org/sqlite from 1.48.2 to 1.49.1 (#18771)
    * chore(deps): Bump cloud.google.com/go/pubsub/v2 from 2.5.1 to 2.6.0 (#18770)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.55.0 to 1.56.0 (#18769)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.5 to 1.16.6 (#18768)
    * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.276.0 (#18767)
    * feat(inputs.huebridge): Add brightness and color fields to light metric (#18739)
    * Update changelog for v1.38.3
    * chore(licenses): Fix license link for github.com/p4lang/p4runtime (#18747)
    * chore(telegraf): Add more information output for Windows service lifecycle (#18736)
    * chore(inputs.docker_log): Migrate to maintained github.com/moby/moby library (#18730)
    * test(inputs.snmp_trap): Add test for SNMPv3 long passwords (#18745)
    * fix(agent): Allow overriding collection_jitter with 0s on a per-input basis (#18519)
    * docs(licenses): Fix link to moved license file (#18731)
    * feat(processors.parser): Add strategy to merge parsed metric with parent individually (#18558)
    * docs(inputs.smartctl): Document sudo-rs incompatibility (#18676)
    * chore(deps): Bump github.com/testcontainers/testcontainers-go from 0.41.0 to 0.42.0 (#18701)
    * chore(inputs.openntpd): Improve error reporting and code consistency (#18728)
    * test(inputs.openntpd): Use testutil functions (#18727)
    * test(metric): Remove mustMetric wrapper (#18729)
    * chore(deps): Bump github.com/prometheus/prometheus from 0.310.0 to 0.311.2 (#18715)
    * test(processors.tag_limit): Remove mustMetric function (#18725)
    * test(inputs.x509_cert): Stabilize TestGatherUDPCertIntegration with pion/dtls v3 (#18718)
    * fix(inputs.opcua_listener): Skip nodes failing monitored-item creation (#18717)
    * docs(inputs.cisco_telemetry_mdt): Document examples of using processors with plugin (#17074)
    * chore(testutil): Remove unused MustMetric function (#18726)
    * fix(inputs.nftables): Handle plain string elements in set unmarshalling (#18686)
    * chore(deps): Bump cloud.google.com/go/bigquery from 1.75.0 to 1.76.0 (#18706)
    * chore(deps): Bump github.com/snowflakedb/gosnowflake from 1.19.0 to 1.19.1 (#18697)
    * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.296.2 to 1.297.0 in the aws-sdk-go-v2 group (#18695)
    * fix(inputs.docker): List all containers so non-running states are gathered (#18719)
    * chore(deps): Bump github.com/tdrn-org/go-tr064 from 0.2.3 to 0.2.4 (#18631)
    * docs(inputs.kubernetes): Remove stale bearer_token_string documentation (#18674)
    * chore(deps): Bump github.com/ClickHouse/clickhouse-go/v2 from 2.44.0 to 2.45.0 (#18705)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.3 to 1.16.5 (#18714)
    * chore(deps): Bump modernc.org/sqlite from 1.48.1 to 1.48.2 (#18711)
    * chore(deps): Bump github.com/google/cel-go from 0.27.0 to 0.28.0 (#18710)
    * chore(deps): Bump github.com/leodido/go-syslog/v4 from 4.3.0 to 4.4.0 (#18716)
    * chore(deps): Bump cloud.google.com/go/monitoring from 1.25.0 to 1.26.0 (#18703)
    * chore(deps): Bump github.com/gophercloud/gophercloud/v2 from 2.11.1 to 2.12.0 (#18696)
    * chore(deps): Bump golang.org/x/tools from 0.43.0 to 0.44.0 (#18698)
    * chore(deps): Bump github.com/tdrn-org/go-nsdp from 0.5.0 to 0.5.1 (#18479)
    * chore(deps): Bump github.com/hashicorp/consul/api from 1.33.4 to 1.33.7 (#18632)
    * fix(inputs.opcua_listener): Defer node ID parsing until after server connection (#18683)
    * chore: Update Go to 1.26.2 (#18344)
    * test(inputs.exec): Limit glob to only match /bin/echo (#18678)
    * chore: Update golangci-lint to v2.11.4 (#18472)
    * feat(inputs.openntpd): Add sensor and status metrics (#18468)
    * feat(inputs.wireguard): Add endpoint field to peer metrics (#18457)
    * fix(inputs.opcua_listener): Wrap error correctly in subscribe client (#18684)
    * test(incus): Update Fedora images (#18668)
    * docs(outputs.heartbeat): Add all supported HTTP-client options (#18670)
    * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.71.0 to 1.97.3 (#18669)
    * feat(inputs.opcua): Add locales configuration option (#18643)
    * fix(parsers.influx): Prevent panic due to nil metric on invalid input (#18641)
    * fix(inputs.turbostat): Skip repeated headers with different whitespace (#18640)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18617)
    * chore(deps): Bump google.golang.org/api from 0.273.0 to 0.274.0 (#18661)
    * chore(deps): Bump cloud.google.com/go/monitoring from 1.24.3 to 1.25.0 (#18657)
    * chore(deps): Bump cloud.google.com/go/pubsub/v2 from 2.5.0 to 2.5.1 (#18658)
    * chore(deps): Bump google.golang.org/grpc from 1.79.3 to 1.80.0 (#18663)
    * chore(deps): Bump super-linter/super-linter from 8.5.0 to 8.6.0 (#18652)
    * chore(deps): Bump the aws-sdk-go-v2 group with 5 updates (#18653)
    * chore(deps): Bump github.com/shirou/gopsutil/v4 from 4.26.2 to 4.26.3 (#18654)
    * chore(deps): Bump github.com/aws/smithy-go from 1.24.2 to 1.24.3 (#18655)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.2 to 1.16.3 (#18656)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.54.0 to 1.55.0 (#18659)
    * chore(deps): Bump modernc.org/sqlite from 1.48.0 to 1.48.1 (#18660)
    * chore(deps): Bump github.com/ClickHouse/clickhouse-go/v2 from 2.43.0 to 2.44.0 (#18662)
    * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to 1.62.0 (#18664)
    * chore(deps): Bump go.step.sm/crypto from 0.77.1 to 0.77.2 (#18665)
    * chore(deps): Bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.7.9 (#18666)
    * chore(deps): Bump github.com/vertica/vertica-sql-go from 1.3.5 to 1.3.6 (#18667)
    * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#18649)
    * chore(deps): Update github.com/gotestyourself/gotestsum from 1.10.1 to 1.13.0 (#18644)
    * chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (#18629)
    * chore(deps): Bump github.com/nats-io/nats.go from 1.49.0 to 1.50.0 (#18637)
    * chore(deps): Bump github.com/hashicorp/vault/api/auth/approle from 0.11.0 to 0.12.0 (#18638)
    * chore(deps): Bump github.com/antchfx/jsonquery from 1.3.6 to 1.3.7 (#18639)
    * chore(deps): Bump github.com/Mellanox/rdmamap from 1.1.0 to 1.2.0 (#18636)
    * chore(deps): Bump modernc.org/sqlite from 1.47.0 to 1.48.0 (#18635)
    * chore(deps): Bump cloud.google.com/go/bigquery from 1.74.0 to 1.75.0 (#18633)
    * chore(deps): Bump github.com/emiago/sipgo from 1.2.1 to 1.3.0 (#18630)
    * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.273.0 (#18634)
    * Update changelog for v1.38.2
    * fix(inputs.opcua_listener): Resume metrics after OPC UA session loss (#18628)
    * chore(deps): Bump github.com/lxc/incus/v6 from 6.22.0 to 6.23.0 (#18624)
    * docs(processors.lookup): Fix typo in csv_key_values header example (#18625)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18619)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18618)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18621)
    * chore(inputs.redfish): Migrate testutil.MustMetric to metric.New (#18615)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18620)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18616)
    * chore(inputs.kube_inventory): Migrate testutil.MustMetric to metric.New (#18614)
    * chore(inputs.smart): Migrate testutil.MustMetric to metric.New (#18612)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18622)
    * chore(inputs): Migrate testutil.MustMetric to metric.New (#18623)
    * chore(inputs.libvirt): Migrate testutil.MustMetric to metric.New (#18613)
    * chore(tools.custom_builder): Remove deprecated ast.Package usage (#18526)
    * fix(inputs.opcua_listener): Parse namespace prefixes and nested browse paths in event fields (#18586)
    * fix(agent): Error out if configuration directory is not readable (#18572)
    * docs: Document mem plugin used_percent behavior change (#18535)
    * chore(inputs): Fix linter issues (#18609)
    * fix(agent): Reject negative collection_offset (#18574)
    * chore(deps): Bump github.com/jackc/pgx/v4 to github.com/jackc/pgx/v5 (#18587)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.12.5 to 2.12.6 (#18606)
    * chore(deps): Bump github.com/go-ldap/ldap/v3 from 3.4.12 to 3.4.13 (#18593)
    * chore(deps): Bump github.com/hashicorp/vault/api from 1.22.0 to 1.23.0 (#18604)
    * chore(deps): Bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 (#18597)
    * chore(deps): Bump cloud.google.com/go/pubsub/v2 from 2.4.0 to 2.5.0 (#18595)
    * chore(deps): Bump github.com/klauspost/compress from 1.18.4 to 1.18.5 (#18596)
    * chore(deps): Bump cloud.google.com/go/auth from 0.18.2 to 0.19.0 (#18594)
    * chore(deps): Bump modernc.org/sqlite from 1.46.2 to 1.47.0 (#18598)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.16.1 to 1.16.2 (#18592)
    * chore(deps): Bump github.com/antchfx/xmlquery from 1.5.0 to 1.5.1 (#18591)
    * chore(deps): Bump github.com/fatih/color from 1.18.0 to 1.19.0 (#18590)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.53.0 to 1.54.0 (#18589)
    * chore(deps): Bump the aws-sdk-go-v2 group with 4 updates (#18588)
    * chore(deps): Bump go.step.sm/crypto from 0.76.2 to 0.77.1 (#18600)
    * chore(deps): Bump github.com/coocood/freecache from 1.2.5 to 1.2.7 (#18603)
    * chore(deps): Bump k8s.io/client-go from 0.35.2 to 0.35.3 (#18605)
    * test(models): Fix tests (#18608)
    * chore(outputs): Add error handling for creating a buffer (#18573)
    * fix(outputs.cloudwatch): Allow to send the max of 30 dimensions (#18556)
    * fix(outputs.heartbeat): Skip selfstat collection when status is not configured (#18567)
    * chore(processors.starlark): Replace testutil.MustMetric with metric.New (#18576)
    * chore(processors): Replace testutil.MustMetric with metric.New (#18580)
    * chore(processors): Replace testutil.MustMetric with metric.New (#18579)
    * chore(processors): Replace testutil.MustMetric with metric.New (#18578)
    * chore(processors): Replace testutil.MustMetric with metric.New (#18577)
    * chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (#18536)
    * docs(inputs): Add section to inform about tracking metric support (#18527)
    * chore(serializers.prometheus): Replace testutil.MustMetric with metric.New (#18555)
    * chore(deps): Bump github.com/testcontainers/testcontainers-go/modules/azure from 0.40.0 to 0.41.0 (#18537)
    * fix(inputs): Add startup-errors of input models to gather statistics (#18568)
    * fix(inputs.sip): Use local_address for Via header hostname (#18569)
    * chore(outputs): Replace testutil.MustMetric with metric.New (#18563)
    * chore(outputs): Replace testutil.MustMetric with metric.New (#18562)
    * chore(outputs): Replace testutil.MustMetric with metric.New (#18561)
    * chore(outputs): Replace testutil.MustMetric with metric.New (#18560)
    * feat(inputs.internal): Add counters for failing writes and gathers (#18571)
    * chore(deps): Bump github.com/testcontainers/testcontainers-go/modules/kafka from 0.40.0 to 0.41.0 (#18545)
    * test(common.snmp): Cleanup (#18575)
    * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3 (#18570)
    * fix(inputs.ping): Do not show warning when timeout not set (#18530)
    * fix(inputs.snmp): Disable OID increase check (#18531)
    * docs(agent): Fix comments in top-level interfaces (#18518)
    * chore(deps): Bump golang.org/x/mod from 0.33.0 to 0.34.0 (#18540)
    * chore(serializers.prometheus): Replace testutil.MustMetric with metric.New (#18554)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.15.2 to 1.16.1 (#18543)
    * chore(deps): Bump cloud.google.com/go/storage from 1.60.0 to 1.61.3 (#18549)
    * docs(processors.parser): Improve documentation of merge strategy (#18516)
    * chore(deps): Bump google.golang.org/api from 0.270.0 to 0.272.0 (#18542)
    * chore(outputs.cloudwatch): Cleanup code (#18460)
    * chore(deps): Bump modernc.org/sqlite from 1.46.1 to 1.46.2 (#18541)
    * chore(deps): Bump github.com/gophercloud/gophercloud/v2 from 2.11.0 to 2.11.1 (#18544)
    * chore(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs/v2 from 2.0.1 to 2.0.2 (#18548)
    * chore(deps): Bump github.com/testcontainers/testcontainers-go/modules/vault from 0.40.0 to 0.41.0 (#18550)
    * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0 (#18551)
    * chore(deps): Bump github.com/prometheus/prometheus from 0.308.1 to 0.310.0 (#18445)
    * Update changelog for v1.38.1
    * chore: Fix invalid pre-allocation (#18534)
    * chore(deps): Bump go.opentelemetry.io/collector/pdata from 1.46.0 to 1.53.0 (#18075)
    * chore(parsers.csv): Rename loop variable to avoid import shadowing (#18524)
    * chore(outputs.zabbix): Rename loop variable to avoid import shadowing (#18523)
    * chore(inputs.docker): Rename loop variable to avoid import shadowing (#18522)
    * chore(serializers.prometheusremotewrite): Rename variable to avoid import shadowing (#18512)
    * chore(serializers.prometheusremotewrite): Replace testutil.MustMetric with metric.New (#18504)
    * chore(inputs): Fix linter issues (#18503)
    * chore(models): Replace testutil.MustMetric with metric.New (#18496)
    * fix(inputs.mem): Use vm.Cached as vm.Buffers on OpenBSD (#18469)
    * fix(inputs.exec): Log stderr messages (#18513)
    * chore: Fix remaining linter issues (#18525)
    * test(internal.clock): Fix flaky TestUnalignedTicker race condition (#18515)
    * chore(models): Rename loop variable to avoid import shadowing (#18511)
    * chore(aggregators.histogram): Fix linter issues (#18493)
    * chore(serializers.prometheus): Rename type metric struct to promMetric (#18507)
    * chore(inputs.amd_rocm_smi): Rename type metric struct to gpuMetric (#18506)
    * chore(serializers.json): Replace testutil.MustMetric with metric.New (#18505)
    * chore(serializers): Fix linter issues (#18500)
    * feat(inputs.opcua_listener): Allow selecting the deadband mode 'None' (#18465)
    * chore(outputs.stackdriver): Clean up minor issues in stackdriver plugin (#18433)
    * fix(inputs.diskio): Sanitize newline characters in serial tag (#18491)
    * fix(outputs.influxdb_v3): Remove duplicate timeout setting (#18509)
    * chore(parsers): Replace testutil.MustMetric with metric.New (part 2) (#18499)
    * chore(parsers): Replace testutil.MustMetric with metric.New (part 1) (#18498)
    * chore(aggregators): Replace testutil.MustMetric with metric.New (#18497)
    * chore(parsers): Fix linter issues (#18501)
    * chore(inputs.sip): Clean up option validation (#18426)
    * test(outputs.stackdriver): Add tests for secret token source (#18432)
    * fix(inputs.docker): Emit status metrics for non-running containers (#18453)
    * test(inputs.statsd): Replace time.Sleep with testify assertions (#18461)
    * chore(outputs): Fix linter issues (#18494)
    * chore(outputs.cloudwatch): Cleanup unit-tests (#18492)
    * chore(deps): Bump go.opentelemetry.io/proto/otlp/collector/profiles/v1development from 0.2.0 to 0.3.0 (#18485)
    * chore(deps): Bump google.golang.org/api from 0.269.0 to 0.270.0 (#18480)
    * chore(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0 (#18484)
    * chore(deps): Bump go.opentelemetry.io/proto/otlp from 1.9.0 to 1.10.0 (#18483)
    * chore(deps): Bump github.com/SAP/go-hdb from 1.15.1 to 1.15.2 (#18486)
    * chore(deps): Bump github.com/apache/arrow-go/v18 from 18.5.1 to 18.5.2 (#18488)
    * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 (#18478)
    * chore(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.2 (#18490)
    * chore(deps): Bump github.com/alitto/pond/v2 from 2.6.2 to 2.7.0 (#18477)
    * chore(deps): Bump the aws-sdk-go-v2 group with 11 updates (#18474)
    * chore(deps): Bump tj-actions/changed-files from 47.0.4 to 47.0.5 (#18473)
    * chore(deps): Bump github.com/emiago/sipgo from 1.2.0 to 1.2.1 (#18487)
    * chore(deps): Bump github.com/nats-io/nats-server/v2 from 2.12.4 to 2.12.5 (#18481)
    * chore(deps): Bump github.com/gophercloud/gophercloud/v2 from 2.10.0 to 2.11.0 (#18475)
    * fix(inputs.ping): Warn on using timeout parameter for native method (#18455)
    * fix(internal): Extract go version even more robustly (#18471)
    * Update changelog for v1.38.0

++++ tempo-cli:

  - Update to version 3.0.0:
    * CLI-related changes:
  - Add span profiling support via otelpyroscope. Enable with
    span_profiling: true or -span-profiling CLI flag to attach
    pprof labels to OTel spans by @simonswine in #7063
  - Add tempo-cli migrate config command for migrating Tempo 2.x
    configs to 3.0 by @mapno in #6982
  - tempo-cli: Add --header flag to query api commands for custom
    headers by @Nouuu in #6768
  - tempo-cli: add redact command to submit trace redaction jobs
    to the backend scheduler by @zalegrala in #6832
  - Double the maximum number of dedicated string columns in
    vParquet5 and update tempo-cli to determine the optimum
    number for the data by @mdisibio in #6282
  - Remove explicit runtime.GC() calls in vParquet5
    compactor/block creation and CLI by @oleg-kozlyuk-grafana in
    [#6603]
  - Removed v2 block encoding and the legacy v2 compactor
    component by @joe-elliott in #6273
  - Removed v2-specific CLI commands: list block, list index,
    view index, gen index, and gen bloom.
  - Removed duplicate compaction prefix from CompactorConfig CLI
    flags by @electron0zero in #6909
  - compaction.compaction.block-retention →
    compaction.block-retention
  - compaction.compaction.max-objects-per-block →
    compaction.max-objects-per-block
  - compaction.compaction.max-block-bytes →
    compaction.max-block-bytes
  - compaction.compaction.compaction-window →
    compaction.compaction-window
  - Removed legacy mem-ballast-size-mbs CLI flag by
    @orkhan-huseyn in #6403
  - tempo-cli: Support relative time (now, now-1h) for start/end
    args and standardize on RFC3339 in all commands by
    @electron0zero in #6458
  - query search command no longer accepts timestamps without
    timezone, for example 2024-01-01T00:00:00; use RFC3339, for
    example 2024-01-01T00:00:00Z, or relative time instead.
  - tempo-cli: Rewrite migrate overrides-config and add migrate
    overrides-per-tenant command to help migrate legacy flat
    overrides to the new scoped format by @electron0zero in #6793
    * Dependencies
  - fix(security/high): update module github.com/apache/thrift to
    v0.23.0 [security] (#7265)
  - fix(security/unknown): update module golang.org/x/crypto to
    v0.52.0 [security] (#7266)
  - fix(security/unknown): update module golang.org/x/net to
    v0.55.0 [security] (#7267)

++++ tree-sitter-ruby:

  - Use correct tree-sitter dirname instead of tree_sitter
    (bsc#1267461).
  - Remove empty tree-sitter-ruby-0.23.1-dependencies.patch.
  - Remove redundant Neovim workaround
  - Fix order of entries in the changelog.

++++ upx:

  - Update to release 5.2.0
    * Support for the cpm86/cmd format

++++ wayland-protocols:

  - Update to version 1.49:
    + Improve multi-GPU support in linux-dmabuf-v1
    + Add Windows BT.2100 image descriptions to color-management-v1
    + A new experimental protocol for fractional scaling
  - Import new key from Simon Sers webpage: https://emersion.fr/about

++++ weechat:

  - Update to 4.9.2:
    * api: fix infinite loop in function string_replace when the search
    string is empty
    * irc: limit size of data received from the server to prevent
    memory exhaustion
    * irc: fix out-of-bounds read on incoming DCC command with a quoted
    filename ending the message (#2322)
    * relay: limit size of received websocket frame and HTTP body to
    prevent memory exhaustion
    * relay: limit size of partial message received while reading an
    HTTP request to prevent memory exhaustion
    * relay: fix out-of-bounds read in dump of data (#2324)
    * xfer: replace directory separator in remote nick by underscore in
    download filename to prevent writing the file outside the download
    directory (#2321)
    * xfer: fix out-of-bounds read when receiving empty line in DCC
    chat (#2323)

++++ xdg-desktop-portal:

  - Update to version 1.22.0:
    + Bug Fixes:
  - Correct passing icon GVariant around in the Dynamic Launcher
    Portal
  - Improve Document Portal document path resolving for the File
    Chooser and OpenURI Portals

++++ xdg-desktop-portal-devel-docs:

  - Update to version 1.22.0:
    + Bug Fixes:
  - Correct passing icon GVariant around in the Dynamic Launcher
    Portal
  - Improve Document Portal document path resolving for the File
    Chooser and OpenURI Portals

++++ xonsh:

  - update to version 0.23.8:
    * Features
  - Add `events.on_completer_filter` to skip certain completer if needed ([#6453](https://github.com/xonsh/xonsh/issues/6453)) ([ea747d2](https://github.com/xonsh/xonsh/commit/ea747d276aa9f3646bfbc6d01dc84b5888a508b0))
  - Builtins: source-foreign: Add ash, dash, ksh as reference to sh ([#6459](https://github.com/xonsh/xonsh/issues/6459)) ([9bb681f](https://github.com/xonsh/xonsh/commit/9bb681f8e30d29b1d2011d47b6d3428368c554f0))
  - Parser: Support multiline string with logical subprocess ([#6465](https://github.com/xonsh/xonsh/issues/6465)) ([78d9c53](https://github.com/xonsh/xonsh/commit/78d9c532aebf6374bbecdb795edce4b285a33a6f))
  - Support SSH escape sequences ([#6462](https://github.com/xonsh/xonsh/issues/6462)) ([c5300ed](https://github.com/xonsh/xonsh/commit/c5300ed1be96aad8cbe94351b11fe8f575122ea9))
    * Fixes
  - Builtins: source-foreign: Show more detailed error, add `source-sh` ([#6458](https://github.com/xonsh/xonsh/issues/6458)) ([8ef52c1](https://github.com/xonsh/xonsh/commit/8ef52c167f5838887ced87be81f6974712ec58b9))
  - Builtins: trace: Fix lags issue by avoiding settrace for all files. Also improve output flushing ([#6460](https://github.com/xonsh/xonsh/issues/6460)) ([da4e2c9](https://github.com/xonsh/xonsh/commit/da4e2c99f759e15615b2d38b26a5b0e5b49dbd7c))
  - **completer:** Source user bash completion scripts ([#6464](https://github.com/xonsh/xonsh/issues/6464)) ([a17c6f6](https://github.com/xonsh/xonsh/commit/a17c6f6c9d56453a3082d8afe642e89c24299c2e))
  - Parser: Treat `!` inside f-string `{…}` as conversion ([#6466](https://github.com/xonsh/xonsh/issues/6466)) ([6f52fdc](https://github.com/xonsh/xonsh/commit/6f52fdccf5c77f1d5235f8f05ebac64fffa8094e))
  - **parser:** treat ``!`` inside f-string ``{…}`` as conversion, not macro ([b41ba78](https://github.com/xonsh/xonsh/commit/b41ba78a10bd0c56e49e083c1bb40df8a886e49b))
  - Proc: Additional polling return code  ([#6457](https://github.com/xonsh/xonsh/issues/6457)) ([0549cc5](https://github.com/xonsh/xonsh/commit/0549cc51b00b3d5c495a3e0145f0c7b57e48f472))
  - Readline: Completer: Fix file with space in name ([#6455](https://github.com/xonsh/xonsh/issues/6455)) ([d7a2811](https://github.com/xonsh/xonsh/commit/d7a2811a4eb6a5d86de8c1670bce6f52f85d9d9e))
  - **tests:** Add pytest-xdist support  ([#6454](https://github.com/xonsh/xonsh/issues/6454)) ([85f6c55](https://github.com/xonsh/xonsh/commit/85f6c55590e64a07097b2e91a486273ad25825cd))
  - TTY: termios error ([#6461](https://github.com/xonsh/xonsh/issues/6461)) ([b8e51f0](https://github.com/xonsh/xonsh/commit/b8e51f0ee2c7c7a8f38dc090e503e2ed1762a3e6))
  - xcontext: Show both path and resolved path ([#6448](https://github.com/xonsh/xonsh/issues/6448)) ([8b75ce2](https://github.com/xonsh/xonsh/commit/8b75ce20c71c72f8e50aa1a55148bf895fa6a243))
  - **xontribs:** Invalidate import caches before loading xontribs ([#6452](https://github.com/xonsh/xonsh/issues/6452)) ([794b53c](https://github.com/xonsh/xonsh/commit/794b53c609df0e3166b584300c3473ffa061f244))
    * Refactoring
  - Remove docstring shenanigans from events ([#6449](https://github.com/xonsh/xonsh/issues/6449)) ([8bc46d0](https://github.com/xonsh/xonsh/commit/8bc46d046d386b7128e1c778ba476f771f859f75))
  - update to version 0.23.7:
    * Features
  - Add `[@toml](https://github.com/toml)` command decorator e.g. `data = $([@toml](https://github.com/toml) cat pyproject.toml)` ([#6436](https://github.com/xonsh/xonsh/issues/6436)) ([97f701d](https://github.com/xonsh/xonsh/commit/97f701dfe8910585a85c16407b5f19cd719d86fc))
  - Add dedicated `sudo` completer ([#6433](https://github.com/xonsh/xonsh/issues/6433)) ([f7f2d27](https://github.com/xonsh/xonsh/commit/f7f2d2734df90bad335b0f9b1e2f0e17cb6656e2))
  - Add sentinel `@.env.DELETE_VAR` to removing env variables using env swap/layouts/specs ([#6427](https://github.com/xonsh/xonsh/issues/6427)) ([7e66501](https://github.com/xonsh/xonsh/commit/7e66501c89c8bae0c236a8bdaad26b51095f0d7d))
    * Fixes
  - `exit N` aborts execution immediately ([#6429](https://github.com/xonsh/xonsh/issues/6429)) ([eb916a0](https://github.com/xonsh/xonsh/commit/eb916a0ddf8d1c3faa21df881ba517c953a095ce))
  - Add repr to DecoratorAlias and ArgParserAlias ([#6443](https://github.com/xonsh/xonsh/issues/6443)) ([554b675](https://github.com/xonsh/xonsh/commit/554b675257a0f208eb33ead7192975b90e250448))
  - **environ:** pop __THREAD_LOCAL__ from inherited os.environ in default_env ([#6434](https://github.com/xonsh/xonsh/issues/6434)) ([4d966d2](https://github.com/xonsh/xonsh/commit/4d966d2b764d1571dbf0101d1d4f52c828b07392))
  - Proc: Fix alias with pipe backgrounding ([#6439](https://github.com/xonsh/xonsh/issues/6439)) ([208d359](https://github.com/xonsh/xonsh/commit/208d359a84bffd624942a365672d46a2baaebd18))
  - **tests:** forward $PATH in foreign shell tests so they work in Nix sandbox ([#6430](https://github.com/xonsh/xonsh/issues/6430)) ([#6431](https://github.com/xonsh/xonsh/issues/6431)) ([afb2eda](https://github.com/xonsh/xonsh/commit/afb2eda1ef4f4c59784a8c36db5bc3b18223cb74))
    * Documentation
  - Capitalize docs title ([#6441](https://github.com/xonsh/xonsh/issues/6441)) ([c458ba4](https://github.com/xonsh/xonsh/commit/c458ba4d940f78041f886b474991a94d37702d18))
  - update to version 0.23.6:
    * Features
  - Add `--show-output` to source foreign ([#6421](https://github.com/xonsh/xonsh/issues/6421)) ([23e26b8](https://github.com/xonsh/xonsh/commit/23e26b8983b877e816b6021f811c97b21c520cea))
  - Add `xontrib info <xontrib_name>` ([#6407](https://github.com/xonsh/xonsh/issues/6407)) ([6fe1e11](https://github.com/xonsh/xonsh/commit/6fe1e114f1b956bee30bb7d74377a059210eb81d))
  - Add checksums for artifacts on release page and on nightly build page ([#6420](https://github.com/xonsh/xonsh/issues/6420)) ([cf0ee6b](https://github.com/xonsh/xonsh/commit/cf0ee6b349469fee0dc7184f32eb0ba3a561b9b4))
  - **Completer:** Show alias body in description if no docstring ([#6408](https://github.com/xonsh/xonsh/issues/6408)) ([fe6472e](https://github.com/xonsh/xonsh/commit/fe6472ef603d9dc896cdab017db308c13fcf1835))
  - Parser: Allow comments in multiline commands ([#6417](https://github.com/xonsh/xonsh/issues/6417)) ([081deeb](https://github.com/xonsh/xonsh/commit/081deebfbcef640d03cf25568374ada1f2f5cead))
    * Fixes
  - AppImage: Remove legacy logic from entrypoint ([#6415](https://github.com/xonsh/xonsh/issues/6415)) ([ab26546](https://github.com/xonsh/xonsh/commit/ab26546f27df5cacc5a202fbeb40763fa70a930b))
  - **Completer:** Fix completer in case of xontrib load with unknown arg ([#6405](https://github.com/xonsh/xonsh/issues/6405)) ([68c234a](https://github.com/xonsh/xonsh/commit/68c234a740fea5999fe098b3b2249ac2db436af9))
  - Conda on Windows: `conda init xonsh` produces TypeError. Also fixed conda activate/deactivate aliases when conda is on $PATH ([#6423](https://github.com/xonsh/xonsh/issues/6423)) ([6708eee](https://github.com/xonsh/xonsh/commit/6708eeedcd77d7bc70eb8795125b8608b4d89195))
  - **docs:** Fix code highlighting ([#6418](https://github.com/xonsh/xonsh/issues/6418)) ([b009635](https://github.com/xonsh/xonsh/commit/b0096358e97aadd1933558199e7baf062dafb8be))
  - **Docs:** Highlight xonsh code block in docs/xonshrc ([#6419](https://github.com/xonsh/xonsh/issues/6419)) ([bfb4667](https://github.com/xonsh/xonsh/commit/bfb46672489599ac58f70847e6dd98b4210aaf0d))
  - Environ: EnvPath should preserve empty values in the general case ([#6416](https://github.com/xonsh/xonsh/issues/6416)) ([3e63379](https://github.com/xonsh/xonsh/commit/3e63379a65089f9f5c9703f8eadce38e1c260e2f))
  - Foreign shell function aliases now stream their output through the caller-supplied stdout/stderr instead of inheriting xonsh's terminal fds ([#6409](https://github.com/xonsh/xonsh/issues/6409)) ([c40cfc5](https://github.com/xonsh/xonsh/commit/c40cfc5574fe9ad122d25a04a09c4ec7b9349abd))
  - **Prompt:** Fix exception in case IGNOREEOF + ^D ([#6413](https://github.com/xonsh/xonsh/issues/6413)) ([03cd547](https://github.com/xonsh/xonsh/commit/03cd547406ef9b7b06119634c37c3f967f754089))
  - Windows: Aliases: Fix sudo shadowing and significantly improve win_sudo logic ([#6410](https://github.com/xonsh/xonsh/issues/6410)) ([58b835b](https://github.com/xonsh/xonsh/commit/58b835b265d37ef90641b6955510d5afd73fa2ef))
  - update to version 0.23.5:
    * Features
  - Show alias description in completion menu ([#6399](https://github.com/xonsh/xonsh/issues/6399)) ([cf6db23](https://github.com/xonsh/xonsh/commit/cf6db2352949b8d630dc22ed67d9673d9999cfc9))
  - Xonsh code formatter alpha version. Run `xonsh format file.xsh` ([#6401](https://github.com/xonsh/xonsh/issues/6401)) ([8c3191e](https://github.com/xonsh/xonsh/commit/8c3191eee70295e6d840d2031092af6444a2e1b0))
    * Fixes
  - **completer:** Allow completion of explicit dot-dirs ([#6402](https://github.com/xonsh/xonsh/issues/6402)) ([343f5fd](https://github.com/xonsh/xonsh/commit/343f5fd9bbea3c143b6bc5ec6e0816d78a1e8b17))
  - **completer:** Fix parent directory completion ([#6404](https://github.com/xonsh/xonsh/issues/6404)) ([0d5a2fc](https://github.com/xonsh/xonsh/commit/0d5a2fc7c130314dcfe8f3a873cf6e3346a163d6))
  - Fix webconfig test with prevent adding tail to global xonsh RC ([#6400](https://github.com/xonsh/xonsh/issues/6400)) ([a94eb6a](https://github.com/xonsh/xonsh/commit/a94eb6ad77a4a0741d9d589bb63ce79ca18b1035))
    * Documentation
  - **editors:** Add JetBrains plugin ([#6396](https://github.com/xonsh/xonsh/issues/6396)) ([6d6640b](https://github.com/xonsh/xonsh/commit/6d6640b689ba305e9ef4da5d0ee9d05d472738d8))
  - update to version 0.23.4:
    * Fixes
  - AssertionError: wrong color format 'blink' ([#6391](https://github.com/xonsh/xonsh/issues/6391)) ([a31a53e](https://github.com/xonsh/xonsh/commit/a31a53ec610c75782f5b52fb2eaa9c1aae09c550))
  - **chore:** Added smoke tests ([#6393](https://github.com/xonsh/xonsh/issues/6393)) ([c5c2a3f](https://github.com/xonsh/xonsh/commit/c5c2a3fb3b82423318c0690fe2d350bc320c0b47))
  - Cross-platform: Jupyter: pyghooks lexer crash when XSH.aliases is None ([#6384](https://github.com/xonsh/xonsh/issues/6384)) ([dc16ca6](https://github.com/xonsh/xonsh/commit/dc16ca691007d436ca2339ad122a976a631ac51c))
  - f-strings: SyntaxError with int formatting ([#6390](https://github.com/xonsh/xonsh/issues/6390)) ([f5ca787](https://github.com/xonsh/xonsh/commit/f5ca7878f089bec57ff5a975f736544a6dfc5d9d))
  - **nix:** fix nix build ([#6388](https://github.com/xonsh/xonsh/issues/6388)) ([5831959](https://github.com/xonsh/xonsh/commit/5831959d066c5d0411f626d749e00eecc58ce2aa))
  - **parser:** Fix lost LHS in `cmd && ![…]` chain wrap ([#6392](https://github.com/xonsh/xonsh/issues/6392)) ([4daff85](https://github.com/xonsh/xonsh/commit/4daff85ebe45c69679639239bb20730a5bc642c3))
  - Xontrib load using entrypoint e.g. coconut ([#6394](https://github.com/xonsh/xonsh/issues/6394)) ([d68e39c](https://github.com/xonsh/xonsh/commit/d68e39ce711b308e10d526e183e6d563ee379de4))
  - update to version 0.23.3:
    * Features
  - Add frame to `@.debug.breakpoint()` ([#6376](https://github.com/xonsh/xonsh/issues/6376)) ([8e17615](https://github.com/xonsh/xonsh/commit/8e176151831c4552804426c9657f72ca0c82692e))
  - Better Android/Termux support ([#6382](https://github.com/xonsh/xonsh/issues/6382)) ([c3aefaf](https://github.com/xonsh/xonsh/commit/c3aefafb351caabbea0874217abeebe47e8afb0a))
  - Better FreeBSD support: defaults, jail tests and fixes ([#6375](https://github.com/xonsh/xonsh/issues/6375)) ([ced252e](https://github.com/xonsh/xonsh/commit/ced252e399ef0bf035658e8771eab4aebbcdb28b))
    * Fixes
  - Debug: Show debug warning in case of worker thread ([#6378](https://github.com/xonsh/xonsh/issues/6378)) ([58b66d5](https://github.com/xonsh/xonsh/commit/58b66d5a360eb26684d270adedd9d15fb7f1c288))
  - **parser:** Fix SyntaxError in case `cmd && @() && cmd` ([#6380](https://github.com/xonsh/xonsh/issues/6380)) ([759f9bb](https://github.com/xonsh/xonsh/commit/759f9bbec7dfa60a76f327b067e0d048c6353964))
  - update to version 0.23.2:
    * Features
  - Added `@.debug` with `breakpoint` and `replace_builtin_breakpoint` ([#6363](https://github.com/xonsh/xonsh/issues/6363)) ([f092a8c](https://github.com/xonsh/xonsh/commit/f092a8ca0c99bffcd69044c61de109e0ceb2ceb4))
  - **completer:** Use quotation only if needed - bash completer ([#6367](https://github.com/xonsh/xonsh/issues/6367)) ([9cca19e](https://github.com/xonsh/xonsh/commit/9cca19efe7c6f6c2761bfb237667ec5ed3b049ab))
  - **completer:** Use quotation only if needed + some fixes ([#6366](https://github.com/xonsh/xonsh/issues/6366)) ([4fd3667](https://github.com/xonsh/xonsh/commit/4fd36675945c11deb881aee115b3d03581c5d8dc))
    * Fixes
  - **completer:** Fix `@.<obj>.<tab>` completion ([#6364](https://github.com/xonsh/xonsh/issues/6364)) ([23e4652](https://github.com/xonsh/xonsh/commit/23e46520e2fbd906eefcf366c1400466f49db43d))
  - **completer:** Fix bash completer quotation ([#6370](https://github.com/xonsh/xonsh/issues/6370)) ([b711c4a](https://github.com/xonsh/xonsh/commit/b711c4a51754d61173b19a49e984b6316d17abe1))
  - **completer:** Hide syntax and private methods if line is empty ([#6372](https://github.com/xonsh/xonsh/issues/6372)) ([94d7753](https://github.com/xonsh/xonsh/commit/94d775348f672b756816ea6f3c241e7fc89d317e))
  - Nix: Now flake uses the package built from source ([#6361](https://github.com/xonsh/xonsh/issues/6361)) ([f6d458c](https://github.com/xonsh/xonsh/commit/f6d458c641da5d87374e02ff68e56aa25719eb6d))
    * Documentation
  - Add Github Actions ([c27c97e](https://github.com/xonsh/xonsh/commit/c27c97e02ff7f1c6943777548055d0402c608ed6))
  - fix dockerhub container name ([8b323de](https://github.com/xonsh/xonsh/commit/8b323def0ffebffc73937c1aac3b1d09ef081657))
  - fix dockerhub container name ([0d929c9](https://github.com/xonsh/xonsh/commit/0d929c96f365d3dd10f44cb7d525d06dd6f7f2a2))
  - Replace xonshrc mentions to the link with xonshrc.rst ([#6365](https://github.com/xonsh/xonsh/issues/6365)) ([6032abc](https://github.com/xonsh/xonsh/commit/6032abc2665a0fd57d0625691b1d39c4464c9ce0))
  - update index.html for i18n support ([#6359](https://github.com/xonsh/xonsh/issues/6359)) ([cac1476](https://github.com/xonsh/xonsh/commit/cac1476cb845a9ec751bf4aa1c1a894c0eb91a62))

++++ yazi:

  - Increase memory constraint to build on aarch64

++++ zig:

  - Bump to version 0.15.2 as version current.

++++ zig0.16:

  - Keep a local copy of skip-localhost-test.patch

------------------------------------------------------------------
------------------  2026-6-7  -  Jun 7 2026  -------------------
------------------------------------------------------------------

++++ MozillaFirefox:

  - Mozilla Firefox 151.0.3
    MFSA 2026-54 (boo#1267841)
    * CVE-2026-10701 (bmo#2038537)
    Incorrect boundary conditions in the Graphics: Text component
    * CVE-2026-10702 (bmo#2040903)
    JIT miscompilation in the JavaScript Engine: JIT component
    * Fixed an issue where selecting or pasting text in a text field
    inside a table cell could disrupt the page layout.
    (bmo#2041235)
    * Fixed an issue where the VPN toolbar button icon could appear
    larger than intended. (bmo#2042454)
  - includes changes from 151.0.2:
    * Fixed an issue where adding another tab to an existing Split
    View could unexpectedly close it. (bmo#2039795)
    * Fixed an issue where Split View would close instead of
    switching tabs when using the "Switch to Tab" option from the
    address bar. (bmo#2039787)
    * Fixed an issue where Firefox stopped caching new content once
    the disk cache was full, causing pages and resources to be
    re-downloaded from the network on every visit. (bmo#2031577)
    * Fixed an issue where some websites could render incorrectly or
    fail to load when they used JavaScript to insert WebKit-
    specific style rules. (bmo#2040693)
    * Fixed an issue where clicking and selecting text in some input
    fields and text areas did not work on pages that styled them
    with certain CSS rules. (bmo#2039504)
    * Fixed an issue where the up and down buttons on number input
    fields could overlap and hide the value when sites sized the
    field to fit its contents. (bmo#2039315)
    * Fixed an issue where sorting strings that include numbers could
    produce an incorrect order on some websites and web
    applications. (bmo#2027078)
    * Fixed an issue where dropdown menus would not open for
    `<select>` elements created inside an iframe and then moved
    into the parent page. (bmo#2041720)

++++ bpftrace:

  - Update to 0.26.1
    * Fix reval and argX for session probes
    * Fix self probe listing
    * Fix statement probes for some compiler versions
  - Update to 0.26.0
    * Stabilize imports of other bpftrace files (.bt) and BPF C sources
    * Stabilize address-of operator (&)
    * DWARF-based stack unwinding for user-space
    * Statement probes (uprobe:binary@file:line[:column])
    * New builtin write_user(dst, src, len) to write to user-space memory
    * Fix subtraction and decrement ops not producing the correct type

++++ llvm:

  - Provide unversioned symbolic links to binaries and man pages for
    llvm, clang, lld, and lldb, since they're no longer provided by
    update-alternatives.
  - Clean up obsoletes for LLVM versions < 13.

++++ llvm22:

  - Migrate away from update-alternatives. The packages only provide
    versioned binaries and man pages now. The metapackage will
    provide symbolic links to the current distro default version.

++++ llvm18:

  - Migrate away from update-alternatives. The packages only provide
    versioned binaries and man pages now. The metapackage will
    provide symbolic links to the current distro default version.

++++ llvm19:

  - Migrate away from update-alternatives. The packages only provide
    versioned binaries and man pages now. The metapackage will
    provide symbolic links to the current distro default version.
  - Enable LLDB Python bindings on Leap 15.6 and newer.

++++ llvm20:

  - Migrate away from update-alternatives. The packages only provide
    versioned binaries and man pages now. The metapackage will
    provide symbolic links to the current distro default version.

++++ llvm21:

  - Migrate away from update-alternatives. The packages only provide
    versioned binaries and man pages now. The metapackage will
    provide symbolic links to the current distro default version.

++++ execdir:

    Update to 0.5.0
  - Add option to clear the alias database
  - Add environment variable to set maxsize of the alias database

++++ faugus-launcher:

  - Bump to version 1.21.1
  - Upstream changes:
    * Updated metadata screenshots
    * Updated screenshots
    * Added support for DW-Proton
    * Updated HDR option
    * Show game icon on splash
    * Some refactoring + high dpi logo on runner
    * cleanup: remove redundant flowbox clearing and dead code in update_list
    * fix: properly close file handle in save_running
    * Added missing translation tokens
    * Grabs better icons
    * refactor: centralize gettext setup into language_config.py
    * Another attempt to fix the EA App
    * Removed EA App support
    * Update runner.py
    * Add files via upload
    * Update faugus-launcher.po
    * fix(proton-manager): skip non-directory entries in get_installed_path
    * Removed old gameid logic
    * Update launcher.py
    * Update shortcut.py
    * Update shortcut.py
    * Update shortcut.py
    * refactor: remove duplicate locale functions, import from language_config
    * Update proton_manager.py
    * Remove duplicate json import
    * Remove unused variables
    * Removed treeview style
    * Fix command injection via executable filenames
    * Remove unused get_remove_prefix_state method
    * Remove unused on_checkbox_addapp_toggled handler.
    * Remove unused variables
    * Remove unused variables
    * Remove unused variables
    * Remove unused variables
    * Remove unused extraction method
    * Update launcher.py
    * Update gamepad.py
    * Update faugus-launcher.po
    * Forgot the argument
    * Removed gpu name print

++++ fontconfig:

  - Update to 2.18.1
    * Workaround :-prefixed filename used in Qt
    * meson: force enabling HAVE_C99_VSNPRINTF
    * Do not set 'sans-serif' for default genericfamily
    * Fix another font matching issue
    * Fix not matching with a font family name
    * Disable invalid attribute warning by default
    * boo#1267844

++++ forgejo:

  - apparmor profile: allow reading of credential files. This fixes
    migration of private repositories

++++ gap-utils:

  - Update to release 0.96
    * Make `TestPackage` work if the package is read-only

++++ gemini-cli:

  - update to 0.45.2:
    * fix(patch): cherry-pick f40498d to release/v0.45.1-pr-27676
    to patch version v0.45.1 and create version 0.45.2
  - update to 0.45.1:
    * fix(patch): cherry-pick 665228e to release/v0.45.0-pr-27570
    to patch version v0.45.0 and create version 0.45.1

++++ llamacpp:

  - Update to version 9553:
    * Added new model and multimodal support, including Granite 4
    Vision, Gemma 4 MTP, and Qwen-VL video handling via frame-merge
    support.
    * Improved accelerator backends with faster CUDA MTP and MoE paths,
    SYCL multi-column MMVQ, Vulkan Intel FWHT support with safer
    feature detection, OpenCL kernel tuning, and WASM SIMD128
    vectorization.
    * Extended server and API behavior with multimodal token counting,
    a new `*/input_tokens` endpoint, reduced unnecessary checkpoint
    restores, and disabled on-device speculative checkpoints.
    * Updated build and packaging bits: CMake now skips CPU-only tools
    when the CPU backend is disabled, XCFramework header and
    module-map generation was fixed, Docker CUDA 13 moved to 13.3.0,
    and MSYS CI dependencies were slimmed down.
    * Improved downloader and CLI behavior by avoiding duplicate MTP
    downloads, skipping mmproj downloads when explicitly supplied,
    and fixing CLI model parameters not being propagated correctly.
    * Fixed multiple conversion and model-compatibility issues,
    including Gemma 4 unified and no-audio cases, Gemma 4 audio
    projector sizing, and Mistral-Medium-3.5-128B GGUF conversion.
    * Fixed GPU, layer, cache, and speculative decoding stability
    issues, including `n_gpu_layers` handling, vocab compatibility
    checks, and KV-cache sharing and copy assertions.
    * Refreshed the WebUI with single-line reasoning preview, improved
    keyboard accessibility, fixed tool selector state and counting,
    pinned packages for reproducible installs, and enabled npm
    install safeguards with `ignore-scripts=true`.
    * Improved chat and tool-call interoperability by fixing LFM2 and
    LFM2.5 tool parsing and reasoning round-trip handling, and by
    relaxing sampler name matching to accept common alias forms.
    * Full commit log:
    https://github.com/ggml-org/llama.cpp/compare/b9500...b9553
  - Include the web ui assets in the RPM package

++++ ghc-crypton-x509-store:

  - Update crypton-x509-store to version 1.9.0.
    * Fix CVE-2026-9648, bsc#1268157.
    * Using "ram" instead of "memory".
    * Depend on package `crypton-asn1-types >= 0.4.1` rather than `asn1-types`.
    ASN.1-related types and classes are now those from the former package.
    * Swap crypton-pem for existing unmaintained pem dependency.

++++ gpxsee:

  - Update to version 16.8
    * Fixed broken non-UTF encodings(codepage) handling on macOS.
    * Fixed missing Qt(system) localization/translations on macOS.
    * Adjusted the macOS App icon to the platform’s visual language.
    * Now using macos-26/Xcode 26.4.1 for the macOS builds.

++++ kak-lsp:

  - Update to version 20.0.0:
    * v20.0.0
    * Update changelog
    * Fix tinymist documentation URL
    * Fix tinymist preview config key. `previewFeature` only works for the vscode plugin
    * Encode brackets for file paths
    * feat: swift/sourcekit-lsp support
    * Paal Øye-Strømme Copyright Waiver
    * Make sure buffer synchronization works even when finaleol is missing
    * workspace/executeCommand: don't panic on invalid args JSON
    * servers.kak: update markdown-oxide root markers
    * Inline lsp-initial-goto-position
    * Fix function_casts_as_integer warning
    * lsp-capabilities: remove stale default mappings
    * changelog new erlang default server
    * fix(ci/commit-new-release.sh): interpolate version number
    * Change default language server for erlang
    * lsp-inlay-hint-apply-*: fix crash when no hints avail
    * Add inlay hint textedit support
    * start new cycle

++++ kitty:

  - Update to 0.47.2:
    * Allow dragging to move scrollbar after clicking on track when
    `scrollbar_jump_on_click` is enabled (#10085)
    * macOS: Fix regression in 0.47.0 that broke passing `Cmd`+`C` on to
    terminal applications when no text is selected (#10087)
    * `kitten @ set-background-image`: Fix ``--layout=configured` changing
    layout to centered instead (#10089)
    * Splits layout: add an `equalize` action and an `equalize_on_close` option
    to redistribute split space proportionally (#3489)
    * Fix matching var/env on tabs not working as expected (#10095)
    * When watching for changed config files do not recursively watch all sub
    directories of the directory containing the config file (#10102)
    * File transfer protocol: use `O_NOFOLLOW`` when opening regular files
    * dnd kitten: Protect against drops from malicious sources

++++ kubevirt1.8:

  - Update to version 1.8.3
    Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.8.3
    bsc#1260234 (CVE-2026-33186), bsc#1265467 (CVE-2026-7374),
    bsc#1266733 (CVE-2026-9804)

++++ mt32emu:

  - Update to 2.8.3
    * Reworked sanity checks for short MIDI messages.

++++ openjph:

  - Update to 0.27.4:
    * Add documentation for ASAN build type #274
    * Bug fix #277

++++ openvswitch:

  - Add missing python3-base BR

++++ pappl:

  - Update to release 1.4.11
    * Updated the programmer's manual.
    * Updated Set-Printer-Attributes validations checks.
    * Fixed a deadlock issue in the USB gadget shutdown code.
    * Fixed a truncation bug when decoding SNMP string values.
    * Fixed the handling of the finishings option.

++++ qmmp:

  - Update to version 2.3.3
    * fixed build with PipeWire versions less than 0.3.50
    * fixed settings dialog layout.
    * fixed default CUE encoding.
    * fixed possible null pointer dereference.
    * fixed tracks order when added using drag and drop.
    * fixed uninitialized structure usage.
    * improved sid plugin:
    + added libsidplayfp 3.0 support.
    + added feature to build without residfp engine.
    + fixed memory leak.
    + fixed displaying audio information.
    * updated Japanese translation.

++++ loki:

  - Fix postun scriplets to not have an unit name of " "

++++ netbird:

  - Update to 0.72.2
  - [management] resolve private services on custom domains in
    synthesized DNS zones by @mlsmaycon in
    https://github.com/netbirdio/netbird/pull/6348

++++ ollama:

  - Update to 0.30.6:
    * Gemma 4 QAT weights: the Gemma 4 family is now optimized with
    Quantization-Aware Training (QAT) to dramatically reduce memory
    requirements and maximize on-device performance.
    * ollama launch omp now integrates with Oh My Pi, an AI coding
    agent with IDE integration
    * Disable WebUI:
    disable-llama.cpp-ui.patch

++++ ollama:

  - Update to 0.30.6:
    * Gemma 4 QAT weights: the Gemma 4 family is now optimized with
    Quantization-Aware Training (QAT) to dramatically reduce memory
    requirements and maximize on-device performance.
    * ollama launch omp now integrates with Oh My Pi, an AI coding
    agent with IDE integration
    * Disable WebUI:
    disable-llama.cpp-ui.patch

++++ pascube:

  - Initial release.

++++ patterns-kalpa:

  - Drop sysextmgr and sysextmgr-tukit-plugin  they break updates

++++ perl-Business-ISBN-Data:

  - updated to 20260604.1.0 (20260604.001)
    see /usr/share/doc/packages/perl-Business-ISBN-Data/Changes
    20260604.001 2026-06-04T10:03:44Z
    * data update for 2026-06-04
    20260523.001 2026-05-23T07:46:14Z
    * data update for 2026-05-23
    20260522.001 2026-05-22T20:56:02Z
    * data update for 2026-05-22
    20260521.001 2026-05-21T22:11:05Z
    * data update for 2026-05-21
    20260519.001 2026-05-19T05:24:44Z
    * data update for 2026-05-19

++++ perl-DBI:

  - updated to 1.648.0 (1.648)
    see /usr/share/doc/packages/perl-DBI/ChangeLog
    1.648 - 2026-06-04, H.Merijn Brand
    * Correct sprintf usage for trace_msg (issue#132)
    * Add DBIXS_VERSION & DBIXS_RELEASE to dbixs_rev.h
    * Remove -Wbad-function-cast
    * Fix possible stack overflow (old issue already noted by Tim) (CVE-2026-9698) bsc#1267957
    * Do not allow table source locations outside explicit given folders
    * DBD::Sponge PRECISION handling (pr#12, pilcrow)
    * Fix possible buffer overflow in preparse (CVE-2026-10879) bsc#1267849
    * Skip mismatching .so's (Greg, PR#81)
    * Fix cast warning in dbi_get_state (Greg, PR#182)

++++ perl-Data-Censor:

  - initial package 0.40.0 (0.04)
    * created by cpanspec 1.84.01

++++ perl-Data-Random:

  - updated to 0.150.0 (0.15)
    see /usr/share/doc/packages/perl-Data-Random/Changes
    0.15      2026-03-01 00:15:18-08:00 America/Los_Angeles
  - fix one more escaped whitespace warning missed in 0.14
    Thanks to JKEENAN (James E Keenan) for the fix

++++ perl-Data-Validate-Domain:

  - Normalize CPAN version
    See https://github.com/openSUSE/cpanspec/issues/47 for details
  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-DateTime-Format-Builder:

  - Normalize CPAN version
    See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Git-Repository:

  - Remove 22.patch, git-2.30.0.patch, git-2.40.0.patch (fixed upstream)

++++ perl-HTTP-Message:

  - updated to 7.20.0 (7.02)
    see /usr/share/doc/packages/perl-HTTP-Message/Changes
    7.02      2026-06-05 23:28:36Z
  - now handling HTTP method '0' (GH#211) (Karen Etheridge)

++++ perl-Hash-Case:

  - initial package 1.70.0 (1.07)
    * created by cpanspec 1.84.01

++++ perl-Mojo-JWT:

  - updated to 1.20.0 (1.02)
    see /usr/share/doc/packages/perl-Mojo-JWT/Changes
    1.02 2026-06-03
  - This release contains fixes for security issues, everybody should upgrade!
  - Improved security of decode to prevent timing side-channel attacks in symmetric signatures

++++ perl-Mojo-Redis:

  - updated to 3.310.0 (3.31)
    see /usr/share/doc/packages/perl-Mojo-Redis/Changes
    3.31 2026-06-04T10:49:00
  - Allow TLS-related query params in Redis URL #80 #84
    Contributor: Alexander Karelas, hazemkmammu
    3.30 2026-06-04T10:37:00
  - Fix connecting through sentinels #78
    Contributor: Jan "Yenya" Kasprzak

++++ perl-Mojolicious:

  - updated to 9.460.0 (9.46)
    see /usr/share/doc/packages/perl-Mojolicious/Changes
    9.46  2026-06-04
  - Added random_bytes function to Mojo::Util. (leont)
  - Improved randomness for CSRF token generation. (leont)
  - Fixed tls_options handling in Mojo::IOLoop::TLS. (krauro)
  - Fixed spec compliance issue with attribute selectors in Mojo::DOM::CSS.

++++ perl-Mojolicious-Plugin-OpenAPI:

  - updated to 5.120.0 (5.12)
    see /usr/share/doc/packages/perl-Mojolicious-Plugin-OpenAPI/Changes
    5.12 2026-06-06T21:34:00
  - Combine body_params and uploads on multipart/form-data requests #267
    Contributor: Archey Barrell

++++ perl-Net-Domain-TLD:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Search-Xapian:

  - updated to 1.2.25.7
    see /usr/share/doc/packages/perl-Search-Xapian/Changes
    1.2.25.7  Wed Jun  3 22:45:01 UTC 2026
    [Changes contributed by Olly Betts]
  - README: Update status - there are not likely to be further releases.
  - If the C++ compiler isn't found and g++ isn't installed, look for
    c++ - this means the build should work out of the box on systems
    such as FreeBSD where the default compiler is clang.  Reported by
    eserte12 (fixes #851).

++++ poedit:

  - Poedit 3.9.1:
    * Fix spellchecker with Enchant 2.8.7 or newer
    * Improve spellchecker handling of Serbian on Linux
    * Fix issues window being too large to fit on the screen
    * Minor UI fixes

++++ privoxy:

  - Update to version 4.2.0:
    Security improvements:
    * Parse the chunk-size with a dedicated function and reject "unreasonably"
    large values to prevent silent truncation by sscanf(), integer overflows
    and misinterpretation of the content later on. Heap buffer overflows on
    platforms with 32-bit pointers were alleged as well.
    Commit 5b3bb22b77. OVE-20260515-0002. Reported by @TristanInSec.
    * ssl_send_certificate_error(): Store the generated message on the heap
    instead of the stack to prevent an alleged segmentation fault if there
    are enough certificates in the chain to exceed the stack size.
    While at it, replace another variable-length array that was probably
    unproblematic with a heap-based buffer as well.
    Commit 4963aa4f08. OVE-20260515-0001. Reported by @TristanInSec.
    Bug fixes:
    * block_acl(): Ignore ACL matches when we don't have a destination yet
    but the ACL requires one to match. block_acl() will be called
    again later on when the destination is known from parsing the request.
    Fixes SF bug #913 reported by Rainer Sokoll with confirmation from
    Peter Geelhoed.
    * rfc2553_connect_to(): Prevent theoretical memory disclosure through
    the CGI interface if a request is rejected due to ACLs. It's theoretical
    due to the previous bug in the ACL code.
    * send_http_request(): Give up on the client connection if writing the
    request data failed. If there's a request body Privoxy may not have
    read all the data yet. The issue could be reproduced by running the
    upstream curl test 1293 multiple times in a row.
    * load_one_re_filterfile(): Only register content filters for statistics.
    Previously all filter types were registered which wasted a bit of memory.
    * Prevent unused-variable warnings when compiling with
    DISABLE_PCRE_JIT_COMPILATION defined.
    * cgi_show_url_info(): Remove special handling of "standard.action".
    General improvements:
    * Add elliptic-curve-keys directive and enable it by default.
    It lets Privoxy use the SN_X9_62_prime256v1 group instead of RSA when
    generating website keys and certificates. This is expected to be faster
    but may not be supported by older clients. The OpenSSL-specific code is
    based on on a patch by Steven Smith submitted in SF#933.
    * Check the listening address when deciding whether or not a client tag
    matches. This allows to use different client tags for different clients
    running on the same host.
    * Add code to make debugging ACL rules more convenient. It can be enabled
    with the new configure parameter --enable-acl-debugging.
    * acl_addr(): Properly reject IPv6 addresses when compiled without RFC2553 support.
    * Use separate linked lists for filters of different types to be able look up
    filters more efficiently. Implements TODO item #96.
    * Allow to set and unset external filters through the CGI editor.
    * parse_acl_rule(): Include the config file line number in the error messages.
    * wolfssl: Downgrade an error message in create_server_ssl_connection()
    to LOG_LEVEL_ERROR.
    * Remove useless csp member re_filterfile_short[].
    * templates: Update description of the 'unstable' conditional symbol.
    * templates/url-info-osd.xml: Update address of the Privoxy developers mailing list.
    * Factor parse_acl_rule() out of load_config().
    * configure.in: Don't claim that OpenSSL has been detected when it may be LibreSSL.
    * configure.in: Remove code to disable pcre2. Since the removal of pcre1
    support in 24d0ff8398fdf pcre2 is no longer optional.
    * Replace the term 'TLS/SSL' with 'TLS' in a bunch of places as most (all?)
    supported TLS libraries default to not supporting SSL anymore.
    * utils/filter2docs.pl: Add two spaces between filter names and description
    so there's space after the longest filter name which currently is
    'allow-autocompletion'.
    * utils/filter2docs.pl: Recognize filters with dots in the name.
    * Remove support for mbedtls 2.x.
    * Remove support for OpenSSL versions before 2.0.
    * GNUMakefile.in: Remove duplicated 'only' in the web-rss-feed target's message.
    * GNUMakefile.in: Add a web-rss-feed target that only syncs the RSS feed.
    * GNUMakefile.in: The Privoxy tools privoxy-log-parser, privoxy-regression-test
    and uagen are handled by the "install" and "uninstall" targets now.
    Action file improvements:
    * Disable fast-redirects for "/.*&__goaway_referer=http".
    * Block ".parsely.com/p(logger|x)/" to match URLs that weren't
    covered by ".pixel.parsely.com/".
    * Block requests to ".siteintercept.qualtrics.com/".
    * Unblock "gitlab./search/count\?".
    * Reword a comment in user.action that claimed that 'we' want
    to support certain sites.
    * Remove obsolete domain sunsolve.sun.com from user.action.
    * Stop referring to SSL in comments.
    * Disable fast-redirects for "archive.is/".
    * Add example section for the taz.de filter to user.action.
    * default.action.master: Update list of predefined filters.
    Filter improvements:
    * Let the "sourceforge" filter hide the "MongoDB" ad and the "vibe coding bar".
    * Add a "taz.de" filter which hides the "paywahl" banner on taz.de by default.
    Documentation improvements:
    * FAQ: Mention that one can also donate through Liberapay and add a link.
    * Add two paragraphs to the 'Reporting security problems' section.
    Request that use of "AI" is disclosed and that reporters respond to
    questions about the report.
    * The Privoxy tools privoxy-log-parser, privoxy-regression-test and uagen
    have man pages now. Previously they were only documented in perldoc.
    * user-manual: Update the content filter list.
    * user-manual: Update limit-connect description. If the https-inspection action
    is enabled, Privoxy does filter the transferred content even if the CONNECT
    action is being used.
    * Document that the listen-address is taken into account for client
    tags as well now.
    * Update limit-connect description.
    * Don't mention an obsolete mbed TLS version in the user manual's
    'Third-party licenses and copyrights' section. While at it, link to the
    GitHub page which shows the README instead of the list of tags which is
    less informative and replace an 'and' with a comma.
    * Mention zstd in the user manual's 'Third-party licenses and copyrights' section.
    * license.sgml: Remove incorrect comment claiming that the file is included
    into the user manual.
    * Factor out license explanation into separate SGML document
    to deduplicate the content. No HTML output change intended.
    * user-manual: Sync paragraph explaining the license of Privoxy binaries
    when linked to a recent TLS library with license.sgml.
    * user-manual: Use &lt; instead of literal '<' to unbreak highlighting in Emacs.
    Website improvements:
    * Update doc/webserver/README.txt.
    * Delete doc/webserver/redirect.php which hasn't been used in years.
    Privoxy-Log-Parser:
    * Highlight listen address in "Evaluating tag 'forward-directly' for client
    127.0.0.1 using 127.0.1.1:8120. End of life 1774948202."
    * Deal with a log message containing only 'TLS' instead of 'TLS/SSL'.
    * Bump version to 0.9.8.
    * Highlight listen address in 'Enlisting tag 'allow-cookies' for client
    127.0.0.1 using 127.0.1.1:8120.'
    Test improvements:
    * run-privoxy-tests.sh: Kill the whole process group if Privoxy
    doesn't start up in time. This prevents hangs when the system is
    heavily loaded, run-privoxy-test.sh's output is piped into tee(1)
    and Privoxy starts up after the the script checks for it, but before
    it exits.
    * Add test for the content filter "taz.de".
    * Add test scenarios for the ACL code.
    * tests/cts: Make the TESTDIR available as environment variable so
    the prechecks can access it.
    * Add test helper script that checks if a local address is available
    to bind to.
    * run-privoxy-tests.sh: Add valgrind support that can be enabled with "-v".
    * run-privoxy-tests.sh: Turn $log_file into a local variable in start_privoxy().
    * tests/cts/README: Recommend to use curl upstream tag curl-8_20_0.
    * Regenerate curl-test-manifest-for-privoxy.
    * gen-skip-reasons.pl: Use '==' instead of 'eq' when checking whether or
    not a test should be skipped. While the script output is the same, the
    test number isn't a  string so using '==' seems more appropriate.
    * gen-skip-reasons.pl: Skip test 1 due to multiple Connection header values.
    * gen-skip-reasons.pl: Skip test 58 for now which doesn't work anymore after
    a recent curl upstream change.
    * gen-skip-reasons.pl: Skip test 1685 which uses a Cookie header with a tab
    that Privoxy converts into a space.
    * Privoxy-Regression-Test: Bump version to 0.7.6
    * Privoxy-Regression-Test: Allow '!' characters which are used in URLs from
    taz.de for example.
    * Privoxy-Regression-Test: Include the offending line in the error message
    when rejecting Sticky Actions with whitespace inside the action parameters.
    * Add three more tests for the chunked-transfer-encoding scenario.

++++ pt2-clone:

  - Update to version 1.89
    * The VU-meters (and spectrum analyzer meters) now move at 60Hz
    instead of 50Hz. The reason for this change is that they were
    stuttering a bit.
    * Added protection against the audio callback locking up (tick
    counter = 0). This shouldn't have been possible under normal
    circumstances, though.

++++ python-M2Crypto:

  - Upgrade to 0.48.0:
  - doc: another move … this time to Codeberg (and communication
    to Matrix)
  - test(smime): parametrize test_write_pkcs7_der
  - test(smime): fix test_signEncryptDecryptVerify
  - fix(util): return bytes from passphrase callbacks
  - fix(SSL.Checker): add IDN Chinese name
  - test(ssl): add IDN certificate fixture coverage
  - test(ssl): cover IDN hostname matching in Checker
  - doc: update expected Name format in migration guide
  - fix(smime): S/MIME signature verification for Outlook and
    Thunderbird
  - fix(provider): handle OSSL_STORE_INFO_PUBKEY compat. for
    OpenSSL < 3.2
  - fix: cast X509_dup in sk_X509_deep_copy to avoid type
    mismatch
  - fix(smime): S/MIME signature verification for Outlook and
    Thunderbird
  - fix(smime): remove obsolete Python pre-3.6 constructs
  - ci: run on Codeberg with forgejo_runner
  - doc: clarify the status of the project
  - fix(provider): adjust the CI run on Gitea for the older
    OpenSSL on Debian
  - fix(evp): narrow digest and BIO pointers for mypy
  - fix(init): acommodate modern packaging API
  - doc: IRC channel is on Libera, Ergo was a wrong idea
  - fix(tests): remove duplicate definition of IS_DEBIAN in
    test_ssl
  - fix(test_bio_ssl): fix TLS 1.3 deadlock and add socket
    timeouts
  - fix(test_bio_ssl): replace sys.exit() with self.fail() to
    prevent test process crash
  - ci: publish to PyPI with Sigstore attestations via Trusted
    Publishing
  - fix(authcookie): handle CookieError from Python 3.13.12+
    (CVE-2026-0672)
  - ci(leap): use setup.py bdist_wheel to bypass old pip PEP 517
    wrapper
  - fix(util): replace is_32bit with struct.calcsize and update
    tests
  - ci: add FreeBSD SourceHut CI build script
  - fix(swig): avoid clang GNUC pragma block before _lib.h
  - fix(provider): don't abuse TemporaryDirectory to be mkdtemp,
    use that directly.
  - fix(provider): gate provider APIs for OpenSSL 1.1.1
  - feat(provider): add key generation and destruction methods
  - docs(provider): add comprehensive documentation to Provider
    module
  - fix(provider): better exception handling
  - doc: add a simple AGENTS.md
  - feat(engine): add availability check, lifecycle helpers, and
    safer cleanup
  - doc(engine): Improve documentation and example of using
    Engine module
  - Upgrade to 0.47.0:
  - feat: added full SWIG bindings for the ASN1_UTCTIME
  - refactor(SWIG): adopt Python Buffer Protocol for
    X509_NAME_ENTRY_set_data
  - fix: allow 64-bit time_t on 32-bit systems in test_is32bit
  - feat(provider): add initial OpenSSL providers support
  - feat: stop supporting 32bit packages on Windows
  - fix: improve detection of OpenSSL on Windows
  - ci: run doctest
  - fix: _matchIPAddress is failing
  - feat: Add degenerate PKCS7 (.p7c) support
  - fix(setup): add `packaging` as a requirement
  - feat(asn1): introduce dedicated ASN1_UTCTIME class
  - feat(CRL): add content of m2crypto-0.21.1-x509_crl.patch
  - refactor(x509): CRL handling and testing
  - feat: add function to provide the equivalent of `openssl
    ciphers`.
  - fix(X509): refactor new_extension to prevent memory
    corruption
  - ci: add tests showing the use of M2Crypto for STARTTLS
    protocol
  - doc: convert documentation to MyST
  - doc: various improvements of documentation
  - revert: remove support for Engine
  - fix(engine): make the compilation of Engine conditional on
    OPENSSL_NO_ENGINE
  - fix(https): make HTTPS Connection work with Proxy
  - doc: add an example of using HTTPS with PKCS#11 Engine

++++ python-msal:

  - Update to version 1.37.0
    * Removed support for Python 3.8 in (#910)
    * Add User Federated Identity Credential (user_fic) grant type
    support in (#918)
    * Use unsigned redirect URI for macOS broker silent flows in (#907)
    * Escape username parameter in (#901)
    * Forward MSAL client metadata headers through IMDS to ESTS in (#902)
    * Update pymsalruntime minimum version to 0.20.6 in (#919)
    * Bump cryptography dependency ceiling to <50 (N+3) in (#906)

++++ python-uv-dynamic-versioning:

  - update to 0.14.0
    * docs: explain about style
    * fix pattern issue
    * feat: support highest tag option

++++ redumper:

  - Udpate to version 722
    * Don't install gtest to build.
    * Don't throw error on old OmniDrive firmware.
  - Update patch:
    * redumper-use-system-googletest.patch

++++ upplay:

  - Update to 1.9.11:
    * Fix compatibility with Qt 6.11.
    * Delete temporary file used for cover display. We used to leave
    them in $TMPDIR.

++++ variety:

  - Update to version 0.9.0:
    * Switch from distutils-extra to setuptools and importlib.resources.
    * Media, scripts, and other resources are now bundled in the python package.
    * Install desktop file manually as setuptools doesn't handle it.
    * Fix #834: Add support for newer GExiv2 versions.
    * Fix #823: Fall back to convert if magick command is not found.
    * Fix #838: Fix display mode blurring whole image.
    * Update Spanish translations.
  - Drop obsolete patches:
    * variety-appdata-path.patch
    * variety-fix-data-path.patch
  - Drop obsolete VarietyIcons.tar.gz as standard-compliant icons are now upstream.
  - Add python3-setuptools-gettext and python3-packaging to BuildRequires.
  - Update to version 0.8.13:
    * Fix #741: Fix downloading server side options (remove tiny.cc redirector)
    * Fix #733: Fix for EarthviewDownloader
    * Fix #704: In "smart" display mode, tile small wallpapers using ImageMagick (#727)
    * Improvement #731: Add support for KDE 6 lockscreen
    * Improvement #752: set_wallpaper: default to feh/nitrogen instead of hardcoding a list of WMs
    * Feature #756: Add support for Fluxbox (via fbsetbg)
    * Feature #619: Add regex name filter for wallpapers
    * Update French and German translations

++++ vermouth:

  - Bump to version 1.9.1 Kirigami-er
  - Upstream changes:
    * Dialogs to Pages (#49)
    * refactor: QML cleanup and refactor
    * cleanup: Remove unneeded padding
    * ui: Fix the status bar showing the runner and the exe path
    * ui: Improve the pinnable sidebar, other UI improvements
    * Update sha sums

++++ vkSumi:

  - Initial release.

++++ wiremix:

  - bump version to 0.11.0:
    * Added
  - Configure which tabs are present and their order.
    * Changed
  - No longer exits on PipeWire errors in release builds.

------------------------------------------------------------------
------------------  2026-6-6  -  Jun 6 2026  -------------------
------------------------------------------------------------------

++++ DoomRunner:

  - Initial release

++++ uwsgi:

  - Fix build on Leap 16.1 where %suse_version is 1610

++++ cargo-audit:

  - Update to version 0.22.2~git0.281452c:
    * Bump `cargo-audit` version
    * rustsec: bump version to 0.33
    * admin: error if ID replacement fails
    * admin: inline single-use intermediate bindings
    * admin: improve error handling in assigner
    * admin: simplify collection handling
    * admin: be stricter about ID line input
    * admin: lint that ID in drafts is the placeholder
    * admin: import more items
    * build(deps): bump toml_edit
    * build(deps): bump jiff from 0.2.24 to 0.2.27
    * build(deps): bump gix from 0.83.0 to 0.84.0
    * Validate advisory dates with jiff crate (#1603)
    * cargo-audit: add test case for affected function filtering
    * cargo-audit: drop empty paths
    * cargo-audit: replace HashSet with Vec in SymbolSet
    * cargo-audit: hoist affected symbol cleanup out of inner loop
    * cargo-audit: inline single-use function function_path_matches_symbol()
    * cargo-audit: inline single-use function remove_function_path_parameters()
    * cargo-audit: simplify logic for remove_function_path_parameters()
    * cargo-audit: add comment to clarify handling of generics
    * cargo-audit: hoist filter wrappers out
    * cargo-audit: replace iterator chain with loop
    * cargo-audit: show warning on failure to parse binary
    * cargo-audit: move comment closer to relevant code
    * cargo-audit: simplify interface for SymbolSet::from_file()
    * cargo-audit: inline trivial test helper function
    * cargo-audit: re-order items in tests module to be top-down
    * cargo-audit: clean up import blocks in presenter module
    * build(deps): bump atom_syndication from 0.12.7 to 0.12.8
    * print the invalid char when linting affected functions
    * Take semver-compatible dependency updates
    * build(deps): bump askama from 0.15.6 to 0.16.0
    * Revert "Document to use cargo install with --locked (fixes #1152)"
    * build(deps): bump gix from 0.81.0 to 0.83.0
    * build(deps): bump tame-index from 0.26.2 to 0.26.3
    * Take semver-compatible dependency updates
    * build(deps): bump object from 0.38.1 to 0.39.0
    * cargo-audit: when run with -q, suppress dependency trees
    * cargo-audit: simplify default for OutputConfig::show_tree
    * Upgrade to comrak 0.52
    * Take semver-compatible dependency updates
    * Lift `print_tree` calls into `print_report`
    * Show affected functions in binaries
    * Add note for experimental tool reachsec
    * build(deps): bump actions/cache from 5.0.4 to 5.0.5
    * build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
    * build(deps): bump obi1kenobi/cargo-semver-checks-action from 2.8 to 2.9
    * cargo-audit: optionally override auditable payload size limit
    * cargo-audit: cap input size for audit bin
    * cargo-audit: add CLI option to skip checking for yanked crates
    * rustsec: avoid warning about packages that are not from crates.io
    * Upgrade to gix 0.81
    * Take semver-compatible dependency updates
    * build(deps): bump askama from 0.15.4 to 0.15.5
    * build(deps): bump actions/cache from 5.0.3 to 5.0.4
    * platforms: bump version to 3.10
    * platforms: update data with MSAN/TSAN targets
    * build(deps): bump tame-index from 0.26.0 to 0.26.1
    * build(deps): bump Swatinem/rust-cache from 2.8.2 to 2.9.1
    * build(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1
    * Bump deps affected by today's advisories.
    * Change generated title for malicious crates.
    * build(deps): bump comrak from 0.50.0 to 0.51.0
    * Add `malicious` as an explicit category.
    * Take semver-compatible dependency updates
    * platforms: bump version to 3.9.0
    * platforms: update data
    * Take semver-compatible dependency updates
    * build(deps): bump gix from 0.79.0 to 0.80.0
    * Disable embedded file timestamps in rust-embed
    * Install rustfmt for the platforms update workflow (#1552)
    * Website: theme fixes
    * Website: Improve light theme
    * Hide the link to crates.io for expect_deleted crates
    * Bump MSRV for rustsec to 1.88 (for time)
    * Take semver-compatible dependency updates
    * ci: fix incorrect path to script
    * build(deps): bump fs-err from 3.2.2 to 3.3.0
    * build(deps): bump gix from 0.78.0 to 0.79.0
    * build(deps): bump toml from 0.9.11+spec-1.1.0 to 1.0.1+spec-1.1.0
    * build(deps): bump toml_edit from 0.24.0+spec-1.1.0 to 0.25.1+spec-1.1.0
    * Sort paths in `lint` function
    * Website: fix broken WG url (#1536)
    * build(deps): bump actions/cache from 5.0.2 to 5.0.3
    * cargo-lock: fix extra empty line at end of file (#1532)
    * admin: display error chain for lint errors
    * admin: don't rely on cached data

++++ chirp:

  - Update to version 20260605:
    * Update boot, zone, scan and alarm channels on channel deletion
    * Add GM-15Pro extended UHF range

++++ dabstar:

  - Udpate to versino 5.2.0
    * Includes fixes following the recent removal of Qwt.
    * The GUI has been refreshed with a more colorful look.
    * The audio peak/RMS level meter is now much more precise.
    * On Linux, the level meter works especially well. On Windows,
    timer precision limitations required a compromise, but the
    result should still be usable.

++++ direvent:

  - direvent 5.5:
    * All subprocesses are terminated before exit
    * New configuration statement: shutdown-timeout
    Sets the time to wait for all subprocesses to terminate before
    exiting the program. The default is 1 second

++++ dnf5:

  - Update to 5.4.2.1
    + 5.4.2.1 changelog: https://github.com/rpm-software-management/dnf5/releases/tag/5.4.2.1
    + 5.4.2.0 changelog: https://github.com/rpm-software-management/dnf5/releases/tag/5.4.2.0
    + 5.4.1.0 changelog: https://github.com/rpm-software-management/dnf5/releases/tag/5.4.1.0
  - Refresh patches
    + dnf5-Use-usr-lib-sysimage-for-the-persistent-state-dir.patch
    + dnf5-disable-Werror.patch
  - Add SUSE Linux family default settings

++++ dnscrypt-proxy:

  - Update to version 2.1.16
    * The "tls_cipher_suite" option is now a no-op. Modern TLS stacks no longer
    expose cipher suite selection in a meaningful way, and the option had become
    misleading
    * A log size of 0 no longer means "unlimited"; it now correctly disables
    rotation by size
    * A new "tls_prefer_rsa" option has been added to prefer RSA cipher suites
    during the TLS handshake, useful on systems without hardware AES
    * The IP allow/block plugins now support CIDR ranges in addition to single
    addresses and prefix matching
    * Forwarding rules now support `$RESOLVCONF:<file>` to pick up upstream
    resolvers from a resolv.conf-style file, complementing the existing `$DHCP`
    syntax
    * Servers that hit a transient high RTT could previously stay penalized
    forever and never come back into rotation; their RTT estimate now decays so
    they can recover
    * Servers are no longer penalized for slow responses when the response is
    actually being served from the stale cache
    * The HTTP transport now handles `Alt-Svc: clear` properly and reuses HTTP
    connections more aggressively
    * The cache TTL is now an explicit, configurable parameter rather than being
    derived implicitly
    * The ""-resolve"" command now reports incomplete DNSSEC support instead of
    silently treating partial signatures as a success
    * "jsdelivr is now offered as an alternative source URL for resolver
    lists, providing more redundancy when the primary mirrors are unreachable
  - boo#1260280: vendored google.golang.org/grpc v1.80.0
  - boo#1265785: vendored golang.org/x/net v0.54.0

++++ fastfetch:

  - Update to version 2.64.2:
    * Common (Lua): addresses AI's feedback
    * Codec (Linux): supports `BINARY_LINK_TYPE=dynamic`
    * Common (QJS): supports `BINARY_LINK_TYPE=dynamic`
    * Common (Lua): supports `BINARY_LINK_TYPE=dynamic`
    * Logo: addresses review comments of AI
    * Doc: updates changelog [ci skip]
    * Logo (Builtin): update OpenWrt logo
    * Doc: updates changelog
    * Global: resets `keysHeight` after every refresh
  - Update to version 2.64.1:
    * Release: v2.64.1
    * Common (Lua): detects circular reference in `encode_json`
    * Common (Base64): adds `static` to internal functions
    * Packages: adds option `PACKAGES_REMOVE_DISABLED` to remove
    disabled package managers from the build entirely
    * Codec (macOS): removes usage of JPEG XL; replaces enums with
    raw constants
    * Common (Lua): optimises code; fixes incompatibility against
    lua 5.3
    * Doc: update changelog
    * Shell: sets pretty name of busybox to ash
  - Update to version 2.64.0:
    * Doc: update changelog
    * Shell: sets pretty name of busybox to ash
    * Shell: be more robust on busybox version detection
    * Release: v2.64.0
    * Codec (Vulkan): be compatible with old Vulkan headers
    * Bootmgr (macOS): don't hard-code the firmware name
    * Logo (Builtin): updates NurOS logo and colors (#2366)
    * Shell (Linux): improves performance of busybox (ash) version detection
    * Common (Format): adds `|` for center aligning

++++ fresh-editor:

  - Update to version v0.3.12:
    * see https://github.com/sinelaw/fresh/releases/tag/v0.3.12

++++ gdal:

  - Fix boo#1264521, boo#1264522, boo#1264523, boo#1264525
  - Fix boo#1264729, boo#1264730, boo#1266376
  - Update to version 3.13.1
    GDAL 3.13.1 is a bugfix release.
    + Build
    * Fix build against Poppler 26.06.00
    * JP2Grok requires Grok >= 20.3.2
    + GDAL 3.13.1
  - Port
    * /vsicurl/: make it year 2038 ready on 32-bit systems or Windows
    * /vsis3/: fix support for listing directory buckets that had been broken per 4bd8d578b50
  - Algorithms
    * Warper Lanczos: remove special case when the ratio of valid source
    pixels/total is below 1/2 (#14560)
    * Zonal stats: avoid undefined behavior when a raster zone dataset has a NaN value
    + Core
    * GeoHEIF: do not report geotransform when there is none
    * Factor code related to overview selection between RasterIO() and gdalwarp
    * GDALRasterBand::HasConflictingMaskSources(): fix potential nullptr dereference
    * CopyWords float -> signed int8/int16/int32 SSE2 code path: convert NaN to 0
    for consistency with scalar code path
    * CopyWords float -> integer data type: optimization for NEON
    * GDALCopy4Words: slightly optimize float -> signed int8/16/32
    * CopyWords: int32 -> uint16: speed enhancement and code cleanup
    * GDALCopyWords uint32->int32 SSE4.1/NEON: fix wrong loop indices (only speed
    impact)
    * GDALCopyWords: optimize Int32<-->UInt32 in SSE2
    * GDALCopyWords(): add int32->int16 SSE2 optimized code path
    * GDALCopyWords(): add int16->uint8 SSE2 optimized code path
    * GDALAlgorithmArg::SetFrom(const GDALArgDatasetValue &): fix inappropriate check
    + Utilities
    * apps/: use non-deprecated argument names
    * gdal external: make sure temporary files are deleted on Windows
    * gdal pipeline: fix nested pipeline inside a step whose name can be raster or
    vector (such as clip) (#14637)
    * gdal pipeline: fix '.... ! materialize --output my.tif ! tile' (#14621)
    * gdal pipeline: address case like 'gdal pipeline read vector_dataset !
    clip --input raster_dataset --like _PIPE_ ! write output_raster'
    * gdal pipeline: make 'materialize' step guess output format when named output
    is specified
    * gdal pipeline replay: make it work when the pipeline uses a short argument
    name and the substitution uses the long one
    * gdal raster calc: fix potential nullptr dereference in case of crazy creation
    option (ossfuzz #513677126)
    * gdal raster color-map: add support for current GMT .cpt color table file
    * gdal raster pipeline .... ! tile: avoid the output filename to be printed in
    stdout
    * gdal raster polygonize: fix empty output layer name in pipeline
    * gdal raster rgb-to-palette: fix crash with transparency / very low number
    of colors (#14682)
    * gdal raster tile: add automatic source overview selection(#14560)
    * gdal vsi list: display last modification timestamp of single file
    * gdalwarp: in 3D->3D vshift mode, do not copy source unit type to output file
    (#14503)
    * gdalwarp: fix wrong blank border detection, especially with geolocation arrays
    (3.11 regression) (#14570)
    * gdalbuildvrt: in -separate mode, emit warning when nodata is out of range
    (#14601)
    + Raster drivers
  - BAG driver:
    * fix potential heap buffer overflow in LoadMetadata()(#14600)
  - ENVISAT driver:
    * avoid crashes, excessive memory alloc and heap buffer overflow (#14526)
  - GRIB driver:
    * Avoid invalid read in g2clib comunpack (fixes #14548)
    * mdl_LocalUnpack(): fix incomplete fix for #14455/#14457
    * ReadGrib2Record(): avoid potential (unlikely) int overflows (#14622)
  - HDF4 driver:
    * HDF4-EOS: fix nullptr deref when opening inexisting array
  - HDF5 driver:
    * fix (potential?) integer truncation/heap buffer overflow in
    HDF5CreateGroupObjs() (#14600)
  - HFA driver:
    * fix read before heap allocation in BuildEntryFromMIFObject() (#14547)
  - JP2Grok driver:
    * fast 16 bit pathway for decompression
    * scale overview coords up to full resolution before calling Grok (#14516)
    * fix tile cache strategy for overview datasets
  - LIBERTIFF driver:
    * fix reading a NoData value whose string representation is between 4 and 8
    bytes on BigTIFF files (#14482)
  - MRF driver:
    * Fix input JPEG mismatch (heap buffer overflow write) (#14549)
    * MRF: check max interleaved bands (#14666)
    * allow to decode naked Lerc2 files with masks with liblerc >= 3.0 (#14676)
  - netCDF driver:
    * Avoid reading attributes without checking length (#14594)
  - NITF driver:
    * update parsing of BANDSB TRE to handle all WAVE_LENGTH_UNIT cases
  - TileDB driver:
    * restrict /vsis3/ identification to .tdb extension or no extension (#14508)
  - VRT driver:
    * VRTKernelFilteredSource: avoid undefined behavior with mode filter when a
    input pixel has a NaN value
    * VRT multidim: fix deadlock on closing when a VRTMDArraySourceFromArray
    references another VRTMDArraySourceFromArray
  - ZARR driver:
    * fix write-heap-buffer-overflow on compound data types with several
    dynamically allocate type (strings) (#14543)
    * fix read heap buffer overflow on corrupted sharded array (#14545)
    + OGR 3.13.1
  - Vector core
    * Dataset creation: emit an explicit warning when a dsco doesn't exist but a lco
    of same name does
    * Layer creation: emit an explicit warning when a lco doesn't exist but a dsco
    of same name does
    * ogrgeometry: Rename SFCGAL_VERSION macro to avoid name collision
  - Vector utilities
    * gdal vector clip: make it robust to scenarios like 'gdal pipeline read
    byte.tif ! clip --input byte.shp --like _PIPE_ ! write /vsimem/out.shp'
    * gdal vector combine: add autocompletion for --group-by
    * gdal vector partition: add autocompletion for --field
    * gdal vector reproject: set the help URL to vector repoject standalone instead
    of vector pipeline
    * ogr2ogr/gdal vector convert: CSV output: set GEOMETRY=AS_WKT as dsco when set
    as lco (#14483)
    * ogrlineref: avoid undefined behavior with NaN values
  - Vector drivers
    +FlatGeobuf driver:
    * fix off-by-one bounds check in readPoint that may cause heap-buffer-overflow
    read (#14528)
  - GeoJSON driver:
    * writer: support recognizing 'application/geo+json', in addition to
    'application/vnd.geo+json'
  - GPKG driver:
    * make RTree node ordering to be (hopefully) identical across platforms
    (#14685)
  - MITAB driver:
    * fix stack-buffer-overflow read in TABINDFile::BuildKey (#14529)
    * fix EscapeString heap-buffer-overflow write when all characters are
    double-quotes (#14530)
  - OSM driver:
    * fix wrong upper bound in call to ReadOSMInfo() causing heap-buffer-overflow
    read (#14532)
  - Parquet driver:
    * fix SetIgnoredFields() crash when a top-level Parquet column and a nested one
    have same name (#14610)
    * declare empty GDAL_DMD_CREATIONOPTIONLIST
  - Selafin driver:
    * fix out-of-bounds read when coordinate array is shorter than declared point
    count (#14544)
  - Python bindings
    * recognize -oo in gdal.VectorTranslate(..., options = ['-oo', 'FOO=BAR']) and
    other similar methods
  - Raster drivers

++++ ghc-emojis:

  - Update emojis to version 0.1.5.
    [#] 0.1.5
    * Update emoji data to Emoji 17.0. Note: recent emojis have no
    aliases, because we still derive aliases from gemoji's emoji.json,
    which has not been updated since Emoji 15.0.
    * Fix order of aliases (regression in 0.1.4.1, which reversed them).

++++ ghc-unicode-collation:

  - Update unicode-collation to version 0.1.3.7.
    [#]# 0.1.3.7
    * Docs: recommend `sortOn (sortKey c)` over `sortBy (collate c)`.
    `collate` recomputes the sort key of each argument on every
    comparison, whereas `sortOn` computes each key only once.  Update
    the headline example and guidance accordingly.
    * Replace IntSet lookups with range checks in implicit weight calculation.
    `calculateImplicitWeight` previously tested CJK/ideograph
    membership using large IntSets defined in its where-clause.
    Since the data is essentially contiguous ranges, replace the
    IntSets with simple range-comparison predicates. This removes
    is ~25% faster on CJK-heavy sorting at -O1. Also drop a
    duplicate range, remove the now-unused Data.IntSet import,
    and correct a misleading (harmless, due to Word16 truncation)
    0x7FFFF mask to 0x7FFF in the fallback case.
    * Test: guard implicit-weight ideograph ranges against data drift.
    The CJK/Tangut/Nushu/Khitan ranges in Text.Collate.Collation are
    hand-coded and decoupled from the shipped Unicode data.  Add a test
    that enumerates every code point the data marks as an ideograph
    (from the @implicitweights directives in allkeys.txt and the CJK
    Ideograph First/Last markers in UnicodeData.txt) and asserts each
    receives an ideographic implicit primary weight (< 0xFBC0) rather
    than the generic unassigned bucket.  A future data bump that does
    not update the ranges will now fail, naming the uncovered points.
    * Benchmarks: force full sorts with `nf` instead of `whnf`.
    `whnf` only evaluated the result list to its first cons cell, so the
    benchmarks measured finding the minimum rather than a full sort. Using
    `nf` forces the entire sorted list, giving a representative measurement.
    * Add `bench-sortkey` benchmark comparing `collate` with `sortKey`.
    This self-contained benchmark (no text-icu/QuickCheck deps) measures
    `sortBy (collate c)` against `sortOn (sortKey c)` across several input
    shapes, demonstrating the speedup from computing each sort key once.
    * Add an `icu-benchmark` flag (default off) guarding the existing
    text-icu benchmark, so the new benchmark can be built without the ICU
    C library.
    * Add a CJK-focused benchmark exercising the implicit weight path.
    * Add flake.nix.
    * CI: Support GHC 9.10 (David Binder), 9.12 (Austin Ziegler), and
    9.14 (Li-yao Xia).
    * Add cabal.project.

++++ go-passbolt-cli:

  - spec: Bump minimum go version to >=1.25
  - Update to version 0.5.0:
    * PB-52065 - Go-cli expose more attributes from API
    * PB-52118 - Bump go SDK to v0.8.0
    * PB-50545 - Go - phase 1 - SDK and CLI integration tests
    * PB-51584 - Create Github secrets to use in CI
    * PB-52063 - Go-cli Unify column selectors
    * PB-50545 - Run go mod tidy
    * PB-50545 - Pin docker imagrs using hash
    * PB-50545 - Go - phase 1 - SDK and CLI integration tests
    * PB-50544 - Go - phase 1 - Add unit test coverage to CI
    * PB-51583 - Fix doc and completion generation job
    * PB-51565 - Update Go SDK in Go CLI
    * PB-50546 - Go - phase 1 - CLI test infrastructure
    * PB-50163 - Go-Cli : schema-driven resource type support
    * PB-51449 - Fix homebrew release producing wrong hashes in tap
    * PB-51397 - 3rd party Github Actions should be pinned (High)
    * PB-51394 - Update go dependencies
    * PB-50130 - Go-Cli: Add a manual workflow step to be able to manually execute the releases
    * PB-50128 - Go-cli : Fix release failure
    * PB-50004 - Go-cli: Adapt readme to create community managed version section

++++ godot:

  - Update to 4.6.3
    * Update layer selector when modifying "TileMap" in inspector
    * Suppress GCC 16's "sfinae-incomplete" warning
    * Debugger: Rather than looping infinitely on data read errors,
    drop the connection
    * Only print to stdio before setup and during/after cleanup
    * Fix "Pack Project as Zip" not saving permissions and time
    * Fix incorrect feature overrides when exporting for Linux
    * Clipboard history not updating on subsequent copies in Wayland
    * Initialize libdecor earlier for Wayland
    * Add project setting to disable new Volumetric fog blending behavior
    * and more: https://godotengine.github.io/godot-interactive-changelog/#4.6.3

++++ hyfetch:

  - Update to version 2.1.0:
    * [U] Release 2.1.0
    * Update neofetch
    * Fixed custom ASCII loading form files (#505)
    * Fixed ASCII whitespace handling (#327)
    * Fixed Intel OEM iGPU names (#230)
    * Fixed duplicate resolution output by skipping inactive DRM connectors (#319)
    * Fixed package coutning by removing the incorrect dnf fast path (#306)

++++ kf6-kconfig:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Do not inherit publicly from std::map
    * KConfigSkeleton: Fix reading value for deleted entry with system default (kde#509416)
    * KConfigXT: Add addItemPathList and addItemUrlList
    * CMake config file: check private QtDBus dependency only for static builds
    * Drop unneeded moc include
    * Fix build warnings with -Wnoexcept (kde#384583)
    * Add autotest for KCoreConfigSkeleton::useDefaults
    * kconfig_compiler: Fix QML forward declarations when using a namespace (kde#510091)
    * kwindowstatesaverquick: Do not force-show windows
    * CMake config file: remove no longer used Qt6Xml dep with (static) libs
    * Add test for ADMIN_ACCOUNT environment variable override
    * Fix wrong usage of qEnvironmentVariable function
    * CMake config file: add missing Qt6Core & Qt6Gui dependency check
    * kconfig_compiler: Consistently accept lowercase type names
    * Install Qt metatypes
    * Update version to 6.27.0

++++ kernel-firmware-amdgpu:

  - Update to version 20260605 (git commit 230073b14d6c):
    * amdgpu: Update DMCUB fw for DCN314
    * amdgpu: revert yellow carp VCN firmware
    * amdgpu: revert vangogh VCN firmware
    * amdgpu: revert sienna cichlid VCN firmware
    * amdgpu: revert navy flounder VCN firmware
    * amdgpu: revert dimgrey cavefish VCN firmware
    * amdgpu: revert beige_goby VCN firmware
    * amdgpu: DMCUB updates for various ASICs

++++ kernel-firmware-bluetooth:

  - Update to version 20260605 (git commit 230073b14d6c):
    * QCA: Add BCS calibration binary for QCC2072
    * QCA: Update Bluetooth firmware for QCC2072 UART interface

++++ kernel-firmware-intel:

  - Update to version 20260605 (git commit 230073b14d6c):
    * intel_vpu: Update NPU firmware

++++ kernel-firmware-qcom:

  - Update to version 20260605 (git commit 230073b14d6c):
    * qcom: update CDSP firmware for x1e80100 platform

++++ kernel-firmware-realtek:

  - Update to version 20260605 (git commit 230073b14d6c):
    * rtl_nic: add firmware rtl8261c.bin for RTL8261c

++++ kernel-firmware-sound:

  - Update to version 20260605 (git commit 230073b14d6c):
    * cirrus: cs35l56: Add firmware for Cirrus Amps for a Dell laptop
    * linux-firmware: Add RCA firmware files for tas257x projects
    * cirrus: cs35l63: Add Cirrus CS35L63 firmware mappings for various Dell laptops
    * cirrus: cs35l56: Update firmware for Cirrus Amps for a couple of Lenovo laptops
    * cirrus: cs35l56: Add firmware for Cirrus Amps for a Lenovo laptop
    * cirrus: cs35l56: Add Cirrus CS35L56 firmware mappings for two Dell laptops

++++ kf6-attica:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-baloo:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * [Query] Make Query::exec() idempotent
    * [autotests] Remove unnecessary/unused include
    * Tighten used namespaces in implementations
    * Term: Remove unused userData member and methods
    * Update version to 6.27.0

++++ kf6-bluez-qt:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Enable LSAN in CI
    * Add Qt6DBus to public link interface
    * Update version to 6.27.0

++++ kf6-breeze-icons:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * configure_package_config_file: drop unused PATH_VARS CMAKE_INSTALL_PREFIX
    * Replace Acrobat branding with Okular iconography (kde#487595)
    * Remove im-[company logo] icons
    * Remove acroread icon
    * Update version to 6.27.0

++++ kf6-extra-cmake-modules:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Set INTERFACE_LINK_LIBRARIES if the found library is a static library
    * fix: translation loading location issue on macOS
    * ECMDepreactionSettings: Set QT_DEPRECATED_WARNINGS_SINCE to current version when newer warnings should not be shown
    * Try harder to determine a good default for the Android API level
    * Silence more warnings in python bindings
    * Add note to ECMGenerateQmlTypes that it's basically obsolete
    * Add KDE_INSTALL_QTMETATYPESDIR
    * Update version to 6.27.0
    * Sanitizer: add support for realtime sanitizer

++++ kf6-extra-cmake-modules-doc:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Set INTERFACE_LINK_LIBRARIES if the found library is a static library
    * fix: translation loading location issue on macOS
    * ECMDepreactionSettings: Set QT_DEPRECATED_WARNINGS_SINCE to current version when newer warnings should not be shown
    * Try harder to determine a good default for the Android API level
    * Silence more warnings in python bindings
    * Add note to ECMGenerateQmlTypes that it's basically obsolete
    * Add KDE_INSTALL_QTMETATYPESDIR
    * Update version to 6.27.0
    * Sanitizer: add support for realtime sanitizer

++++ kf6-frameworkintegration:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kapidox:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update version to 6.27.0

++++ kf6-karchive:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Allow to set CMake modules path outside additionally.
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-kauth:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * KF6AuthCore: move Qt6::Gui to private link interface
    * Port to KWaylandExtras::xdgActivationToken
    * Update version to 6.27.0

++++ kf6-kbookmarks:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * KF6BookmarksWidgets: list KF6::Bookmarks in public interface, not private
    * Update version to 6.27.0

++++ kf6-kcalendarcore:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kcmutils:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Add support for Union to SettingHighlighterPrivate
    * Update version to 6.27.0
    * kcmshell: Don't leak QML engine
    * Add smoke-test option to kcmshell

++++ kf6-kcodecs:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * KEmailAddress::decodeMailtoUrl: return empty string on non-mailto URL (kde#519721)
    * remove unused code
    * KCharsets::fromEntity: bound numeric reference to QChar range and reorder bounds check (kde#519719)
    * [Codec] Change compare method in charset lookup
    * [Codec] Fix infinite loop in charset lookup (kde#520200)
    * Update version to 6.27.0

++++ kf6-kcolorscheme:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kcompletion:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kconfigwidgets:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Hide windowsvista style from KStlyeManager
    * Also activate window in KConfigDialog::showDialog
    * Add Amharic kf6_entry.desktop
    * Update version to 6.27.0

++++ kf6-kcontacts:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * CMake config file: add missing Qt6Gui dependency check
    * impp: Try to always return a label for an IM protocol, even if none is known
    * impp: Add helper getter to get only username portion of the address
    * Fix build not including new files in resource
    * improtocols: Add a bunch of modern services
    * Update version to 6.27.0

++++ kf6-kcoreaddons:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * fix Clang-Tidy: Static member accessed through instance
    * fix Clang-Tidy: Method 'initTestCase' can be made static
    * fix Clazy: Unused QString lineFeed
    * KAboutData: Reload applicationData when desktopFileName param is set
    * Fix build warnings with -Wnoexcept
    * kaboutdata: Use application display name for --author
    * klistopenfilesjob_unix: Remove unneeded qOverload for connect
    * licenses Free Software Foundation has changed a bit the text of the licenses
    * KTextToHTML: escape HTML entities in highlighted text (kde#504078)
    * Use default DEFAULT_SEVERITY for logging
    * Force locale on Windows as well for the KAboutData unit test
    * Install Qt metatypes
    * Update version to 6.27.0

++++ kf6-kcrash:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Add Android Sentry integration
    * Update version to 6.27.0

++++ kf6-kdav:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Use Depth: 1 instead of Depth: 0 for multiget REPORT requests
    * Fix percent-encoding of item hrefs in CalDAV/CardDAV multiget requests
    * Add job to create DAV collection
    * autotests: Add davitemsfetchjobtest
    * test: Remove manual test server
    * enums: Deprecate GroupDav protocol support
    * Update version to 6.27.0

++++ kf6-kdbusaddons:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kdeclarative:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Add location to CalendarEvents::EventData
    * Add strict qmllint configuration
    * Use id instead of parent
    * Use Application instead of Qt.application
    * Remove unused include
    * Register QKeySequence to QML
    * Add missing module dependency
    * Access local property directly
    * Fix unqualified property access
    * Use int instead of enum as property type
    * Port to KI18nContext QML API
    * Update version to 6.27.0

++++ kf6-kded:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-kdesu:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Make sure to handle \\\0 without overflowing read
    * Update version to 6.27.0

++++ kf6-kdnssd:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kdoctools:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kfilemetadata:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kglobalaccel:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Add KGlobalAccel::setInverseShortcutActions() to the API
    * Format with clang-format and xmllint
    * Add empty lines in dbus interface files
    * Properly mark all deprecated APIs in org.kde.KGlobalAccel interface
    * Mark org.kde.KGlobalAccel.actionList as deprecated
    * Make KGlobalAccel::stealShortcutSystemwide() steal all matching shortcuts
    * Support a custom bus
    * Update version to 6.27.0

++++ kf6-kguiaddons:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Install Qt metatypes
    * Update version to 6.27.0

++++ kf6-kholidays:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Add Bolivian Holidays (kde#520179)
    * .clang-tidy - fix typo StringCompareLikeFuctions
    * src/lunarphase.cpp - krazy excludeall typedefs
    * CMakeLists.txt - update the flex and bison urls
    * src/sunevents_p.h - fix include guard name
    * SunRiseSet: place deprecation attribute standard-type-clang-compatible
    * fix holidays appear twice in january (kde#498462)
    * UA: Update Ukrainian holidays
    * Update version to 6.27.0
    * .gitlab-ci.yml - don't fail on clang-tidy issues

++++ kf6-ki18n:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Avoid use of Qt module header includes with QtQmlIntegration
    * Add "gnuintl" as a variant for Intl library name
    * Convert old prg doc reference to proper link
    * Update version to 6.27.0

++++ kf6-kiconthemes:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * KIconButton: add some unit test for the properties
    * widgets/kicondialog: clear custom when pressing OK (kde#520007)
    * Update version to 6.27.0

++++ kf6-kidletime:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kimageformats:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Updated documentation on memory usage
    * JXR: add a memory allocation barrier in jxrlib
    * EXR: reject files with dimensions exceeding 300kx300k pixels
    * OSS Fuzz: set image allocation limit to 2000 MiB
    * Improve size limits for AVIF, HEIF, and RAW plugins
    * IFF: fix byte swapping in 16-bit DEEP images
    * Add Farbfeld read only support
    * DDS: fix mime type
    * IFF: DEEP image support
    * imageAlloc: add image initialization support
    * Fix uninitialized value
    * HEIF: image transformation support
    * Update CI image
    * Update version to 6.27.0

++++ kf6-kio:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Too many changes since 6.26.0, only listing bugfixes:
    * kmountpoint: Iterate mountpoint backwards to handle systemd-automount (kde#518012)
    * openurljob: respect "open in application" preference for binaries (kde#519773)
    * KUrlNavigator: Fix double background interference when in editable mode (kde#506177)
    * KDirModel: Use mostLocalUrl for old url (kde#509461)
    * kprocessrunner: For apps running in terminal, use terminal emulator's appId (kde#459986)
    * dropjob: Sanitize input URLs (kde#518481)
    * KDirModel: Remove setting node preview on itemChanged (kde#517607)
    * Don't show an error when the user cancels the device mounting password dialog (kde#400420)
    * http worker: call redirection also for redirectToTrailingSlash (kde#517682)
    * kurlnavigator: Don't show context menu targeting hidden buttons when path is compressed (kde#505197)
    * kdiroperator, kfilewidget: Use zoomsteps when using scrollwheel (kde#494704)
    * core/copyjob: Prompt to replace MS-DOS reserved chars for MTP (kde#489288)

++++ kf6-kirigami:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Remove polyfill imports for SafeArea API
    * Don't apply safe area margin to page bottom when there's a footer
    * Only apply safe area margins when we have a parent
    * Fix top margin in Page overlayItem
    * Heading: set the color to Platform.Theme.textColor for heading
    * Explicitly layout the window content item vertically as well
    * Fix toolbar size with non-zero SafeArea margins
    * controls/Badge: avoid binding loop
    * Fix access to ScenePosition attached property in DrawerHandle
    * GlobalDrawer: top-align topContent (kde#520337)
    * Add basic tests for some components
    * Don't handle back key twice
    * FormLayout: Fix FormData namespace alias (kde#520076)
    * Revert "Disable qmllint for some modules"
    * Form: Guard root.Forms.FormAlignmentGroup.group
    * GlobalDrawer: Use implicitWidth, set preferredHeight in item (kde#517091)
    * Remove unused import
    * Clean up internal imports
    * controls: Remove defunct onCompleted block in AbstractApplicationWindow
    * controls: Don't break width/height bindings in AbstractApplicationWindow
    * Remove duplicate ecm_qt_install_logging_categories
    * Use default DEFAULT_SEVERITY for logging
    * Action: Notify fromQActinChanged when the QAction changed
    * Form: Introduce FormAlignmentGroup
    * Install Qt metatypes
    * ToolbarLayout: don't crash when moreButton is not valid
    * Fixs subtitle  padding calculation in forms flat mode
    * Update version to 6.27.0

++++ kf6-kitemmodels:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kitemviews:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kjobwidgets:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kmime:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0

++++ kf6-knewstuff:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * EngineBase::addProvider(provider): fix consumer-side hiding virtual method
    * Update version to 6.27.0

++++ kf6-knotifications:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * android: Improve icon handling
    * android: Confirm reception of inline replies
    * android: Set Intent package names rather than invalid component names
    * android: Fix invalid iterator access
    * Don't update notifications before they have actually been sent
    * android: Don't defer NotifyByAndroid::notify execution
    * configure_package_config_file: drop unused PATH_VARS KDE_INSTALL_DBUSINTERFACEDIR
    * Update version to 6.27.0

++++ kf6-knotifyconfig:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kpackage:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kparts:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kpeople:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kplotting:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kpty:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kquickcharts:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-krunner:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Extract and install Qt metatypes
    * RunnerManager: move spurious member into pimpl class
    * ResultsModel: Directly call toInt from QVariant to avoid implicit conversion
    * RunnerManager: Avoid weird use of mutable iterator in favor of simple for loop
    * RunnerContext: Use QHash for unique IDs since order is not relevant
    * Use std::min/max instead of QT macros
    * Update version to 6.27.0

++++ kf6-kservice:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kstatusnotifieritem:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-ksvg:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Svg: clear stylesheetOverride on imageSetChanged (kde#503671)
    * Svg: make eventFilter public again
    * CMake config file: remove duplicated targets include
    * Drop accidental duplicate QML registration
    * Remove unused ECM module
    * Add basic test for SvgItem
    * Update version to 6.27.0

++++ kf6-ktexteditor:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * use expanded document mode tabs in config pages
    * Revert "CI: Comment out Qt 6.12 for now since tests are failing"
    * ScriptTester: Due to the change in Qt 6.12, getMessage() should return an empty string instead of undefined when there is no message
    * Add public API for visible/real line number conversion
    * calculate which line numbers need repainting correctly
    * Allow disabling "use first line of doc as file name" for untitled docs (kde#519242)
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-ktexttemplate:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-ktextwidgets:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * KPluralHandlingSpinBox: place deprecation attribute standard type compatible
    * Update version to 6.27.0

++++ kf6-kunitconversion:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Mark US pints as common, rather than Imperial ones
    * Update version to 6.27.0

++++ kf6-kuserfeedback:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * configure_package_config_file: drop unused PATH_VARS KDE_INSTALL_INCLUDEDIR
    * Update version to 6.27.0

++++ kf6-kwallet:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-kwidgetsaddons:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Use version-controllable deprecation warning macros instead of hardcoding
    * Update kcharselect-data to Unicode 17.0
    * Force locale on Windows as well for unit test
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-kwindowsystem:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * KKeyServer: place deprecation attribute standard-type-clang-compatible
    * Use default DEFAULT_SEVERITY for logging
    * kwaylandextras: refine activation token documentation a bit
    * Update version to 6.27.0

++++ kf6-kxmlgui:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * kxmlguiwindow: Special case KToolBarPopupAction for CommandBar
    * kmainwindow commandbar: include root ActionGroup actions
    * Avoid setting session management window properties without session management (kde#519786)
    * Add file suffix for shortcuts
    * Update version to 6.27.0

++++ kf6-modemmanager-qt:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-networkmanager-qt:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Fix bridgeport hairpin-mode setting key
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-prison:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Update version to 6.27.0

++++ kf6-purpose:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * CMake config file: add missing Qt6Gui &  Qt6Widgets dependency check
    * Change Pastebin to Pastebin.com
    * Adapt to KOnlineAccounts interface change
    * Add missing find_dependency for Qt6QmlIntegration
    * Use default DEFAULT_SEVERITY for logging
    * Adapt to KOnlineAccounts API change
    * Replace var with const
    * Remove unused import
    * Convert org.kde.purpose.private.widgets to proper QML module
    * Fix unqualified property lookup
    * Rename JobView::state to jobState
    * Use KI18nContext
    * Use fully qualified typename in property
    * Fix deprecation warnings from ECM
    * Remove CMake warning about arc runtime dependency
    * Revert "Enable LSAN in CI"
    * Update version to 6.27.0

++++ kf6-qqc2-desktop-style:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * README.md kdesrc-build -> kde-builder
    * Remove group separators from SpinBox by default like QSpinBox
    * Update version to 6.27.0

++++ kf6-solid:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Use globally-configured storage size units for labeling disks (kde#518493)
    * Allow to set CMake modules path outside additionally.
    * kdeconnect: Always remove device before emitting deviceRemoved
    * Use default DEFAULT_SEVERITY for logging
    * Update version to 6.27.0

++++ kf6-sonnet:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * CMake config file: fix missing Qt6Widgets check with SONNET_USE_WIDGETS:ON
    * Allow to set CMake modules path outside additionally.
    * Remove unused ECM module
    * Update version to 6.27.0

++++ kf6-syndication:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * CMake config file: add missing Qt6Core dependency check
    * Update version to 6.27.0

++++ kf6-syntax-highlighting:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Add missing license texts
    * YAML: fix quoted no-string in list (kde#500809)
    * Add syntax highlighting for Slint files
    * Minor fixes on gemtext syntax and reference
    * add BNF and ABNF syntax highlighting (kde#518109)
    * Breeze Dark theme: less vibrant color for BracketMatching to make dsFunction color visible (kde#519805)
    * theme_contrast_checker.py: use Okl as default color space
    * theme_contrast_checker.py: add --neighbor-color and --neighbor-distance to filter colors that are close to a specific color
    * theme_contrast_checker.py: add --bg-color to view colors of a theme with a specific background color
    * Fish: update to latest version and fix various bugs (kde#519060)
    * LaTeX: fix optional parameter with minted shortcuts (kde#514536)
    * J: update to latest version from github (kde#518108)
    * Raku: bump highlighting definition version
    * Raku: Allow - inside
    * Raku: Fix breakage of double backslash before ending single quote
    * Raku: Allow signatures on token/rule/regex declarations
    * Update version to 6.27.0

++++ kf6-threadweaver:

  - Update to 6.27.0
    * New feature release
    * For more details please see:
    * https://kde.org/announcements/frameworks/6/6.27.0
  - Changes since 6.26.0:
    * Update dependency version to 6.27.0
    * Remove duplicate headers
    * Update version to 6.27.0

++++ libressl:

  - Update to release 4.3.2
    * Support for MLKEM768_X25519 keyshare in TLS.
    * Added ML-KEM benchmarks to openssl(1) speed.
    * Added support for starttls protocol sieve.
    * Add support for RSASSA-PSS with pubkey OID RSASSA-PSS to
    libssl.
    * Rework portable assembly handling with LIBRESSL_USE_ASSEMBLY.
    * Add SHA assembly for elf-aarch64.
    * Fix posix_open() implementation so it properly signals failure.
    * Fix overwrite of user CFLAGS/LDFLAGS in hardening flag
    detection.
  - Added fix_cert_path.patch: Use the correct path for cert bundle
    from ca-certificates packages.
  - Added enable_pqc.patch: Enable use of PQC for TLSv1.3 with
    default parameters.

++++ mpg123:

  - Update to version 1.33.6
    * mpg123
    + Prepare for const-returning strchr().
    + Hide seq_len debugging counter in non-debug mode.
    + Fix memory leak with --network internal due to inverted NULL
    check in net123_close_internal() (handle never NULL in
    practice, though).
    * mpg123, out123: Fix strrchr() usage to be more const and
    correct under C99 as well as C23.
    * mpg123-strip: Also use largefile API properly using
    mpg123config.h, but without actual effect at least on
    Linux/x86. It is cleaner that way, though.
    * libmpg123: Remove unused loop variable in layer2 left over
    from runtime table elimination (32 bit mmx/sse code).

++++ python311-core:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ python314-core:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ python314-nogil-nogil-core:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ netbird:

  - Update service-install-cli-change.patch:
    Add more guidance how to manage the drop in files

++++ ocaml:

  - update to version 4.14.4
    See included Changes for benefits and breaking changes
    (bsc#1260910 CVE-2026-34353)

++++ patterns-kalpa:

  - Add missed kalpa-themes

++++ perl-Class-Accessor-Lite:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Class-ReturnValue:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Devel-StackTrace-AsHTML:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details
  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-HTTP-Entity-Parser:

  - Normalize CPAN version
    See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-HTTP-Server-Simple:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Hash-MultiValue:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Log-Dispatch:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Pod-Coverage:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Stream-Buffered:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Test-Kwalitee:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-Test-Pod:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details
  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-WWW-Form-UrlEncoded:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ perl-XML-NamespaceSupport:

  - See https://github.com/openSUSE/cpanspec/issues/47 for details

++++ python311:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ python311-documentation:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ python-cmd2:

  - Add failing_tests.patch (gh#python-cmd2/cmd2!1678) to make the
    test suite work with the latest version of rich.

++++ python314:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ python314-documentation:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ python314-nogil:

  - Keep unversioned Python 3 development entry points in
    python3-devel: python313-devel no longer provides python3-devel
    and no longer owns libpython3.so, python3-config, python3.pc,
    or python3-embed.pc. Do not package versioned GIL pkg-config
    files in nogil-devel. Also, fix regular expressions in
    rpmlintrc.

++++ selinux-policy:

  - move %postMigration from %posttrans to %post to finish migration
    and copy user/custom modules to /etc when zypper dup is aborted
    due different package issue or semodu invocation (fixes boo#1264463)

++++ xscreensaver:

  - Add xscreensaver-screenfade.patch: don't abort in
    openGL_context_for_window. Callers (e.g. the screen fade) treat
    a NULL return as "GL is unavailable" and fall back gracefully

------------------------------------------------------------------
------------------  2026-6-5  -  Jun 5 2026  -------------------
------------------------------------------------------------------

++++ agama:

  - Adapt manager to set the list of resolvables. It asks each module
    about its requirements and configures the software service
    (bsc#1266276).

++++ agama-web-ui:

  - Fix race condition in download success alert.
  - Do not show "Review and install" button in installation pages
    (gh#agama-project/agama#3588).

++++ agama-yast:

  - Extend D-Bus API to allow getting the resolvables required by
    storage and bootloader (needed for bsc#1266276).
  - Stop calling to software directly from the D-Bus service.

++++ aravis:

  - Drop obsoleted %suse_update_desktop_file

++++ ardour:

  - Update to 9.7.0
    Check https://ardour.org/whatsnew.html for all details.
    We are pleased to announce the release of Ardour 9.7. This bugfix
    release comes with several noteworthy enhancements: futher MIDI
    editing improvements, better listing of supported control
    surfaces, and a brand-new vertical scrollbar in the editor.

++++ container-selinux:

  - Update to version 2.249.0:
    * bump to v2.249.0
    * Allow rpmdb to manage files on mounted container filesystems

++++ gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-aarch64-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-aarch64-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-amdgcn-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-arm-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-arm-none-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-arm-none-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-avr-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-avr-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-bpf-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-hppa-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-hppa-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-loongarch64-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-loongarch64-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-nvptx-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-ppc64-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-ppc64le-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-ppc64le-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-pru-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-riscv64-elf-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-riscv64-elf-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-riscv64-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-riscv64-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-rx-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-rx-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-s390x-gcc15:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ cross-s390x-gcc15-bootstrap:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ digger-cli:

  - Update to version 0.6.146:
    * add timeout to generate service client so it does not fail to
    do status updates by @motatoes in #2622
    * ui github setup link fix by @motatoes in #2642
    * Update Slack invitation links in CONTRIBUTING.md by
    @s1ntaxe770r in #2646
    * fix: upgrade azure/login to v2.2.0 to prevent cleanup warnings
    by @AyhanSetirekli in #2584
    * docs: recommend docker-compose guide by @s1ntaxe770r in #2604
    * docs: security page by @s1ntaxe770r in #2605
    * fix: add target url to link to workflow run by @s1ntaxe770r in
    [#2606]
    * Fix default image repos (backend ee -> ce), add podAnnotations
    by @sidpalas in #2598
    * conditionally enable summary by @s1ntaxe770r in #2619
    * Feat/exclude drift by @s1ntaxe770r in #2650
    * fix: drift_exclude_patterns excluding all projects when include
    is unset by @motatoes in #2653
    * docs: add Holocron migration spike by @motatoes in #2656
    * Feat/block excludes by @s1ntaxe770r in #2659

++++ falcosidekick:

  - Update to version 2.34.1:
    * fix: prevent DoS panics from malformed output_fields in OTLP
    traces and Spyderbat outputs

++++ fips:

  - Update to version 3.5.0:
    * Version 3.5.0
    * Bump microsoft/setup-msbuild from 1.1 to 1.3
    * Bump softprops/action-gh-release from 2 to 3
    * Bump actions/checkout from 4 to 6
    * Bump actions/upload-artifact from 4 to 7

++++ five-or-more:

  - Update to version 48.1+6:
    + metainfo: Update the help URL
    + Call parent class on state event
    + Updated translations.
  - Use meson_test macro instead of manual call to validate desktop
    file.

++++ forgejo:

  - Update to version 15.0.2:
    + fix: prevent git write to wiki repo from unauthorized user via git HTTP
    + fix: prevent LFS authorization token from being used for read/write access
    after user's access is restricted
    + fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing
    resources beyond their permitted scope via non-API end
    + fix: implementing missing OAuth validation checks, improve protections
    against race conditions
    + fix: prevent OAuth redirect URI spoofing via non-ascii case collision
    + fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks

++++ forgejo-longterm:

  - Update to version 11.0.14:
    + fix: prevent git write to wiki repo from unauthorized user via git HTTP
    + fix: prevent LFS authorization token from being used for read/write access
    after user's access is restricted
    + fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing
    resources beyond their permitted scope via non-API endpoints
    + fix: implementing missing OAuth validation checks, improve protections
    against race conditions
    + fix: prevent OAuth redirect URI spoofing via non-ascii case collision
    + fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks
  - Update apparmor profile, reflecting the same changes as the non-longterm package:
    + Set UMask so that subdirectories within /var/lib/forgejo are not
    world readable
    + fix typo in abstraction
    + have all all local permissions before subprofiles
    + Allow SSH mirroring and template customization in AppArmor profile

++++ gcc15-testresults:

  - Update to GCC 15 branch head, 15.2.1+git11263, GCC 15.3 RC1
  - Drop -fhardened from RPM_OPT_FLAGS

++++ ghc-optparse-applicative:

  - Update optparse-applicative to version 0.19.0.0 revision 1.
    Upstream has revised the Cabal build instructions on Hackage.

++++ gnome-klotski:

  - Update to version 3.38.2+47:
    + Don't create window in startup phase
    + appdata: Rename apptadata to metainfo
    + build: Use appstreamcli
    + appdata: Update appdata
    + Fix setting application name
    + Set prgname to application ID
    + Reference of [GtkChild] fields is handled by GtkBuilder, type
    must be unowned
    + Updated translations.
  - Add AppStream and desktop-file-utils BuildRequires and check
    section with meson_test macro: Validate metadata and desktop file
    during build.

++++ gnome-usage:

  - Update to version 48.0+13:
    + system-monitor: use Timeout.add_seconds
    + Use power saving mode for disabling system monitor
    + system-monitor: do active use counting and track screensaver
    state
    + Centralise update ticks
    + settings: support property notification
    + Updated translations.

++++ grafana:

  - CVE-2026-39821: Fix validation bypass and privilege escalation by
    updating golang.org/x/net to version 0.55.0 (bsc#1266600)
    * Fix multiple issues when parsing HTML files (bsc#1267153):
    CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681,
    CVE-2026-42506
    * Added 0009-Bump-golang.org-x-net.patch

++++ haproxy:

  - one more path for the cpu handling in apparmor

++++ heroic-gogdl:

  - Update to version 1.2.2
    * fix: prevent .netrc credentials from being injected into GOG auth by @badboybeyer in #75
    * Add more logging to --debug level by @izacus in #79
    * fix: prevent multiple CLI crashes and improve error handling by @Jonatas-Goncalves in #76
    * fix: do case insensitive comparison of deprecated codes by @imLinguin in eee0bbb
    * ci: package as zipapp on linux by @imLinguin in 2ed0d06
    * Update use-system-xdelta3.patch to fit upstream
    * Remove pyproject.toml modifications performed via sed
    * Drop xdelta extension definition from pyproject.toml via patch

++++ iagno:

  - Update to version 50.0+8:
    + Updated translations.

++++ indi:

  - Update to 2.2.2:
    * Add Wake on LAN support to 10micron driver by @fenriques in
    [#2379]
    * ci: add erfa as explicit build dependency by @ckemper67 in
    [#2378]
    * alignment: add SPK physics-based math plugin by @ckemper67 in
    [#2376]
    * alignment: guard SPK test target when erfa is not found by
    @ckemper67 in #2380
    * fix(libastro): parenthesize DEG_TO_RAD/RAD_TO_DEG macros by
    @ckemper67 in #2382
    * fix(libastro): use apparent sidereal time in
    EquatorialToHorizontal; add accuracy tests by @ckemper67 in
    [#2383]
    * docs: add liberfa to install prerequisites in README by
    @ckemper67 in #2385
    * Add Wanderer ETA M54 Electronic Tilt Adjuster driver by
    @cfuture81 in #2386
    * Alignment: deprecate old Transform* shims, migrate all in-tree
    callers to *JD by @ckemper67 in #2388
    * esp32go driver: updated support by @jordisese in #2391
    * add pkgconf to the control file by @s-pouya-sh in #2392
    * Wanderer ETA: Add backfocus offset feature by @cfuture81 in
    [#2397]
    * Support max focus position via firmware command in Pinefeat CEF
    focuser by @pinefeat in #2399
    * Correct Movement of Avalon UPAS by @DomMer2587 in #2403
    * Gemini dust-cap Pro variant suport by @f4exb in #2404
    * Pegasus Flatmaster Neo Driver by @DomMer2587 in #2405

++++ inspektor-gadget:

  - Update to version 0.53.1:
    * Bug fixes
  - [BACKPORT] security hardening fixes for USDT/uprobe
    ELF/ld.so.cache parsing by @alban in #5547

++++ international-doom:

  - splitted into international-doom, international-heretic and
    international-hexen packages for better discovery of Heretic and Hexen

++++ istioctl:

  - update to 1.30.1:
    https://istio.io/latest/news/releases/1.30.x/announcing-1.30.1/
    * Added istioctl analyze check IST0176 that flags Gateway API
    CRDs installed at a version below the minimum required by the
    current Istio version. Resources backed by such CRDs are
    silently filtered by istiod, which previously made it hard to
    discover TLS passthrough breakage after upgrading to Istio 1.30
    with stale Gateway API CRDs.

++++ jujutsu:

  - update to 0.42.0:
    * Release highlights
  - Switched to the mimalloc memory allocator for better
    multi-threaded performance.
    * Breaking changes
  - The following deprecated command options have been removed:
  - jj commit --reset-author/--author
  - jj describe --no-edit/--edit/--reset-author/--author
  - jj git push --allow-new
  - jj metaedit --update-committer-timestamp
  - The following deprecated config options have been removed:
  - git.auto-local-bookmark
  - git.push-new-bookmarks
    * Deprecations
  - jj evolog no longer supports legacy commit predecessors
    recorded in jj < 0.30.
    * New features
  - Shell completions now surface descriptions for custom
    aliases, revset-aliases, template-aliases, and
    fileset-aliases. Descriptions are extracted from the .doc
    field of the alias definition if it is a table with .doc and
    .definition properties.
  - jj show now accepts multiple revisions, showing all of them
    one after the other, behaving closer to git show.
  - jj git fetch now generates evolution history based on change
    IDs. If change IDs are preserved by the remote, local
    descendant revisions will be rebased onto the rewritten
    parents.
  - Added jj util backend name command that prints the commit
    backend being used in the current repo.
  - Added edit-invocation-mode config option for diff editors
    (e.g.  jj diffedit, jj split). When set to "file-by-file",
    the editor is launched once per changed file, making it
    possible to use per-file tools like vimdiff for editing.
    * Fixed bugs
  - jj git remote add now reports an error instead of panicking
    when the remote name is empty or contains whitespace.  #9099
  - Color-words diffs are now shown as separate before and after
    lines when color output is disabled, making piped or
    redirected diffs readable.  #5894
  - jj bookmark forget no longer prints Forgot N local bookmarks.
    when no local bookmarks were actually forgotten (e.g. when
    only an untracked remote bookmark matched). #9181.
  - The builtin_log_redacted template now also redacts workspace
    names.

++++ kernel-default:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-source:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-source-longterm:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-docs:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-kvmsmall:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-longterm:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-obs-build:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-obs-qa:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-syms:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-syms-longterm:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ kernel-vanilla:

  - packaging: Add nvidia kernel description
  - commit 5f2699f

++++ key-rack:

  - Update to version 0.5.0:
    * This version brings a bunch of UI refinements and support for
    app keyrings that contain invalid entries.
    * Updated translations.
  - Update URL to new home.
  - Drop unneeded update-desktop-files BuildRequires and macro,
    replace with desktop-file-utils that provides the needed binary
    update-desktop-database.
  - Add lang sub-package, we have translations now.

++++ krita:

  - Update to 6.0.2.1
    * Fix bug with the layer docker that was very pervasive, and
    could cause anything from unsynced layers to crashes to
    groups not behaving as they should

++++ kubeconform:

  - Update to version 0.8.0:
    * Update README (#360)
    * Small fixes, better sanitization (#359)
    * fix: update duration validation to use strfmt package (#348)
    * Update deps, make sure we use vendored dependencies (#358)
    * Openapi2jsonschema-go (#357)
    * fix: avoid panic when a schema document decodes to null (#356)
    * Read resources from multiple workers (#354)
    * Fix typo (#339)
    * fix: Github -> GitHub (#340)

++++ kubetui:

  - Update to version 1.14.0:
    * Highlights
  - Node tab
    A new Node tab (press 5) lists cluster nodes with status,
    roles, age, and version. It includes a detail pane for the
    selected node, customizable columns (runtime dialog /
  - -node-columns / presets), label columns, and column-aware
    filtering. (#920, #972, #974, #975, #979, #983, #985)
  - Column-aware filtering (Pod / Node / Config / Network)
    The table filter is now column-aware across all aggregate
    views: COL:<regex> to include, !COL:<regex> to exclude,
    label:<selector> applied server-side, and bare values match
    NAME. Terms on hidden columns become inactive (kept, not
    applied), the title shows a [position/shown (total)] count
    (e.g. [1/2 (3)]) so you can see how many rows the filter
    hides, and ? opens a per-tab filter help dialog. (#980, #982,
    [#986], #988, #989, #991, #992, #997, #999)
  - Label columns (Pod / Node / Config / Network)
    Register Kubernetes labels as table columns via label_columns
    in the config file. Registered labels also become valid
    filter columns and column-dialog entries. (#975, #993, #1002,
    [#1003])
  - Log query: multi-namespace partial success
    When a log query targets multiple namespaces and the resource
    is missing in some of them, the remaining namespaces keep
    streaming logs; missing ones surface as inline [kubetui]
    notices instead of failing the whole query. (#1004)
    * Fixes
  - Force exec auth plugins non-interactive so plugin stderr
    can't corrupt the TUI (#987)
  - Keep all columns visible when the pane is too narrow (#976)
  - Apply theme to the pod log-query and node filter help dialogs
    (#984)
  - URL-encode user-typed label selectors (#996)
  - Clear filter state on filter cancel and drive the (total)
    indicator by filter state
    * Internal / Refactor
  - Extract a shared parse_table_filter core used by all tabs
    (#991)
  - Node column registry single-source-of-truth (#995)
  - Apply nightly rustfmt (#971)
    * Documentation
  - Overhaul the README for the new features, and document the
    OSC52 clipboard mode that shipped in v1.12.0 (#1006)
    * Dependencies
  - chore(deps): lock file maintenance (#964)
  - chore(deps): lock file maintenance (#966)
  - chore(deps): lock file maintenance (#968)
  - chore(deps): update actions/checkout digest to df4cb1c (#1005)
  - chore(deps): update rust crate bitflags to v2.12.1 (#1001)
  - chore(deps): update rust crate http to v1.4.1 (#977)
  - chore(deps): update rust crate jiff to v0.2.25 (#970)
  - chore(deps): update rust crate jiff to v0.2.26 (#978)
  - chore(deps): update rust crate jiff to v0.2.27 (#981)
  - chore(deps): update rust crate jiff to v0.2.28 (#990)
  - chore(deps): update rust crate log to v0.4.30 (#973)
  - chore(deps): update rust crate log to v0.4.31 (#1000)
  - chore(deps): update rust crate log to v0.4.32 (#1007)
  - chore(deps): update rust crate serde_json to v1.0.150 (#967)
  - chore(deps): update rust crate tokio to v1.52.2 (#963)
  - chore(deps): update rust crate tokio to v1.52.3 (#965)
  - chore(deps): update rust crate unicode-segmentation to v1.13.3 (#998)

++++ kumactl:

  - Update to version 2.13.7:
    * fix(goldenfiles): update meshhttproute gateway (#16848)
    * fix(kuma-init): properly validate ip family condition (backport
    of #16810) (#16828)
    * perf(gateway): drop redundant exact match for root path prefix
    (backport of #16782) (#16842)
    * fix(meshhttproute): dedup duplicate routes on gateway virtual
    hosts (backport of #16786) (#16833)
    * fix(kuma-cp): use system trust when CA cert is not provided
    (backport of #16777) (#16793)
    * fix(e2e): make universal DP compatibility tests actually
    exercise old DPs (backport of #16804) (#16808)
    * ci(deps): skip deps with unpublished fix ver (backport of
    [#16770]) (#16800)
    * feat(xds): add DiscoveryResponse size histogram (backport of
    [#16783]) (#16787)
    * chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0
    (#16737)
    * chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0
    (#16736)
    * ci(pr-comments): add e2e golden refresh (backport of #16626)
    (#16725)
    * fix(kds): default usedonly when fetching stats (backport of
    [#16711]) (#16715)
    * fix(xds): add a feature flag to enable reuse ports (backport of
    [#16677]) (#16707)
    * chore(deps): align envoy go-control-plane fork (#16703)
    * fix(gatewayapi): reconcile classes on startup (backport of
    [#16687]) (#16695)
    * feat(xds): delta xDS Helm + injection (bp 16392) (#16686)
    * fix(gatewayapi): fix e2e flakes (backport of #16624) (#16683)
    * ci(runners): configurable labels via RUNS_ON (#16630)

++++ lazyworktree:

  - Update to version 1.46.1:
    This release introduces an alternative F1 shortcut for the
    command palette, a complete visual redesign of the website and
    documentation using a modern blue color palette, and key bug
    fixes for path expansion.
    * Bug Fixes
  - Path Expansion: Fixed path expansion logic to correctly
    preserve literal tilde paths (such as ~other/worktrees) while
    still expanding home directory prefixes (~/).
  - Website and Docs Tweaks: Renamed the install header to
    "Installation", reformatted long HTML figure captions, and
    fixed minor typos in the README.
    * Maintenance
  - New Keybinding: Added F1 as an alternative shortcut to open
    the command palette alongside the existing : and Ctrl+P
    bindings.
  - Visual Redesign: Migrated the landing website and
    documentation interface from warm earthy tones to a modern
    blue-based design system, utilizing the Space Grotesk
    typeface for improved readability.
  - Configuration Documentation: Enhanced the configuration
    reference with precise types and descriptive details for
    agent_sessions, layout_sizes, and worktree_note_type keys.
  - CI Workflow Consolidation: Combined the nightly coverage
    badge generation into the weekly maintenance workflow,
    reducing redundant GitHub Actions runs.
  - Documentation Refinement: Standardized callout phrasing
    across all documentation pages to use "Refer to this page
    when:" instead of "Use this page when:" for improved clarity.
  - Script Update: Updated the internal release notes generator
    script to target the gemini-3.5-flash model.
    * Dependencies
  - Updated Go dependencies, including golang.org/x/sys,
    github.com/mattn/go-runewidth, and
    github.com/charmbracelet/ultraviolet (#62).

++++ sqlite3:

  - Update to version 3.53.2:
    * Fixes for problems in 3.53.0 reported by users.
    * bsc#1268013, CVE-2026-11824: heap-based buffer overflow
    vulnerability in the FTS5 full-text search extension.
    * bsc#1268012, CVE-2026-11822: memory corruption vulnerabilities
    in the FTS5 full-text search extension.
    * See the check-in timeline for details:
    https://sqlite.org/src/timeline?from=version-3.53.1&to=version-3.53.2

++++ manifold:

  - Update to 3.5.1
    Mostly a patch release for #1735.
  - Bug fixes
  - fix camera radius reset by @elalish in #1733.
  - Fix &v[size] UB in normals test sentinel pointers by
    @zmerlynn in #1736.
  - Fix originalID races on shared CSG nodes by @zmerlynn in
    [#1741].
  - Bindings
  - Expose ExecutionContext factories in bindings (C/Python/WASM)
    by @zmerlynn in #1743.
  - Refactoring
  - Thread ExecutionContext into MeshGL ingest via
    ExecutionContext::FromMeshGL by @zmerlynn in #1723.
  - Thread ExecutionContext into Smooth via
    ExecutionContext::Smooth by @zmerlynn in #1734.
  - Thread ExecutionContext into LevelSet via
    ExecutionContext::LevelSet by @zmerlynn in #1739.
  - Per-phase timing in ADVANCE_PHASE_OR_RETURN; extend
    perfPhases by @zmerlynn in #1742.
  - Route Boolean3::Result timing through the shared phase
    mechanism by @zmerlynn in #1745.

++++ mpv:

  - Remove BuildRequires on vapoursynth-script, package has been
    renamed and the new one is already being pulled by the devel package.

++++ netpbm:

  - disable test/pnmhisteq.test

++++ podofo:

  - Update to 1.1.0:
    * OpenSSLInternal: Fixed potential double-free in
    compute_hash_to_sign(), GHSAi(bsc#1265320 CVE-2026-44348)
    * Added support for ECDSA signing
    * Added PdfXMPPAcket::PruneAndValidate(pdfaLevel) for XMP
    validation
    * PdfParser: Try to rebuild the index if cross reference
    sections parsing fails
    * Added initial support for several raw images with
    /BitsPerComponent != 8
    * Added support for updating/signing files with data offset
    before %PDF- magic
    * Added support for updating/signing files with broken XRef
    sections
    * Added support for devendoring 3rd party dependencies
    * AFDKO: Integration made optional (still enabled by default)
    * Added support for PEM encoded X509 certificate loading

++++ libtorrent:

  - Update to release 0.16.13
    * Added support base64 support for non-UTF8 strings.
    * Add ready directory watch support.
    * Added per-category allocation limits to SocketManager.
    * Added a new callback mechanism and use it for trackers.

++++ libzypp:

  - Repo "keyhint" must denote a filename, no path (bsc#1267426,
    CVE-2026-44941)
  - version 17.38.12 (35)

++++ matrix-synapse:

  - Update to 1.154.0
  - Features
  - Add support for MSC4452: Preview URL capabilities API which
    exposes a io.element.msc4452.preview_url capability.
  - If experimental_features.msc4452_enabled is true, the
    /_matrix/(client/v1/media|media/v3)/preview_url endpoint
  - now responds with a 403 status code when the capability is
    disabled. (#19715)
  - Bugfixes
  - Fix a bug in MSC4186: Simplified Sliding Sync that could
    prevent user avatars from showing if the room had an empty
    name. (#19468, #19791)
  - Fix access token cache not being invalidated for sessions
    using refresh tokens. Contributed by @FrenchGithubUser @
    Famedly. (#19483)
  - Fix bug where Synapse would return 400 (M_BAD_JSON) when
    sending a message with a mentions field and Synapse module
    check_event_allowed callback registered (frozen event).
    Contributed by @gaetan-sbt. (#19634)
  - Fix long-standing but niche bug with /sync where it could
    attempt to fetch data with flawed invalid future tokens.
    (#19644)
  - Fix /sync failing when MSC4354 Sticky Events are enabled and
    the sync request filters out Ephemeral Data Units (EDUs).
    (#19787)
  - Fix packaging for Fedora and EPEL caused by unnecessary
    bumping attrs minimum version requirement in pyproject.toml
    file. Contributed by Oleg Girko. (#19789)
  - Fix merging signatures when a policy server is running under
    the same server name as Synapse. The bug was re-introduced in
    v1.153.0rc1 after being fixed earlier in v1.151.0rc1.
    Contributed by @tulir @ Beeper. (#19797)
  - Improved Documentation
  - Added details about how Synapse syncs the picture claim when
    update_profile_information setting is true. (#19508)
  - Internal Changes
  - Port Event.content field to Rust. (#19725)
  - Prefer close backfill points (absolute distance). (#19748)
  - Replace unique quarantined_media waiting patterns with
    standard wait_for_stream_token(...). (#19764)
  - Improve Synapse logging around when someone encounters We
    can't get valid state history. so you can correlate
    everything by event_id. (#19765)
  - Tidy up Rust RoomVersion structs. (#19766)
  - Update WorkerLock tests to better stress the
    WORKER_LOCK_MAX_RETRY_INTERVAL. (#19772)
  - Refactor MSC4242: State DAG checks behind a single TypeIs
    helper to avoid scattered isinstance casts. (#19774)
  - Use StrCollection for prev_state_events. (#19777)
  - Fix up the construction of events in tests, ahead of the Rust
    event port. (#19781)

++++ netbird:

  - Update to 0.72.1
  - [management] Copy private field on shallowCloneMapping by
    @mlsmaycon in #6347
  - Update to 0.72.0
  - Private Service Expose & Reverse Proxy
  - Added support to expose NetBird-only services over tunnel
    peers across management, client, and proxy. #6226
  - Added follow-up fixes for private reverse-proxy services.
    [#6268]
  - Added private service expose support in the dashboard.
    netbirdio/dashboard#646
  - Updated reverse proxy modals in the dashboard.
    netbirdio/dashboard#661
  - Bound embed client WireGuard per-device memory across proxy
    and client. #5962
  - Client Improvements
  - Filtered scoped/cloned default routes from BSD network
    monitor. #6208
  - Matched DNS wildcard handlers on label boundaries. #6255
  - Refactored Linux system info to use syscalls. #6230
  - Released WASM js.FuncOf callbacks in SSH and RDP paths. #5982
  - Fixed possible deadlock in statemanager Stop. #6228
  - Improved Rosenpass support. #6136
  - Recognized NetBird DNS forwarder port in capture text format.
    [#6177]
  - Applied netroute default-gateway workaround on Android. #6192
  - Captured injected ICMPv6 echo replies in debug capture. #6321
  - Gated DNS forwarder on BlockInbound. #6257
  - Persisted sync response via pluggable store, including disk
    support on iOS. #6331
  - Allowed WireGuard port to be zero in UI and showed the port
    in status command. #6158
  - Prevented corruption from competing log rotation and improved
    debug bundle. #6214
  - Management Improvements
  - Fixed owner role update. #6264
  - Refactored management server bootstrap. #6256
  - Updated log levels. #6266
  - Extended nmap monitoring. #6271
  - Added SSO session extend flow. #6197
  - Extended combined server initialization. #6156
  - Enriched context in permissions manager. #6286
  - Exported ResolveDomain. #6334
  - Dashboard Improvements
  - Added simplified dashboard layout. netbirdio/dashboard#649
  - Fixed broken SSH and RDP in the dashboard.
    netbirdio/dashboard#650
  - Moved setup keys to Settings. netbirdio/dashboard#653
  - Improved table filters layout. netbirdio/dashboard#654
  - Grouped Networks and Routes under Network Routing.
    netbirdio/dashboard#660
  - Infrastructure & CI
  - Pinned GitHub Actions with SHA and improved workflows. #6249
  - Added Codecov integration and coverage reporting across
    workflows. #6333
  - Allowed Docker image overrides for getting started. #6335
  - Exposed VCS revision in dev build version output across
    client, management, and misc. #6263

++++ okteto:

  - Update to version 3.20.0:
    * fix(analytics): change customer_id to customer_name in PostHog
    properties (#5031)
    * fix: update vulnerable dependencies and pin base image digests
    (#5028)
    * feat(analytics): add PostHog analytics backend with image_build
    event (#5016)
    * chore(deps): Update module github.com/containerd/containerd/v2
    to v2.2.4 [SECURITY] (#5027)
    * build(deps): bump renovatebot/github-action from 46.1.13 to
    46.1.14 (#5018)
    * build(deps): bump github.com/in-toto/in-toto-golang from 0.9.0
    to 0.11.0 (#5015)
    * chore(deps): Update module sigs.k8s.io/gateway-api to v1.5.1
    (#5014)
    * chore(deps): Update golang-stdlib-extensions (#5010)
    * revert: downgrade github.com/go-git/go-git/v5 to v5.16.5
    (Okteto 3.18 baseline) (#5011)
    * build(deps): bump renovatebot/github-action from 46.1.12 to
    46.1.13 (#5008)
    * chore(deps): Update module github.com/docker/cli to
    v29.4.0+incompatible (#5009)
    * chore(deps): Update module
    github.com/santhosh-tekuri/jsonschema/v6 to v6.0.2 (#5007)
    * build(deps): bump renovatebot/github-action from 46.1.11 to
    46.1.12 (#5005)

++++ ollama:

  - update to 0.30.5:
    * Fix gemma4:12b floating point exception crash
    * llama.cpp version update
    * models: add support for gemma4-12b

++++ ollama:

  - update to 0.30.5:
    * Fix gemma4:12b floating point exception crash
    * llama.cpp version update
    * models: add support for gemma4-12b

++++ os-autoinst:

  - Update to version 5.1780506677.7bacdcd:
    * test: enable pretty serial markers in full-stack test
    * test: replace Core 7.2 ISO with bash-remastered version
    * test: add script to remaster Core ISO with bash
    * feat!: fail by default if always_rollback is not supported
    * fix: Clean up the last VM disks to avoid disk image creation failure
    * fix: script_run - type command and marker together on serial console
    * fix: fail explicitly on test module basename collisions

++++ perl-Sys-Virt:

  - Update to 12.4.0
  - Add all new APIs and constants available in libvirt 12.4.0

++++ plasma-wayland-protocols:

  - Update to 1.21.0
    * Bump version to 1.21.0
    * outputdevice,-management: add abm level setting
    * output device, management: add support for HDR ICC profiles
    * screencast: Add event for pipewire object serial
    * autotests: Make generated protocol files a fixture for build tests
    * Add support for per-output virtual desktops
    * Fix kde_output_device_mode_v2 version
    * Add kde-output-device-registry-v2 interface

++++ pnpm:

  - Update to 11.5.2:
    * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md

++++ python-modern-colorthief:

  - Update to version 0.3.0:
    + Update dependencies

++++ python-azure-appconfiguration:

  - New upstream release
    + Version 1.8.1
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-computelimit:

  - New upstream release
    + Version 1.1.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-containerservice:

  - New upstream release
    + Version 41.3.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-azure-mgmt-imagebuilder:

  - New upstream release
    + Version 2.0.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Adjust upstream source name in spec file
  - Drop extra LICENSE.txt as upstream now ships its own
  - Rename LICENSE.txt to LICENSE in %files section
  - Update Requires from pyproject.toml

++++ python-azure-mgmt-trustedsigning:

  - New upstream release
    + Version 1.0.1
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package
  - Remove temporary version override
  - Update Requires from pyproject.toml

++++ python-ezdxf:

  - Remove source files, so they aren't shipped.

++++ python-pytest-pook:

  - Initial release of 1.0.0.

++++ python-ruff:

  - update to 0.15.16
    * Preview features
    * [flake8-async] Implement yield-in-context-manager-in-async-generator (ASYNC119)
    * [pylint] Narrow diagnostic range and exclude cases without exception handlers (PLW0717)
    * [ruff] Treat yield before break from a terminal loop as terminal (RUF075)
    * Bug fixes
    * [eradicate] Avoid flagging ruff:ignore comments as code (ERA001)
    * [eradicate] Fix ERA001/RUF100 conflict when noqa is on commented-out code
    * [pyflakes] Avoid removing the format call when it would change behavior (F523)
    * [pylint] Avoid syntax errors in invalid character replacements in f-strings before Python 3.12 (PLE2510, PLE2512, PLE2513, PLE2514, PLE2515)
    * [pyupgrade] Avoid converting format calls with more kinds of side effects (UP032)
    * Rule changes
    * [flake8-pytest-style] Avoid fixes for ambiguous argnames and argvalues combinations (PT006)
    * Performance
    * Drop excess capacity from statement suites during parsing
    * Documentation
    * [pydocstyle] Improve discoverability of rules enabled for each convention
    * [ruff] Restore example code for Python versions before 3.15 (RUF017)
    * Fix typo bin/active → bin/activate in tutorial
    * Other changes
    * Shrink additional parser AST collections

++++ rclone:

  - Update to version 1.74.3: (boo#1267869)
  - Bug Fixes
  - rc
  - Fix unauthenticated command execution via --rc-serve inline
    remotes CVE-2026-49980 (Nick Craig-Wood)
  - Stop global.* connection string options changing config
    CVE-2026-49980 (Nick Craig-Wood)
  - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick
    Craig-Wood)
  - CVE-2026-42504: mime: quadratic complexity in
    WordDecoder.DecodeHeader
  - CVE-2026-42507: net/textproto: arbitrary input are included
    in errors without any escaping
  - CVE-2026-27145: crypto/x509: split candidate hostname only
    once
  - log: Fix wrong source file:line in JSON logs from release
    builds (Nick Craig-Wood)
  - mount2: Fix empty directory listings on re-read (Janne Beate
    Bakeng)
  - serve s3: Fix multipart ListParts pagination returning wrong
    part numbers (Nick Craig-Wood)
  - serve sftp
  - Fix file corruption when a client resumes an upload (Nick
    Craig-Wood)
  - Fix truncate request being silently ignored (Nick
    Craig-Wood)
  - Local
  - Fix getXattr returning empty map instead of nil (Leon
    Brocard)
  - Drime
  - Fix server-side copy and move failing with Cloudflare 520
    error (Nick Craig-Wood)
  - Fix files being uploaded to the wrong directory (Nick
    Craig-Wood)
  - Remove duplicate upload_cutoff config option (Nick
    Craig-Wood)
  - Fix directory rename leaving the renamed folder empty in VFS
    (Nick Craig-Wood)
  - Drive
  - Fix server-side move failing on shared drives with duplicate
    dirs (Nick Craig-Wood)
  - Iclouddrive
  - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
  - Fix "Index has invalid data" error listing iCloud Photos
    (Nick Craig-Wood)

++++ rspamd:

  - Update to 4.1.0
  - Incompatible changes
  - mx_check: three-layer Redis cache and finer outcome symbols
    (MX_NONE replaces MX_NXDOMAIN/MX_MISSING)
  - fuzzy_check: discover rspamd.com servers via SRV by default
  - Features
  - Upstreams: load-aware Power of Two Choices selection,
    per-upstream latency EWMA, slow start on revive, per-target
    SRV expansion honouring weights and error budgets, and
    deferred DNS so transient startup failures no longer drop
    upstreams
  - url_redirector: chain-aware cache with intermediate hop
    injection, coherent browser fingerprint profiles for stealth
    resolution, glob-based redirector_hosts_map, and a per-URL
    GET allowlist
  - mx_check: IP-class classification, bad_mxs/bad_ips trust
    maps, and per-source checks
  - Protocol (/checkv3): expose custom metadata via metadata
    headers and task:get_metadata()
  - Composites: hot-reloadable dynamic composites map
  - Lua API: bulk and regexp symbol lookups on task;
    phase-specific (connect/read/write) timeouts and an on_error
    callback for lua_tcp; lua_extras structured loader for custom
    selectors, maps, and regexps with cross-kind dependency
    ordering; and lua_feedback_parsers for DSN and ARF reports
  - Scan timeouts: report pending async events and stalled
    symbols when a scan times out
  - Selectors: add fuzzy_digest, fuzzy_shingles, authenticated,
    and received_count
  - Logging & reporting: ClickHouse named extra_columns presets
    (with an outbound preset) and richer Elastic logs (Reply-To,
    received IPs, URL metadata, forcing module)
  - external_services & scanners: per-service <RULE>_CHECK anchor
    symbol for dependency ordering, plus eXpurgate engine support
    in lua_scanners
  - HTML/HTTP: HTML5 tag definitions (video/audio/picture/svg/…)
    and optional insertion-ordered HTTP header emission
  - Tooling: rspamadm control memstat for per-worker memory dumps
    (RSS, mempool callsites, Lua heap, jemalloc), dmarc_report
  - -batch-wait, and autolearnstats --sort-by/--group
  - Containers & misc: env-overridable baseline pidfile and
    logging, auto-load of the shipped fasttext model when
    present, and fixed-point (%.Nf) formatting with correct
    rounding in fpconv
  - Bug fixes
  - Security hardening (parsers): fix NULL deref on S/MIME with
    empty pkcs7-data, bound S/MIME recursion depth, harden
    RAR/ZIP/7-zip parsers against malformed input, fix OOB reads
    in CSS ident-escape scanning, find_eoh lookahead, bare spf2.
    records, and empty/all-dots URL hosts, reject DNS labels that
    overrun the packet, prevent an HTML entity-decode buffer
    overflow, and add defensive mime_parser guards
  - Security hardening (DoS & deps): bound URL query-scan
    reentrancy on nested query URLs (multipattern), avoid
    uninitialised bytes in rfc2047 decode, guard image linking
    against a NULL decoded header, and port libucl upstream
    security fixes (msgpack, parser bounds, schema)
  - fuzzy_storage: harden network input paths, fix peer-pipe
    partial-write resume and shutdown drain, plug a per-refresh
    leak in dynamic ban inserts and a per-frame leak on
    persistent TCP connections, and stop blocking allowed clients
    on TCP
  - neural: preserve the trained ANN across symbol-list drift and
    symcache-driven profile rotation, and stabilise the profile
    digest under disable_symbols_input while retargeting training
    to the newest profile
  - upstream: refill the token bucket over time so a flapping
    upstream recovers, and avoid an infinite loop in get_random
    when the only candidate is excluded
  - URLs: canonicalise mailto: URIs and bare emails to a
    slash-less form (RFC 6068), keep URLs with long userinfo
    (userinfo-obfuscation phishing), preserve the verbatim href
    as url->raw, and require TLD ≥ 3 chars for word_dot
    naked-domain matches
  - protocol (/checkv3): apply inline metadata.settings and
    populate request headers
  - composites: avoid over-eager second-pass deferral so
    filter-stage composites are visible from postfilters
  - Lua modules: fix a lua_tcp connection leak on read without
    write, resolve the Redis master for rspamadm tools under
    Sentinel, use Queue:new() in elastic, floor the dmarc connect
    timestamp for PUC Lua compatibility, separate the greylisting
    period from the Redis connection timeout, and write rspamadm
    vault output to stdout directly
  - Headers & encoding: emit ARC headers deterministically, map
    DKIM permfail to dkim=permerror in Authentication-Results,
    honour mime_utf8 in the INVALID_MSGID rule, correct lengths
    after in-place mime-header rewrites, keep capture groups that
    follow an empty one in regexp, and skip ICU conversion for
    the synthetic x-binaryenc charset
  - Misc: track all buckets in ratelimit selector rules, warn
    when task_timeout is less than the symcache symbol timeout,
    and use string_view::data() to fix libc++ builds

++++ rtorrent:

  - Update to release 0.16.13
    * Added a new callback mechanism and use it for trackers.
    * Added intermediate requesting flag for trackers to prevent
    premature deletion.
    * Added per-category allocation limits to SocketManager.
    * rpc: close SCGI task on EPIPE to stop event_write() busy-loop.

++++ rubygem-agama-yast:

  - Extend D-Bus API to allow getting the resolvables required by
    storage and bootloader (needed for bsc#1266276).
  - Stop calling to software directly from the D-Bus service.

++++ rumdl:

  - Update to version 0.2.8:
    * Added
  - code-block-tools: add deno fmt as a built-in formatter
    (755b086)
  - junit: report passing files, not just failures (dc8a964)
  - code-block-tools: generate built-in tools docs table from the
    registry (fe9d52c)
    * Fixed
  - code-block-tools: drop rubocop (not usable as a generic
    code-block linter) (fa7fa83)
  - code-block-tools: correct and drop built-ins after verifying
    real binaries (9106da9)
  - code-block-tools: correct shellcheck invocation, drop
    unworkable eslint (415fab0)
  - MD026: make trailing-punctuation removal idempotent (3dfeb83)
  - config: bound project config discovery at the home directory
    (0cdf3b7)
  - tables: use real line terminator for byte offsets in table
    detection (751b158)

++++ selinux-policy:

  - Update to version 20260605:
    * Update dbus_role_template() with communication over unix dgram socket
    * Allow staff user read nsfs files
    * Allow staff user additional sandboxing permissions
    * Dontaudit sa-update perfmon and sys_admin capabilities
    * packit: Stop notifying martinpitt for Cockpit test failures
    * Allow the kernel to execute also special files
    * Bring back execmem permission for svirt_tcg_t
    * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
    * Leave content of virtqemud_use_execmem empty
    * Dontaudit libvirt-daemons execmem
    * Allow virtstoraged to setattr fixed disk devices
    * Dontaudit ksmtuned dac_read_search and dac_override capabilities
    * Remove unused hypervkvp_unit_file_t
    * Allow mock create and use its private tmpfs files
    * Allow samba-bgqd send to nmbd over a unix datagram socket
    * Vibecode Gitlab CI smoke test for Leap 16.0+
  - Syncing with upstream rawhide selinux-policy up to:
    * 443befa43872b63a5c1d7773fca159fda2abf772
  - Update embedded container-selinux version to commit:
    * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)

++++ sqlite-jdbc:

  - Update to v3.53.2.0
    * Features
    ~ sqlite
    + upgrade to sqlite 3.53.2 (3e1dabf)
    * Build
    ~ deps
    + bump org.graalvm.buildtools:native-maven-plugin (d24c1cc)
    + bump org.graalvm.buildtools:native-maven-plugin (751989a)
    + bump org.graalvm.sdk:nativeimage from 25.0.2 to 25.0.3
    (cc3e1a5)
    + bump shanegenschaw/pull-request-comment-trigger (cc93aa7)
    ~ deps-dev
    + bump surefire.version from 3.5.5 to 3.5.6 (3c29706)
    + bump org.apache.maven.plugins:maven-enforcer-plugin
    (8a20a64)
    ~ unscoped
    + fail workflow if child workflow also fails (49ea263)
    + remove PR comment trigger (03bfd9a)
  - Update to v3.53.1.0
    * Features
    ~ sqlite
    + upgrade to sqlite 3.53.1 (8263322)
    * Changes
    ~ rewrite amalgamation_version.sh for POSIX shell (52522d0)
    ~ fix android usage (7ef8e0f)
    * Build
    ~ deps
    + bump gummy-bears-api-24 to 0.14.0 (a28d6ce)
    + bump gummy-bears-api-24 to 0.13.0 (248e1e9)
    ~ deps-dev
    + bump org.jreleaser:jreleaser-maven-plugin (396fdf3)
    + bump com.tngtech.archunit:archunit-junit5 (458abe1)
    ~ unscoped
    + conditionally bootstrap SLF4J API JAR (bc7d223)
    + make JAVA_CLASSPATH configurable (5aa7426)

++++ stackit-cli:

  - Update to version 0.64.0:
    * feat(object-storage): fix credentials create nil pointer
    (#1430)
    * chore(sqlserverflex): migrate to multiversion sdk
    * chore(resourcemanager): migrate to multi version SDK (#1427)
    * chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to
    7.2.2 (#1420)
    * chore(deps): bump actions/stale from 10 to 10.2.0 (#1419)
    * fix(iaas): print valid JSON/YAML output for list cmds (#1365)
    * Extended installation instructions for mise. (#1408)
    * chore(alb): migrate to new SDK structure (#1415)
    * fix(fs): use new OsFS instead of os.DirFS during execution
    (#1416)
    * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.10 (#1411)
    * fix(postgresflex): use correct prefix for get user error
    message (#1409)

++++ velociraptor-client:

  - Update to version 0.7.0.4.git185.a5708584:
    * Update golang dependencies
    Fixes CVE-2026-34986 (bsc#1262841)
    Fixes CVE-2026-1229 (bsc#1265479)
    Fixes CVE-2026-33814 (bsc#1265650)
    Fixes CVE-2026-39827 (bsc#1266059)
    Fixes CVE-2026-39834 (bsc#1266059)
    Fixes CVE-2026-39828 (bsc#1266059)
    Fixes CVE-2026-39829 (bsc#1266059)
    Fixes CVE-2026-39831 (bsc#1266059)
    Fixes CVE-2026-42508 (bsc#1266059)
    Fixes CVE-2026-39833 (bsc#1266059)
    Fixes CVE-2026-39830 (bsc#1266059)
    Fixes CVE-2026-39832 (bsc#1266059)
    Fixes CVE-2026-46597 (bsc#1266059)
    Fixes CVE-2026-46598 (bsc#1266059)
    Fixes CVE-2026-46595 (bsc#1266059)
    Fixes CVE-2026-39835 (bsc#1266059)
    Fixes CVE-2026-39821 (bsc#1266489)
    Fixes CVE-2026-33487
    Fixes CVE-2026-25680 (bsc#1267056)
    Fixes CVE-2026-42502 (bsc#1267056)
    Fixes CVE-2026-27136 (bsc#1267056)
    Fixes CVE-2026-25681 (bsc#1267056)
    Fixes CVE-2026-42506 (bsc#1267056)
    Fixes CVE-2026-33487 (bsc#1267056)
    * Update npm packages
    Fixes CVE-2025-27152 (bsc#1239305)
    Fixes CVE-2026-25128 (bsc#1257518)
    Fixes CVE-2026-26278 (bsc#1258550)
    Fixes CVE-2026-33036 (bsc#1259978)
    Fixes CVE-2025-5889 (bsc#1244349)
    Fixes CVE-2025-6547 (bsc#1245281)
    Fixes CVE-2025-6545 (bsc#1245282)
    Fixes CVE-2025-7783 (bsc#1246811)
    Fixes CVE-2025-64718 (bsc#1255429)
    Fixes CVE-2025-13465 (bsc#1257322)
    Fixes CVE-2026-26996 (bsc#1258626)
    Fixes CVE-2026-27904 (bsc#1259007)
    Fixes CVE-2026-2739 (bsc#1258648)
    Fixes CVE-2026-27606 (bsc#1258877)
    Fixes CVE-2026-42039 (bsc#1267407)
    * Update google.golang.org/grpc to 1.79.3
    Fixes CVE-2026-33186 (bsc#1260088)
    * github-actions: remove failing Windows workflow
    * Update github.com/ulikunitz/xz
    Fixes CVE-2025-58058 (bsc#1248903)
    * Update github.com/golang/glog
    Fixes CVE-2024-45339 (bsc#1236562)
    * Update github.com/gorilla/csrf v1.6.2 => v1.7.3
    Fixes CVE-2025-24358 (bsc#1241233, bsc#1241236)
    * Update golang.org/x/oauth2 v0.13.0 => v0.27.0
    Fixes CVE-2025-22868 (bsc#1239201, bsc#1239234)
    * Fix go vet non-constant format string from go1.24
    * Fix TestHTTPComms failures from go1.24+
    * Update golang.org/x/net to v0.45.0
    Fixes CVE-2023-45288 (bsc#1236506)
    Fixes CVE-2025-22869 (bsc#1239326, bsc#1239358)
    Fixes CVE-2025-22870 (bsc#1238678)
    Fixes CVE-2025-22872 (bsc#1241713)
    Fixes CVE-2025-47911 (bsc#1251346)
    Fixes CVE-2025-58181 (bsc#1253788)
    Fixes CVE-2025-58190 (bsc#1251537)
    * Fix symbol not found errors from SUSE.Linux.Events.Services

++++ tali:

  - Update to version 40.9+8:
    + data: Rename appdata to metainfo
    + Updated translations.
  - Add desktop-file-utils BuildRequires and check section with
    meson_test macro, validate desktop file during build.

++++ velociraptor:

  - Update to version 0.7.0.4.git185.a5708584:
    * Update golang dependencies
    Fixes CVE-2026-34986 (bsc#1262841)
    Fixes CVE-2026-1229 (bsc#1265479)
    Fixes CVE-2026-33814 (bsc#1265650)
    Fixes CVE-2026-39827 (bsc#1266059)
    Fixes CVE-2026-39834 (bsc#1266059)
    Fixes CVE-2026-39828 (bsc#1266059)
    Fixes CVE-2026-39829 (bsc#1266059)
    Fixes CVE-2026-39831 (bsc#1266059)
    Fixes CVE-2026-42508 (bsc#1266059)
    Fixes CVE-2026-39833 (bsc#1266059)
    Fixes CVE-2026-39830 (bsc#1266059)
    Fixes CVE-2026-39832 (bsc#1266059)
    Fixes CVE-2026-46597 (bsc#1266059)
    Fixes CVE-2026-46598 (bsc#1266059)
    Fixes CVE-2026-46595 (bsc#1266059)
    Fixes CVE-2026-39835 (bsc#1266059)
    Fixes CVE-2026-39821 (bsc#1266489)
    Fixes CVE-2026-33487
    Fixes CVE-2026-25680 (bsc#1267056)
    Fixes CVE-2026-42502 (bsc#1267056)
    Fixes CVE-2026-27136 (bsc#1267056)
    Fixes CVE-2026-25681 (bsc#1267056)
    Fixes CVE-2026-42506 (bsc#1267056)
    Fixes CVE-2026-33487 (bsc#1267056)
    * Update npm packages
    Fixes CVE-2025-27152 (bsc#1239305)
    Fixes CVE-2026-25128 (bsc#1257518)
    Fixes CVE-2026-26278 (bsc#1258550)
    Fixes CVE-2026-33036 (bsc#1259978)
    Fixes CVE-2025-5889 (bsc#1244349)
    Fixes CVE-2025-6547 (bsc#1245281)
    Fixes CVE-2025-6545 (bsc#1245282)
    Fixes CVE-2025-7783 (bsc#1246811)
    Fixes CVE-2025-64718 (bsc#1255429)
    Fixes CVE-2025-13465 (bsc#1257322)
    Fixes CVE-2026-26996 (bsc#1258626)
    Fixes CVE-2026-27904 (bsc#1259007)
    Fixes CVE-2026-2739 (bsc#1258648)
    Fixes CVE-2026-27606 (bsc#1258877)
    Fixes CVE-2026-42039 (bsc#1267407)
    * Update google.golang.org/grpc to 1.79.3
    Fixes CVE-2026-33186 (bsc#1260088)
    * github-actions: remove failing Windows workflow
    * Update github.com/ulikunitz/xz
    Fixes CVE-2025-58058 (bsc#1248903)
    * Update github.com/golang/glog
    Fixes CVE-2024-45339 (bsc#1236562)
    * Update github.com/gorilla/csrf v1.6.2 => v1.7.3
    Fixes CVE-2025-24358 (bsc#1241233, bsc#1241236)
    * Update golang.org/x/oauth2 v0.13.0 => v0.27.0
    Fixes CVE-2025-22868 (bsc#1239201, bsc#1239234)
    * Fix go vet non-constant format string from go1.24
    * Fix TestHTTPComms failures from go1.24+
    * Update golang.org/x/net to v0.45.0
    Fixes CVE-2023-45288 (bsc#1236506)
    Fixes CVE-2025-22869 (bsc#1239326, bsc#1239358)
    Fixes CVE-2025-22870 (bsc#1238678)
    Fixes CVE-2025-22872 (bsc#1241713)
    Fixes CVE-2025-47911 (bsc#1251346)
    Fixes CVE-2025-58181 (bsc#1253788)
    Fixes CVE-2025-58190 (bsc#1251537)
    * Fix symbol not found errors from SUSE.Linux.Events.Services

------------------------------------------------------------------
------------------  2026-6-4  -  Jun 4 2026  -------------------
------------------------------------------------------------------

++++ webkitgtk3:

  - Update to version 2.52.4 (bsc#1267506 bsc#1267507 bsc#1267508
    bsc#1267509 bsc#1267510 bsc#1267511 bsc#1267512 bsc#1267513
    bsc#1267514 bsc#1267515 bsc#1267516 bsc#1267517 bsc#1267518
    bsc#1267519 bsc#1267520 bsc#1267521):
    + Add support for half-width fonts.
    + Improve content filter compilation by avoiding file copies.
    + Improve handling of out of disk space conditions when the
    NetworkProcess tried to write data in caches.
    + Improve how the CMake build system checks whether libatomic is
    required.
    + Fix painting scrollbars when their width changes.
    + Fix playback of certain YouTube videos with low frame rates.
    + Fix webkit://gpu not working in systems where neither
    libGL.so.1 nor libOpenGL.so.0 are available.
    + Fix the build with librice 0.4 or newer when the GStreamer
    WebRTC backend is enabled at build configuration time.
    + Fix the build with USE_GSTREAMER_WEBRTC=OFF.
    + Fix the build with USE_GBM=OFF.
    + Fix several crashes and rendering issues.
    + Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
    CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
    CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
    CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
    CVe-2026-43660.
  - Drop webkit2gtk3-aarch64-build-fix.patch: fixed upstream.
  - Add webkitgtk-ppc64le-build-fix.patch: fix the build when system
    malloc is enabled.

++++ webkitgtk4:

  - Update to version 2.52.4 (bsc#1267506 bsc#1267507 bsc#1267508
    bsc#1267509 bsc#1267510 bsc#1267511 bsc#1267512 bsc#1267513
    bsc#1267514 bsc#1267515 bsc#1267516 bsc#1267517 bsc#1267518
    bsc#1267519 bsc#1267520 bsc#1267521):
    + Add support for half-width fonts.
    + Improve content filter compilation by avoiding file copies.
    + Improve handling of out of disk space conditions when the
    NetworkProcess tried to write data in caches.
    + Improve how the CMake build system checks whether libatomic is
    required.
    + Fix painting scrollbars when their width changes.
    + Fix playback of certain YouTube videos with low frame rates.
    + Fix webkit://gpu not working in systems where neither
    libGL.so.1 nor libOpenGL.so.0 are available.
    + Fix the build with librice 0.4 or newer when the GStreamer
    WebRTC backend is enabled at build configuration time.
    + Fix the build with USE_GSTREAMER_WEBRTC=OFF.
    + Fix the build with USE_GBM=OFF.
    + Fix several crashes and rendering issues.
    + Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
    CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
    CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
    CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
    CVe-2026-43660.
  - Drop webkit2gtk3-aarch64-build-fix.patch: fixed upstream.
  - Add webkitgtk-ppc64le-build-fix.patch: fix the build when system
    malloc is enabled.

++++ accessibility-inspector:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ agama:

  - Wait until all pending tasks are finished before starting the installation
    (bsc#1266276).

++++ agama-web-ui:

  - Improve the installation settings UI by showing and explaining the
    current configuration before downloading it
    (gh#agama-project/agama#3581).
  - Provide user feedback when collecting and downloading installer logs
    from the web UI (gh#agama-project/agama#3580).
  - Block a page until all its tasks are completed (part of
    bsc#1266276).

++++ akonadi:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ akonadi-calendar:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ akonadi-calendar-tools:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * konsolekalendar.cpp - fix viewing a date range (kde#520686)
    * konsolekalendar/main.cpp - fix the --create command line parsing (kde#450299)

++++ akonadi-contacts:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ akonadi-import-wizard:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ akonadi-mime:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ akonadi-search:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Skip tests that got broken with the recent FreeBSD CI image update
    * Adapt to KMime having moved to Frameworks

++++ akonadiconsole:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ akregator:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Backport to 26.04: metakit: define q4_LONG64 on arm64 (fixes hang on launch)

++++ alligator:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ analitza:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ angelfish:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix kcfg file

++++ ansible-sap-infrastructure:

  - 1.4.0
  - Minor Changes:
  - sap_vm_provision - Rework role with best practices to align with project
  - sap_vm_provision - Update ibmcloud PowerVS image dictionaries
  - sap_vm_provision - Add MS Azure disclaimer about reliability of azure collection
  - sap_vm_temp_vip - Refactor variables and improve logic for skipping hosts
  - Bugfixes:
  - sap_vm_provision - Fix deprecated network parameter for amazon.aws.ec2_instance
  - sap_vm_provision - Fix adding /etc/hosts for all in play not just itself
  - sap_vm_temp_vip - Fix NoneType broadcast variable

++++ ansible-sap-install:

  - 1.9.2:
  - Bugfixes:
  - sap_ha_pacemaker_cluster - Fix issue 1203 sudo dash
  - sap_storage_setup - Add option to mount generic NFS mounts
  - sap_swpm - Remove ansible.posix dependency
  - 1.9.1:
  - Bugfixes:
  - sap_general_preconfigure - Ansible 2.24 compatibility
  - sap_ha_pacemaker_cluster - Ansible 2.24 compatibility
  - sap_hana_preconfigure - Ansible 2.24 compatibility
  - sap_hana_preconfigure/RHEL - Correctly set tsx in all cases
  - sap_maintain_etc_hosts, sap_hana_install, sap_install_media_detect - Ansible 2.24 compatibility
  - sap_netweaver_preconfigure - Ansible 2.24 compatibility
  - sap_storage_setup, sap_hostagent, anydb - Ansible 2.24 compatibility

++++ ansible-sap-launchpad:

  - 1.3.2
  - Bugfixes:
  - all - Replace inject vars with ansible_facts for 2.20

++++ ansible-sap-playbooks:

  - 1.4.0
  - Minor Changes:
  - collection: Add MS Azure disclaimer about reliability of azure collection
  - all: Fix all linting errors and update facts for 2.20
  - all: Refactor product dictionary to reuse same contents when possible
  - all: Update ibmcloud image dictionaries
  - all: Add S4HANA and S4HANA FND 2025 software lists
  - hana: Update SAP HANA versions and add throttle for rsync
  - ibmcloud_powervs: Update variables for better clarity

++++ apache2-mod_php8:

  - version update to 8.5.7
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
    Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
    DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
    Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
    OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
    Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
    URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) [bsc#1264578]
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) [bsc#1264579]
  - remove deprected --enable-inline-optimization

++++ arianna:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ark:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ artikulate:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ audex:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ audiotube:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Handle no formats being found
    * Add video url fallback
    * Explicitly search for Python to fix compilation with ECM 6.26
  - Drop patch:
    * workaround_pybind11_bug.patch

++++ aws-crt-cpp:

  - Update to version 0.39.1
    * Bump crt by @TingDaoK in (#857)
    * Add TlsConnectionOptions param to profile credentials provider
    configuration by @sbiscigl in (#853)
  - from version 0.39.0
    * Keep reference to proxy strategy options on connection
    by @DmitriyMusatkin in (#852)

++++ azure-cli:

  - New upstream release
    + Version 2.87.0
    + For detailed information about changes see the
    HISTORY.rst file provided with this package
  - Update Requires from setup.py

++++ azure-cli-core:

  - New upstream release
    + Version 2.87.0
    + For detailed information about changes see the
    HISTORY.rst file provided with this package
  - Update Requires from setup.py

++++ baloo-widgets:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ blinken:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ bomber:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ bovo:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ mongo-c-driver:

  - Update to version 2.3.1
    libbson
    Fixes
    * Fix length check in bson_new_from_buffer.
    * Fix documentation generation on Sphinx 9.0+.
    libmongoc
    Improvements
    * Improve forward compatibility with OpenSSL 4.0.0 when handling
    EAGAIN errors in old-style read callbacks where
    BIO_FLAGS_AUTO_EOF is enabled.
    * Improve decompressed message length constraints.
    Fixes
    * Fix documentation generation on Sphinx 9.0+.
    * Propagate username to custom OIDC callback.

++++ calendarsupport:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ calindori:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ cantor:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ clpeak:

  - Update to version 2.0.10:
    * Add ROCm / HIP backend
    Full AMD GPU backend using the HIP runtime. Includes the.
    complete benchmark suite as it becomes available on each GPU.
    family:
    + Compute throughput — FP64/FP32/FP16/BF16/INT32 vector kernels
    with vector-width ILP variants.
    + INT8 DP4a — sudot4 instruction on CDNA3 / RDNA3-4.
    + Raw MFMA matrix-core peak — FP16, BF16, INT8, FP8 (CDNA
    architectures).
    + 2:4 structured-sparse MFMA (smfmac) — FP16, BF16, FP8.
    + FP4 matrix-core (MXFP4) — Instinct MI300+.
    + Native WMMA peak — RDNA3/4, covering FP16, BF16,
    FP8 E4M3/E5M2.
    + rocBLAS — FP16, BF16, FP8 GEMM.
    + hipBLASLt — FP8 GEMM.
    + Memory bandwidth — global, local, host-device transfer.
    * Add oneAPI / SYCL backend
    Intel GPU backend compiled with icpx -fsycl. Requires the
    Intel oneAPI Base Toolkit.
    + Compute throughput — FP64/FP32/FP16/BF16/INT32/INT8 vector
    kernels with vector-width sweeps.
    + joint_matrix peak — device-queried shapes, VNNI B layout,
    TF32; per-device capability diagnostics.
    + oneMKL GEMM — FP16, BF16, FP32 (where supported).
    + Memory bandwidth.
    + Falls back to CPU/accelerator device when no GPU is visible.
    * New Benchmarks (CUDA)
    + NVFP4 matrix-core — mma FP4 benchmarks for Ada/Hopper.
    + FP4 2:4 sparse mma.sp — Blackwell (SM 12.0+), with corrected
    .scale_vec::4X selectors.
    * CLI Changes
    + --verbose - Print backend debug logs: kernel build logs,
    API errors, and library exceptions that are suppressed by
    default.
    * Device selection: now accepts comma-separated index lists.
    * Removed flags
    + --cl-platform-name <str>
    OpenCL platform name matching removed; use --cl-platform
    <index>.
    + --cl-device-name <str>
    OpenCL device name matching removed; use --cl-device <index>
    + --int4-packed-compute / --no-int4-packed-compute.
    Emulated INT4 benchmark removed.

++++ colord-kde:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ cppcheck:

  - update to version 2.21.0
    * funcArgNamesDifferentUnnamed warns on function declarations/
    definitions where a parameter in either location is unnamed
    * uninitMemberVarNoCtor warns on user-defined types where (1)
    some but not all members requiring initialization have in-class
    initializers or (2) there is a mixture of members which do/
    do not require initialization.
    * fcloseInLoopCondition warns when fclose() is used as a while
    loop condition, which may skip the loop body or double-close
    the file handle.
    * import project: include path in compile_commands.json now
    handled correctly

++++ crmsh:

  - Update to version 5.1.0+20260604.45e70fd3:
    * Refactor: crash_test: Use log filters to control output instead of removing handlers
    * Refactor: log: replace crmsh.log.setup_logger with logging.setupLogger
    * Dev: log: Use filters to control handler output and simplify logger setup
    * Dev: corosync_config_format: lower the level of debug logs from tokenizer to DEBUG2
    * Refactor: log: Decouple logging from config module

++++ ctlptl:

  - Update to version 0.9.4:
    * vendor: update to kind 1.32 (#416)
    * vendor: update to k8s 1.36 (#411)
    * Update version numbers: 0.9.3

++++ dolphin:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * KItemListWidget: Add pressedChanged (kde#508329)
    * tests: kfileitemmodeltest avoid scheme-less url
    * dolphintabpage: drop swapActiveView in RightView close path (kde#520002)
    * userfeedback: prevent dangling pointer access in SettingsDataSource (kde#519876)

++++ dolphin-plugins:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ domtrip:

  - Update to upstream version 1.5.2
    * This version makes addBlankLineBefore() and addBlankLineAfter()
    idempotent, preventing double blank lines when inserting
    elements into positions that already have visual separation.
  - Modified patch:
    * domtrip-ant-build-system.patch
    + Adapt to the version change

++++ dragonplayer:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ drm_info:

  - Update to 2.10.0
    * Add support for non-KMS devices
    * Indicate failure when none of the explicit devices yield info
    * Indicate failure when failing to read info from all devices
    * fourcc.py: Deduplicate DRM_FORMAT entries
    * Print color ops and pipelines
    * Map kms colorops and props as JSON
    * Add client cap for plane color pipeline
    * Fix early return for zero TILE property
    * Add support for TILE property
    * Expose client caps again
    * Pretty-print EDID make/model/serial via libdisplay-info
    * Unconditionally set HAVE_LIBPCI
    * Use faux bus info from drmDevice
    * Fix conflicting variables with libpci and faux bus
    * Print device bus information
    * Add faux bus to JSON schema
    * Encode EDIDs as base64
    * Add JSON schema
    * Add support for faux bus
    * Add support for the IN_FORMATS_ASYNC property
    * Add support for MediaTek format modifiers
    * Add support for Apple format modifiers
    * readme: make usage list more readable
    * readme: make --wrap-mode=nofallback paragraph more generic
    * build: bump minimum libdrm version to 2.4.104
    * readme: add link to GitLab repo, use references
    * readme: drop CI badge
    * json: fix trailing NUL byte in PATH data field
  - clean up .spec file

++++ edk2-Shell:

  - Add edk2-gcc16.patch to fix the broken build with GCC 16

++++ elisa:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ elixir:

  - Add 003-skip-tests-daemon-mode-source.patch:
    * Skip some testsi (daemon-mode release, source tests) that are failing in the build env
  - Upgrade to Elixir 1.20.0:
    * Changelog available at https://hexdocs.pm/elixir/1.20.0/changelog.html

++++ eventviews:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * monthview.cpp - MonthView::holiday() - dedupe the holidays list
    * Adapt to KMime having moved to Frameworks

++++ falkon:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ffmpegthumbs:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ filelight:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ flare:

  - Update to 1.15
    * https://github.com/flareteam/flare-game/releases/tag/v1.15
  - Update to 1.15
    * https://github.com/flareteam/flare-game/releases/tag/v1.15

++++ kiten:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ four-in-a-row:

  - Update to version 3.38.1+62:
    + data: Rename appdata to metainfo
    + Validate metainfo data with appstreamcli
    + docs: Remove reference to "default" theme
    + Updated translations.
  - Switch to source service for tarball.
  - Add AppStream and desktop-file-utils BuildRequires and add check
    section with meson_test macro, run tests during build.

++++ francis:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ gemrb:

  - Update to 0.9.5
    * New features:
    + partial audio system rewrite for better (spatial) audio
    and music
    + iwd2: customizable action bar, weapon set switching, item
    usability info
    + detect illusions, spell info on right-click, various
    hardcoded pst bonuses
    + smooth keyboard scrolling, in-game zoom
    + GUI enhancements are now configurable from within the game
    * Improved features:
    + pathfinder and drawing speedups
    + video players, animations, controller input
    + iwd2 weapon sets, pst GUI, pst level up, ee compatibility
    + scripting, effects, projectiles
    + bugfixes

++++ llamacpp:

  - Split libllama-common into its own package
  - Update to version 9500:
    * Added broader model support, including DeepSeek v3.2,
    DeepSeekOCR 2, EXAONE 4.5, Gemma 4 variants, Mellum,
    Step3.7-Flash, and Granite multilingual embeddings R2.
    * Improved multimodal inference with expanded OCR, audio, and
    vision handling, including Gemma 4 unified fixes,
    DeepSeek-OCR updates, Hunyuan OCR consolidation, granite-speech,
    and MiniCPM-V 4.6 support.
    * Enhanced CUDA and HIP acceleration with Hopper PDL support,
    quantized KV-cache handling, AMD MFMA routing improvements,
    Blackwell and NVFP4-related work, and faster walsh-hadamard
    transforms.
    * Extended Vulkan, OpenCL, SYCL, Metal, and WebGPU backends with
    new operators, BF16/Flash Attention improvements, reduced
    contention, broader quantization support, and better Intel,
    AMD, and Adreno tuning.
    * Improved CPU and GGML internals with additional RISC-V RVV/SVE
    optimizations, SpacemiT support, faster quantization helpers,
    tensor access improvements, and a ggml bump to 0.13.1.
    * Expanded server and API support with Vertex AI compatibility,
    ETag handling, `/models?reload=1`, SSE improvements, real-time
    reasoning interruption, better checkpoint handling, and audio
    transcription updates.
    * Included important stability and security fixes, notably the
    fix for server heap-buffer-overflow CVE-2026-21869, along with
    multiple correctness fixes across speculative decoding,
    multimodal processing, KV-cache handling, and router mode.
    * Updated the application and tooling stack with the new unified
    `llama` executable, additional benchmarking and quantization
    tools, conversion updates, `gguf-py` 0.19.0, newer BoringSSL,
    and refreshed `cpp-httplib`.
    * Full commit log:
    https://github.com/ggml-org/llama.cpp/compare/b8814...b9500

++++ ghc-pandoc:

  - Update pandoc to version 3.10.
    Upstream has edited the change log file since the last release in
    a non-trivial way, i.e. they did more than just add a new entry
    at the top. You can review the file at:
    http://hackage.haskell.org/package/pandoc-3.10/src/changelog.md

++++ ghc-pandoc-lua-engine:

  - Update pandoc-lua-engine to version 0.5.3.
    Upstream does not provide a change log file.

++++ ghc-pandoc-server:

  - Update pandoc-server to version 0.1.3.
    Upstream does not provide a change log file.

++++ ghostwriter:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ go1.21:

  - Packaging: Enable libalternatives for SLE16.1 and Tumbleweed
    Refs boo#1245878
    * Drop go1.21 dependency on update-alternatives fixes bsc#1264390

++++ go1.22:

  - Packaging: Enable libalternatives for SLE16.1 and Tumbleweed
    Refs boo#1245878
    * Drop go1.22 dependency on update-alternatives fixes bsc#1264391

++++ go1.23:

  - Packaging: Enable libalternatives for SLE16.1 and Tumbleweed
    Refs boo#1245878
    * Drop go1.23 dependency on update-alternatives fixes bsc#1264392

++++ go1.24:

  - Packaging: Enable libalternatives for SLE16.1 and Tumbleweed
    Refs boo#1245878
    * Drop go1.24 dependency on update-alternatives fixes bsc#1264393

++++ go1.25:

  - Packaging: Enable libalternatives for SLE16.1 and Tumbleweed
    Refs boo#1245878
    * Drop go1.25 dependency on update-alternatives fixes bsc#1264394

++++ go1.26:

  - Packaging: Enable libalternatives for SLE16.1 and Tumbleweed
    Refs boo#1245878
    * Drop go1.26 dependency on update-alternatives fixes bsc#1264395

++++ granatier:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ grant:

  - Update to version 0.6.6 (.5 was not released):
    * update to dockers_v2 for goreleaser (#519)
    * chore(deps): update anchore dependencies (#513)
    * Pass 'contents: read' to check-gate workflow (#516)
    * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
    * chore(deps): update anchore dependencies (#505)
    * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
    * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
    * chore(deps): bump github.com/containerd/containerd/v2 (#510)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
    * chore(deps): bump golang.org/x/term (#507)
    * remove release notification (#508)
    * Port to go-make (#506)
    * chore(deps): update anchore dependencies (#503)
    * chore(deps): update anchore dependencies (#485)
    * chore(deps): update tool versions (#495)
    * use released shared workflow (#502)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
    * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
    * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
    * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
    * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
    * chore(deps): update tool versions (#493)
    * chore(deps): bump github.com/anchore/syft (#494)
    * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
    * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
    * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
    * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
    * chore: remove common workflows (#492)
    * chore(deps): update tool versions (#488)
    * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
    * chore(deps): update anchore dependencies (#480)
    * chore(deps): update tool versions (#482)
    * restore go minimum version to 1.25.8 (#481)
    * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
    * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
    * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
    * chore(deps): update anchore dependencies (#469)
    * chore(deps): update tool versions (#470)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
    * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
    * chore(deps): update tools to latest versions (#451)
    * chore(deps): update tool versions (#452)
    * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
    * chore(deps): update Go version (#468)
    * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
    * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
    * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
    * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
    * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
    * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
    * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
    * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
    * chore: update zizmor workflow triggers (#456)
    * chore: add security-events write permission for zizmor (#455)
    * (chore): removing automations (#453)
    * chore(deps): update tools to latest versions (#445)
    * chore(deps): update anchore dependencies (#447)
    * chore(deps): update tool versions (#444)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
    * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
    * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
    * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
    * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
    * chore(deps): pin certain go dependencies (#438)
    * fix: --dry-run status code correction (#398)
    * chore(deps): update tools to latest versions (#434)
    * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
    * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)

++++ grantlee-editor:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ grantleetheme:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ grype:

  - Update to version 0.113.0:
    * Added Features
  - Include Ubuntu 26.04 "resolute" in distro codenames [#3397
    @anchore-oss-update-bot]
  - source RPM filtering on Hummingbird [#3410 @willmurphyscode]
    * Bug Fixes
  - use relatedVulnerabilities description as fallback in SARIF
    output [#3271 @axidex]
  - improve platform CPE determination logic [#3470
    @westonsteimel]
  - normalize uppercase V in semantic version comparison [#3461
    @immanuwell]
  - purl handling in cgr maven libs [#3420 @willmurphyscode]
  - Treat uppercase V prefixes the same as lowercase v prefixes
    in fuzzy version comparison [#3037 #3089 @wasup-yash]
  - Add Runtime Warnings When TLS Verification Is Disabled or
    HTTP Is Enabled [#3101 #3396 @Dashtid]
  - Add support for the aarch64 architecture when parsing the
    version of Ruby gems in lockfiles [#3442 #3475 @msnandhis]
  - zsh completion fails [#2933 #3433 @brandtkeller]
    * Dependencies
  - chore(deps): bump github.com/containerd/containerd/v2 (#3457)
  - chore(deps): bump github.com/containerd/containerd/v2 (#3483)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#3438)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#3454)
  - chore(deps): bump github.com/invopop/jsonschema (#3408)
  - chore(deps): bump the actions-minor-patch group across 1
    directory with 2 updates (#3431)
  - chore(deps): bump the actions-minor-patch group across 1
    directory with 2 updates (#3444)
  - chore(deps): bump the actions-minor-patch group across 1
    directory with 4 updates (#3449)
  - chore(deps): bump the actions-minor-patch group across 1
    directory with 7 updates (#3471)
  - chore(deps): bump the actions-minor-patch group across 2
    directories with 3 updates (#3458)
  - chore(deps): bump the actions-minor-patch group across 2
    directories with 4 updates (#3409)
  - chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#3448)
  - chore(deps): bump the go-minor-patch group across 2
    directories with 4 updates (#3473)
  - chore(deps): bump the go-minor-patch group with 3 updates
    (#3430)
  - chore(deps): update anchore dependencies (#3412)
  - chore(deps): update generated codename data (#3397)
  - chore(deps): update quality gate database (#3407)
  - chore(deps): update tool versions (#3335)

++++ grype-db:

  - Update to version 0.53.4:
    * Bug Fixes
  - delete existing on-disk grype-db cache during restore [#1020
    @westonsteimel]
    * Additional Changes
  - longer timeout for multicore provider data syncs [#1011
    @willmurphyscode]
    * Dependencies
  - chore(deps): Bump cryptography from 46.0.5 to 46.0.7 (#1003)
  - chore(deps): Bump github.com/containerd/containerd/v2 (#1014)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#1002)
  - chore(deps): Bump github.com/gookit/color in the
    go-minor-patch group (#1005)
  - chore(deps): Bump github.com/klauspost/compress (#997)
  - chore(deps): Bump gitpython from 3.1.44 to 3.1.49 (#996)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 2 updates (#1006)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 2 updates (#999)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 3 updates (#1021)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 4 updates (#1015)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 4 updates (#1022)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 4 updates (#991)
  - chore(deps): Bump the actions-minor-patch group across 1
    directory with 5 updates (#1016)
  - chore(deps): Bump the actions-minor-patch group across 2
    directories with 5 updates (#992)
  - chore(deps): Bump the actions-minor-patch group with 3
    updates (#998)
  - chore(deps): Bump urllib3 from 2.6.3 to 2.7.0 (#1012)
  - chore(deps): update anchore dependencies (#993)
  - chore(deps): update tool versions (#985)
  - chore(deps-dev): Bump mypy from 1.20.2 to 2.0.0 (#1008)
  - chore(deps-dev): Bump types-requests (#1007)
  - chore(deps-dev): Bump types-requests (#1018)
  - chore(deps-dev): Bump types-requests (#1023)
  - chore(deps-dev): Update coverage[toml] requirement (#1017)
  - Update to version 0.53.3:
    * chore(deps): update anchore dependencies (#986)
    * bump to grype@main (#989)

++++ gwenview:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ incidenceeditor:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * incidencedatetime.cpp - consider allday setting when validating
    * Adapt to KMime having moved to Frameworks

++++ itinerary:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Add 26.04.2 release notes
    * Adapt notification icons to behavior changes in KF 6.27
    * Add 26.04.1 release notes

++++ java-11-openj9:

  - Make post scripts less noisy (bsc#1267355)

++++ java-11-openjdk:

  - Make post scripts less noisy (bsc#1267355)

++++ java-17-openj9:

  - Make post scripts less noisy (bsc#1267355)

++++ java-17-openjdk:

  - Make post scripts less noisy (bsc#1267355)

++++ java-1_8_0-openj9:

  - Make post scripts less noisy (bsc#1267355)

++++ java-1_8_0-openjdk:

  - Make post scripts less noisy (bsc#1267355)

++++ java-21-openj9:

  - Make post scripts less noisy (bsc#1267355)

++++ java-21-openjdk:

  - Make post scripts less noisy (bsc#1267355)

++++ java-25-openj9:

  - Make post scripts less noisy (bsc#1267355)

++++ java-25-openjdk:

  - Make post scripts less noisy (bsc#1267355)

++++ java-26-openjdk:

  - Make post scripts less noisy (bsc#1267355)

++++ jfrog-cli:

  - Update to version 2.107.0:
    * New Features
  - [jfrog-cli-artifactory] RTECO-1079 - Implement search for
    plugins #474 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1079 - Add prompt to install &
    update for version #475 (@udaykb2)
    * Bug Fixes
  - [jfrog-cli] RTECO-1352 - Fix jf setup docker login when using
  - -url #3517 (@Edenb2131)
  - [jfrog-cli-artifactory] Fix - Change GOPROXY #477 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1352 - Fix jf setup docker
    login when using --url #460 (@Edenb2131)
    * Internal Changes
  - [jfrog-cli-artifactory] RTECO-1079 - Update agents commands
    help #478 (@udaykb2)
    * Other Changes
  - [jfrog-cli] Rteco 1299 jfrog artifactory ecomatrix cli e2e
    [#3523] (@naveenku-jfrog)
  - [jfrog-cli] Make sure to use cyclonedx-go 0.10.0 #3525
    (@attiasas)
  - [jfrog-cli] RTECO-1299 - Retry failed jfrog-cli-workflows
    runs via rerun-failed-jobs API #3529 (@naveenku-jfrog)
  - [jfrog-cli-artifactory] RTECO-1079 - Remove updating plugins
    during publish #471 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1079 - Consistent plugin
    identification #473 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1079 - Make version & slug
    consistent #472 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1079 - Change the semver error
    response #479 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1079 - Use consistent env
    naming #480 (@udaykb2)

++++ juk:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ k3b:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kaccounts-integration:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kaccounts-providers:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kaddressbook:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kajongg:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kalarm:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ kalgebra:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kalk:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kalm:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kalzium:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kamoso:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kanagram:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kapman:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kapptemplate:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kasts:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kate:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * fix comment
    * fix urlinfo for relative files with line
    * diffwidget.cpp - include QDir to fix compile
    * ensure we hide the buttons in the view space if no tabs & nav bar there (alternative implementation) (kde#515133)
    * Use proper working directory when invoking git (kde#519685)

++++ katomic:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kbackup:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kblackbox:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kblocks:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kbounce:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kbreakout:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kbruch:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kcachegrind:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kcalc:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kcalutils:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * incidenceformatter.cpp - fix start-end times for recurring events(again)
    * Revert "incidenceformatter.cpp - fix start-end times for recurring events"
    * incidenceformatter.cpp - html clean descs for displayview and tooltips
    * incidenceformatter.cpp - cleanHtml - use QTextDocumentFragment::fromHtml
    * incidenceformatter.cpp - fix start-end times for recurring events

++++ kcharselect:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kclock:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kcolorchooser:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kcron:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kde-inotify-survey:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ poxml:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdebugsettings:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdeconnect-kde:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * sms: bail out when the phone advertises a conversation with no messages
    * virtualmonitor: Fix virtual screen size on high dpi screens

++++ kdeedu-data:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkdegames:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdegraphics-mobipocket:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdegraphics-thumbnailers:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdenetwork-filesharing:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdenlive:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Too many changes since 26.04.1, only listing bugfixes:
    * Use percent based value for audio quality, and adjust the range accordingly per codec (kde#520750)
    * Enforce even numbers for render width/height (kde#520737)
    * Fix tmp files copied to wrong location when setting project folder (kde#467740)
    * Use QFileInfo instead of QUrl/QDir to try fixing Windows shared drives (kde#451413)
    * Display paths in native format in render widget (kde#520428)

++++ kdepim-addons:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdepim-runtime:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ kdesdk-scripts:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdesdk-thumbnailers:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdevelop:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdevelop-plugin-php:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdevelop-plugin-python3:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdf:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdialog:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdiamond:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdnssd:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ keditbookmarks:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ keysmith:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kfind:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kfourinline:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kgeography:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kget:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kgoldrunner:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kgpg:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kgraphviewer:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ khangman:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ khealthcertificate:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ khelpcenter:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kidentitymanagement:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kig:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kigo:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ killbots:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kimagemapeditor:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kimap:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ kio-admin:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kio-extras:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kio-gdrive:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kio_audiocd:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kamera:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kdesdk-kioslaves:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kirigami-gallery:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kiriki:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kitinerary:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Add extractor script for BDŽ (Bulgarian State Railways) PDF tickets
    * Adapt to Poppler 26.06 API changes
    * Fix required Qt version
    * Reflect the move of KMime to Frameworks in the dependency data
    * Add Condor PKPass extractor

++++ kjournald:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kjumpingcube:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kldap:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kleopatra:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Make it build with GpgME 1.24.2
    * Require GpgME 1.24.2 instead of GpgME 2.0
    * Adapt to KMime having moved to Frameworks
    * Fix required Qt version

++++ klettres:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ klickety:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ klines:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmag:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmahjongg:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmail:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ kmail-account-wizard:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ kmailtransport:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmbox:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Don't run benchmarks as part of autotests on the CI
    * Adapt to KMime having moved to Frameworks

++++ kmime:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Don't accept headers without a name

++++ kmines:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmix:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmousetool:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmouth:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kmplot:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ knavalbattle:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ knetwalk:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ knights:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ koko:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix move to trash action overriding image editor delete actions (kde#519784)
    * MediaViewPage: Fix typo affecting next button visibility

++++ kolf:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kollision:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kolourpaint:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kompare:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kongress:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ konqueror:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ konquest:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ konsole:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix copy command causing scroll to bottom

++++ kontact:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kontactinterface:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kontrast:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ konversation:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kopeninghours:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ korganizer:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ kosmindoormap:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Pin OSM element info model test to en_US locale also on Windows
    * Add fallback for missing diff command on Windows CI

++++ kde-dev-utils:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kpat:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kpimtextedit:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kpkpass:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kpmcore:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kpublictransport:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Improve OTP parsing heuristic for choosing between trip and route names (kde#519906)
    * Adapt to Deutsche Bahn journey query API changes

++++ kqtquickcharts:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ krdc:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ krecorder:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kreversi:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ krfb:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kruler:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksanecore:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix crash on skanlite startup (kde#517465)

++++ kshisen:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksirk:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksmtp:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksnakeduel:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kspaceduel:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksquares:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksudoku:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ksystemlog:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kteatime:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ktimer:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ktnef:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ktorrent:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ktouch:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ktrip:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ ktuberling:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kturtle:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kubrick:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kunifiedpush:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kwalletmanager:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kwave:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kweather:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kweathercore:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ kwordquiz:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ noise-suppression-for-voice:

  - Set the set_version service to mode="manual": factory-auto only
    allows source services in localonly/disabled/buildtime/manual
    mode, so the previous unscoped service caused the Factory
    submission to be declined
  - Spec cleanup:
    * Convert Mesa-libGL-devel, libXcursor-devel and libXrandr-devel
    to their pkgconfig(gl)/pkgconfig(xcursor)/pkgconfig(xrandr)
    forms
    * Drop obsolete Group tags

++++ libkcddb-qt6:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkdcraw:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkeduvocdocument:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkexiv2-qt6:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkcddb:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkdcraw-qt5:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkmahjongg:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkgapi6:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libgravatar:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkdepim:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ mailcommon:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ mailimporter:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ mimetreeparser:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix required Qt version
    * Adapt to KMime having moved to Frameworks

++++ pimcommon:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libkleo:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Require GpgME 1.24.2 instead of GpgME 2.0

++++ libksane:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libktorrent:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ marble:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libdmapsharing:

  - Update to version 3.9.14:
    + Always install dmap-transcode-stream.h
    + Account for type mismatch
    + Print warning if filter string contains bad parenthesis or
    quote
    + Eliminate unnecessary variables

++++ libdv:

  - Add libdv-gcc16.patch to fix the build with GCC 16

++++ libdv-playdv:

  - Add libdv-gcc16.patch to fix the build with GCC 16

++++ libinput-extra:

  - Update to release 1.31.3
    * libinput-device-group now sanitizes the PHYS value which
    prevents local privilege escalation through udev property
    injection.
    * `libinput record`: the --autorestart interval handling was
    broken for intervals 5s and higher
    * `libinput recor`: added a convenience fix for running with
  - -autorestart.
    * Eraser buttons can now be mapped to any button (previously only
    BTN_STYLUS, BTN_STYULUS2 and BTN_STYLUS3 were permitted).

++++ libinput:

  - Update to release 1.31.3
    * libinput-device-group now sanitizes the PHYS value which
    prevents local privilege escalation through udev property
    injection.
    * `libinput record`: the --autorestart interval handling was
    broken for intervals 5s and higher
    * `libinput recor`: added a convenience fix for running with
  - -autorestart.
    * Eraser buttons can now be mapped to any button (previously only
    BTN_STYLUS, BTN_STYULUS2 and BTN_STYLUS3 were permitted).

++++ libkomparediff2:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ libksieve:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ python313-core:

  - Add test_UDPLITE_support.patch (bsc#1263787,
    gh#python/cpython!149081) improving testing for the support of
    IPPROTO_UDPLITE, which could be not present although header
    files are.
  - Add missing BR `crypto-policies-scripts` (need for the fix of
    bsc#1211301).

++++ python313-nogil-nogil-core:

  - Add test_UDPLITE_support.patch (bsc#1263787,
    gh#python/cpython!149081) improving testing for the support of
    IPPROTO_UDPLITE, which could be not present although header
    files are.
  - Add missing BR `crypto-policies-scripts` (need for the fix of
    bsc#1211301).

++++ rocs:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ tqsl:

  - update to 2.8.6
    * Correct an issue which causes tqsl to be stuck on “waiting on
    other copies of TQSL to exit” when attempting to re-upload
    previously uploaded QSOs.
  - update to 2.8.5
    * Remove the certificate pinning for the lotw.arrl.org website as
    this was causing TQSL errors when ARRL updated the website
    certificate.
    * Correct logs uploaded using TQSL “Sign and Upload” so those
    files are compressed prior to upload.
    * Correct a defect that meant that restarting log signing did not
    delete the temporary file, leading to LoTW detecting duplicate
    certificates and station locations.

++++ lokalize:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * flatpak: Fix socket permissions

++++ lskat:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ mame:

  - Replaced mame-sdl_ini_path-hardcode.patch by mame-sdl_ini_path.patch
  - Migrated from ~/.mame to ~/.config/mame via /etc/mame/mame.ini

++++ markdownpart:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ massif-visualizer:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ mbox-importer:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ merkuro:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix week view navigation when locale starts week on Sunday
    * calendar: Fix IncidenceEditorPage not letting users select end/due time
    * Adapt to KMime having moved to Frameworks

++++ messagelib:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix logic, we need to execute code if we find photo
    * Adapt to KMime having moved to Frameworks

++++ minuet:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ neochat:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix crash in ThreadModel
    * Fix crash in ThreadModel
    * Work around problem in QConcatenateTablesProxyModel
    * Fix crash when viewing space home page
    * Fix creating a room as a child of a space and cleanup API
    * Remove bogus beginRemove/ResetModel calls
    * Avoid having a stale quick action item when message is unhovered
    * Fix crash when SSSSHandler emits error twice
    * DevicesModel: Don't return garbage data for timestamp roles
    * Fix DevicesPage not updating when connection changes
    * Persist the last save file dialog directory for Flatpaks
    * Linkify URLs with apostrophes (kde#501960)
    * Don't mangle URLs with two consecutive underscores (kde#503933)
    * Add hack to stop multi-line pinned messages from appearing
    * Don't allow previewing audio/video before sending it (kde#519112)
    * Fix how underscores were parsed in our new rich text system
    * Fix Quotient version checks

++++ neovim:

  - Use Lua5.1 rather than luajit, as we don't have all the modules in
    Leap16.0 and Leap16.1
  - enable aarch64 tests again
  - disable tests on Leap16

++++ okular:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ openQA:

  - Update to version 5.1780561853.63760953:
    * fix(rpm): eliminate systemd on-disk warnings during worker upgrade
    * chore(deps): Dependency cron 2026-06-04
    * ci: Run OBS scm checks only for master branch
    * fix(systemd): activate inactive workers and reload active ones safely
    * chore(deps): Dependency cron 2026-06-03
    * test(full-stack): remove redundant ISO size check to be flexible

++++ osc:

  - 1.27.1
  - Command-line:
  - Fix 'osc maintaner' not to error out before it prints maintainers in git
  - Library:
  - Fix a regression in Gitea 1.26 where we need to send '{}' instead of an empty body in POST requests

++++ palapeli:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ pandoc-cli:

  - Update pandoc-cli to version 3.10.
    Upstream does not provide a change log file.

++++ parley:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ partitionmanager:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ pcsc-tools:

  - Update to version 1.7.5
    * 102 new ATRs.
    * pcsc_scan:
    + fix an infinite loop.
    + do not crash if SCardEstablishContext() fails.
    + do not wait for an non-started thread.
    + handle the case of an error during SCardGetStatusChange.
    * meson: use -DATRparser="" to disable the ATR parser.
    * gscriptor: Add Georgian translation.
    * minor fixes and improvements.

++++ php8:

  - version update to 8.5.7
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
    Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
    DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
    Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
    OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
    Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
    URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) [bsc#1264578]
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) [bsc#1264579]
  - remove deprected --enable-inline-optimization

++++ php8-embed:

  - version update to 8.5.7
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
    Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
    DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
    Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
    OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
    Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
    URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) [bsc#1264578]
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) [bsc#1264579]
  - remove deprected --enable-inline-optimization

++++ php8-fastcgi:

  - version update to 8.5.7
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
    Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
    DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
    Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
    OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
    Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
    URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) [bsc#1264578]
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) [bsc#1264579]
  - remove deprected --enable-inline-optimization

++++ php8-fpm:

  - version update to 8.5.7
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
    Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
    DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
    Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
    OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
    Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
    URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) [bsc#1264578]
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) [bsc#1264579]
  - remove deprected --enable-inline-optimization

++++ php8-test:

  - version update to 8.5.7
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
    Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
    DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
    Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
    OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
    Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
    URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) [bsc#1264578]
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) [bsc#1264579]
  - remove deprected --enable-inline-optimization

++++ picmi:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ pim-data-exporter:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Adapt to KMime having moved to Frameworks

++++ pim-sieve-editor:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Use dependencies from stable branches

++++ pinentry:

  - Force -std=gnu++17 when building with GCC 16 to fix the broken
    build

++++ pinentry-gui:

  - Force -std=gnu++17 when building with GCC 16 to fix the broken
    build

++++ plasma-camera:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ plasma-phonebook:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ plasma-settings:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * pagestack: Fix pushed items getting auto-deleted

++++ plasmatube:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ prek:

  - Update to version 0.4.4:
    * Highlights
    0.4.4 makes prek run easier to watch and easier to slice.
    Hook stream output now shows a small live preview under the
    running hook in the progress UI. Long-running hooks no longer
    look stuck while they are producing logs, and failed hooks are
    easier to diagnose because recent output is already visible
    before the final result.
    The new group selector lets a single config support different
    workflows. Tag hooks with groups, then select or exclude those
    groups at run time:
    repos:
  - repo: local
    hooks:
  - id: format
    name: Format Python
    language: system
    entry: ruff format
    groups: [format, ci]
  - id: lint
    name: Lint Python
    language: system
    entry: ruff check
    groups: [lint, ci]
    prek run --all-files --group ci
    prek run --all-files --no-group format
    This is useful when local development, CI, slow validation, or
    project-specific checks need different hook sets without
    splitting the config.
    * Enhancements
  - Add hook group filters to prek run (#2141)
  - Delay hook output preview rendering (#2140)
  - Stream hook output in progress UI (#2136)
    * Bug fixes
  - Fix intent-to-add stash restore (#2143)
    * Documentation
  - Document hook stage file input (#2147)

++++ python313:

  - Add test_UDPLITE_support.patch (bsc#1263787,
    gh#python/cpython!149081) improving testing for the support of
    IPPROTO_UDPLITE, which could be not present although header
    files are.
  - Add missing BR `crypto-policies-scripts` (need for the fix of
    bsc#1211301).

++++ python-aiohttp-jinja2:

  - Add patch support-aiohttp-3.14.patch:
    * Support aiohttp 3.14 by using web.RequestKey.

++++ python-aioresponses:

  - Add upstream patch support-aiohttp-3.14.patch to support latest
    aiohttp gh#pnuckowski/aioresponses#288

++++ python-azure-mgmt-appconfiguration:

  - New upstream release
    + Version 6.0.0b2
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python313-documentation:

  - Add test_UDPLITE_support.patch (bsc#1263787,
    gh#python/cpython!149081) improving testing for the support of
    IPPROTO_UDPLITE, which could be not present although header
    files are.
  - Add missing BR `crypto-policies-scripts` (need for the fix of
    bsc#1211301).

++++ python-ini2toml:

  - Add patch support-tomlkit-0.15.0.patch:
    * Support tomlkit 0.15.0 by not using dumps()

++++ python313-nogil:

  - Add test_UDPLITE_support.patch (bsc#1263787,
    gh#python/cpython!149081) improving testing for the support of
    IPPROTO_UDPLITE, which could be not present although header
    files are.
  - Add missing BR `crypto-policies-scripts` (need for the fix of
    bsc#1211301).

++++ python-rich-click:

  - Update to 1.9.8:
    * Fixed regression in patching with Click 8.4.0.
    * Warn about regression in Typer >=0.26.0 patching. (No fix currently.)
  - Ignore typer tests due to typer 0.26.0.

++++ python-uv:

  - update to 0.11.18
    * Enhancements
    * Always compute SHA256 for remote distributions
    * Add PyEmscripten platform (PEP 783)
    * Add Pyodide 2025 target triple
    * Preview features
    * Make preview features for commands have names that aren't ambiguous with the command
    * Respect --isolated in uv check
    * Add uv check to run ty from uv
    * Bug fixes
    * Update activation scripts with upstream fixes
    * Continue tool uninstall after dangling receipts
    * Skip Unix-specific installation steps when cross-installing Windows Python distributions
    * Performance
    * Fix performance regression in unzip of local wheels
    * Other changes
    * Bump MSRV to 1.94

++++ python-vcrpy:

  - Add patch support-aiohttp-3.14.patch:
    * Support changes required for aiohttp 3.14.

++++ qmlkonsole:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ qrca:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ rke:

  - Update to version 1.8.14:
    NOTE: v1.32.13-rancher1-3 and v1.31.14-rancher1-1 are not
    available without an active RKE Extended Life subscription. For
    more details, please refer to the SUSE EOL article.
    * RKE Kubernetes versions
  - v1.30.14-rancher1-1
  - v1.31.14-rancher1-1
  - v1.32.13-rancher1-3 (default)

++++ rke2-selinux:

  - Update to version 0.23.stable.1:
    * Define versions to build selinux in centos10 to have support
    for fresh rhel, almalinux and rocky installs
    * Define specific policys for /run and /var/run in rhel9-10
    * Use transactional-update env in microos and slemicro
    * Clean dapper if that is not necessary anymore
    * Harden via checksum validation
    * Pin GH Actions to commit sha
    * Fix(policy): drop restorecon -F to preserve MCS labels
    * Remove dapper and also remove version duplicate script
    * Add FOSSA scanning workflow
    * Fix missing context in /run/k3s/containerd
    * fix snashots context
    * fix: use restorecon only in rke2 directory and not in rancher
    directory
    * adding slash scape to containerd log policy

++++ rosegarden:

  - switch to Qt6
  - update to 26.06
    Bug Fixes
    * LV2: Fix memory leaks. Bug #1748. [8139069f92]
    * cmake: Set LV2 minimum version to 1.18.0. [e78887fc13]
    * LV2: Improved handling of GTK2 plugins. Feature Request #541.
    [6c6b5e39ba]
    * Fix duplicate menu items in "Set Entry Velocities" window.
    Bug #1752. [95e52f0e64]
    * Fix empty profile dump with no profiling. Bug #1755. [90d2c00a16]
    * Add missing #include <QObject>. Bug #1746 [b714afbaa4]
    * cmake: Make lv2 optional. Patch #84. [c519c57ab2]
    * cmake: Rename DISABLE_LILV -> DISABLE_LV2. [2d2824cc84]
    * cmake: Add DISABLE_PCH. [04e36f6ea4]
    * cmake: Fix broken CMAKE_BUILD_TYPE. [c149ea9a66]
    * Matrix: Fixed crash on large horizontal zoom. Bug #1761.
    [853313edcf]
    * Matrix: Fixed horizonatal zoom range issue. Bug #1761.
    [4a34375a33]
    * Matrix: Fix vertical zoom range issue. [807cd89374]
    * Matrix: Improve HV wheel behavior. [0ef1e21deb] [566f984873]
    * Matrix: Fix preview play for tied notes. Bug #1764. [e9ed4f1221]
    * AudioPluginDialog: Improve Editor button behavior. Editor button
    is now disabled if JACK isn't up. An error message is provided via
    the button's tooltip when it is disabled. [fbaa3ec6b1]
    * MIDI Mixer: Handle changes to the number of devices without closing
    the window. [520641f59c]
    * MIDI Mixer: Fix garbage in meters. [254e75a45f]
    * MIDI Mixer: Handle changes to the number of controllers.
    [faeb4238be]
    * Audio File Manager: Fix unload not working on selected WAV files.
    Bug #1766. [8626e2ec58]
    * main window: Fix toolbar tool buttons not responding to tool
    changes via the context menu. [6d33d9d5ed]
    * main window: Fix context menu tool items enabled at the wrong time.
    [212f1ba128]
    * main window: Disable VU meters on muted and archived tracks.
    Bug #1767. [1ff36b47e4] [5ed9c5248c]
    * main window: Make rotary tooltip dynamic. Bug #1768. [d39555d401]
    * metronome: Use bar velocity for preview. [3f773b79b0]
    * MusicXML: Fix crash when importing MusicXML. PR #32. [92f9b3b426]
    * Notation: Fix erasing triplet note. Bug #1772. [5a0d019c45]
    * Tranzport: Disabled support for Frontier Design Group's
    TranzPort DAW Control. See README for instructions on re-enabling
    and let us know if you are using this. [44dab8314b]
    * Notation: Fix select and delete notes in tuplets. Bug #1772.
    [ff57686630] [81541588f7]
    * Notation: Fix inserting tuplet note at beginning. Bug #1772.
    [de410d7937]
    * main window: Fix scroll to follow playback. When it is off, the
    display will not scroll. Turn it on and the display will jump to
    where the cursor is. Bug #1774. [254f9824ce]
    * examples: Make all channels fixed. PR #45. [6b2824a52d]
    * Notation: Fix beaming a selection that contains a tuplet losing
    the tuplet. Bug #1773. [80af019789]
    * Notation: Improve rendering of mixed beam/tuple group. Bug #1773.
    [905859fc05]
    * Event List Editor: Fix initial selection in event editor.
    Bug #1777. [af81698a7c]
    * Editors: Remove "Durations" from rescale menu items. Bug #1771.
    [91a1a718f5]
    * Event List Editor: Select new event after insert. [5131ab73df]
    * Event List Editor: Fix edit not leaving event selected.
    [c6ec410702]
    * Matrix: Fix matrix velocity can end up 0. Bug #1777. [af83558f8e]
    * Matrix: Fix unreadable grid dropdown in Native theme. Bug #1778.
    [6f886727a6]
    * Matrix: Fix unreadable quantize dropdown in Native theme.
    Bug #1778. [29193b7a03]
    * Notation: Fix crash with Make Triplet (Ctrl+R). Bug #1781.
    [6bf63b0f3d]
    New Features
    * rgd: Added support for alternative bank select approaches for
    synths like the Yamaha TG77 and Oberheim Matrix-1000. Feature
    Request #542. [b9c94293c5] [5b03a6285c]
    * matrix: Remember velocity for each segment. [7e3ecfa101]
    * main window toolbar: Added metronome button to the transport
    toolbar. [2fcbb1426f]
    * main window: Make "End" key jump to the end of the segments on
    first press, and to the end of the composition on the second press.
    [42ba3c6341]
    * Rulers: Add "Set to Default" to context menu. Also accessible via
    middle mouse button in select and move tools. [5a2efddfb3]
    * lilypond: Add warning about too-short durations that will lead to
    lilypond errors. PR #44. [a11a8343f8]
    * Event List Editor: Add Edit > Paste At... [b3682ef93c]

++++ rumdl:

  - Update to version 0.2.7:
    * Fixed
  - MD077: normalize over-indented loose list continuation
    (6b9fcee)

++++ semaphore:

  - Update to version 2.18.9:
    * 0a37ea2 feat(cli): allow create token

++++ showtime:

  - Update to version 50.0+19:
    + Add playback speed shortcuts and fix detail caps handling
    + meson: Remove unused variable
    + main: Enable debug logging only for devel profile
    + play: Ignore meta/x-gst-fourcc missing plugin messages
    + pyproject: Add pyproject.toml with stricter checks
    + Updated translations.
  - Add explicit AppStream BuildRequires, meson checks for it.

++++ signon-kwallet-extension:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ skanlite:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ skanpage:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ skladnik:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ skupper:

  - Update to version 2.2.1:
    https://github.com/skupperproject/skupper/milestone/10?closed=1

++++ step:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ svgpart:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ sweeper:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ sysdig:

  - Update to version 0.41.4:
    * Tracks the falcosecurity/libs 0.21.0 release train
    * The capture backend is now the modern (CO-RE) eBPF probe
    built into the binary; the legacy scap kernel module is no
    longer built by upstream
    * Numerous fixes carried in via the updated libs (see the
    upstream release notes)
  - Bump bundled sources to match sysdig 0.41.4:
    * falcosecurity/libs 0.16.0 -> 0.21.0
    * scap driver 7.1.0+driver -> 8.1.0+driver
  - Drop the legacy scap kernel-module (KMP) build entirely:
    upstream 0.41.4 no longer builds a kernel driver, so the
    kernel-module-package machinery, the kernel-source
    BuildRequires and the manual driver install step are gone;
    the modern eBPF probe replaces it
  - Add sysdig-disable-container-plugin.patch: the new container
    plugin otherwise downloads a prebuilt binary at build time
    (offline-build and prebuilt-binary policy violation); building
    it from source needs the still-unpackaged RE-flex and
    plugin-sdk-cpp
  - Build the modern eBPF probe (BUILD_SYSDIG_MODERN_BPF), adding
    BuildRequires on clang, bpftool and libbpf-devel
  - Set ExclusiveArch to x86_64 aarch64 ppc64le s390x, the arches
    for which the modern BPF probe ships a vendored vmlinux.h
    (this enables aarch64 instead of excluding it)
  - Build the bundled libs statically into the binary
    (-DBUILD_SHARED_LIBS=OFF) and drop the now-installed
    falcosecurity-libs development SDK (headers, static libs,
    pkgconfig) and the scap driver/DKMS source tree
  - Move the bash and zsh completions into separate
    sysdig-bash-completion and sysdig-zsh-completion subpackages
  - Ship the bash completion under
    %{_datadir}/bash-completion/completions and use a fixed
    script interpreter for scap-driver-loader
  - Drop obsolete Group tags

++++ telly-skout:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ tokodon:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * Fix generate-icon-list script to include more icon sources
    * Fix qml-check-icons image
    * Improve previewing news links from the Explore page
    * Hide configure application action from profile on desktop
    * Add icon for "No Media" and "No Posts" placeholders
    * Wrap text for notification page's placeholder text
    * Show a black background when failing to load attachments
    * Fix the "Include public posts in search results" setting
    * Only show cross-account actions for functional accounts
    * Remove embed action for now
    * Fix notifications page momentarily showing no loading placeholder
    * Use default DEFAULT_SEVERITY for logging

++++ umbrello:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - Changes since 26.04.1:
    * svn2png: Fix bug not checking the correct svg renderer instance
    * Fix clip4 paste of sequence messages across instances (kde#418395)

++++ vermouth:

  - Bump to version 1.8.5
  - Upstream changes:
    * Add some text explaining the import, root dir parse
    * Changes to text and ui
    * Import from GOG
    * Update SHAs

++++ wolfictl:

  - Update to version 0.39.18:
    * fix(dag): preserve provider priority in local repo
    * refactor(dag): drop the unused per-origin package resolver
    * build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#1983)
    * build(deps): bump cloud.google.com/go/storage from 1.62.1 to
    1.62.2 (#1984)
    * build(deps): bump step-security/harden-runner from 2.19.3 to
    2.19.4 (#1985)
    * build(deps): bump github.com/containerd/containerd/v2 (#1986)
    * build(deps): bump golangci/golangci-lint-action from 9.2.0 to
    9.2.1 (#1987)
    * build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1989)
    * build(deps): bump chainguard-dev/actions from 1.6.19 to 1.6.21
    (#1990)
    * build(deps): bump actions/checkout in /.github/actions (#1991)

++++ yakuake:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

++++ zanshin:

  - Update to 26.04.2
    * New bugfix release
    * For more details please see:
    * https://kde.org/announcements/gear/26.04.2/
  - No code change since 26.04.1

------------------------------------------------------------------
------------------  2026-6-3  -  Jun 3 2026  -------------------
------------------------------------------------------------------

++++ AppStream:

  - Add upstream change:
    * 0001-Explicitly-add-fcfreetype.h-include-to-asc-font.c.patch

++++ Mesa:

  - Update to 26.1.2 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.2

++++ Mesa-drivers:

  - Update to 26.1.2 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.2

++++ MirrorCache:

  - Update to version 1.105:
    * Add ua to avoid_countries for ru and by
    * Extend list of sanctioning countries for ru and by mirrors

++++ agama:

  - Fix software progress in openSUSE where it incorrectly report
    proposing software selection instead of refreshing repositories
    (gh#agama-project/agama#3579)

++++ agama-web-ui:

  - Enhanced the VLAN connection form (gh#agama-project/agama/#3571).

++++ amazon-ssm-agent:

  - Update to version 3.3.4624.0
    * Bump golang.org/x/crypto from v0.51.0 to v0.52.0 (bsc#1266200, CVE-2026-39827,
    CVE-2026-39828, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
    CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597,
    CVE-2026-46598)
    * Bump golang.org/x/net from v0.54.0 to v0.55.0
    * Enforce directory boundary in BuildSafePath
    * Fix visibility issue with Bottlerocket OS in document output
    * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this
    also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  - Drop CVE-2026-41506.patch, merged upstream

++++ ansible-13:

  - new package ansible-13 following the 13.x series of ansible

++++ apr:

  - Fixed state being reinitialized to NULL every loop, which the
    test does not expect.
    apr-fix-autoinit.patch

++++ assimp:

  - added patches
    CVE-2026-10197: Affected is the function glTF2Importer:ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Importer.cpp. manipulation results in null pointer dereference [bsc#1266996]
    * assimp-CVE-2026-10197.patch
    CVE-2026-10199: Affected by this issue is the function glTF2:LazyDict in the library glTF2Asset.h. Manipulation of the argument operator[] leads to null pointer dereference [bsc#1266998]
    * assimp-CVE-2026-10199.patch

++++ libavif:

  - update to 1.4.2:
    * Added since 1.4.1
  - Add --jobs flag to avifgainmaputil to use multiple worker
    threads when reading/writing AVIF files.
    * Changed since 1.4.1
  - Require C11 for compilation. Public headers will remain C99.
  - Add --jobs flag to avifgainmaputil and enable auto tiling.
  - Use AOM_TUNE_IQ for layered image inter-frame encoding.
  - Update aom.cmd/LocalAom.cmake: v3.14.1
  - Update LocalAvm.cmake: research-v15.0.0
  - Update libjpeg.cmd/LocalJpeg.cmake: 3.1.4.1
  - Update libxml2.cmd/LocalLibXml2.cmake: v2.15.3
  - Update libyuv.cmd/LocalLibyuv.cmake: 644251f25 (1924)
  - Update svt.cmd/svt.sh/LocalSvt.cmake: v4.1.0
  - Update zlibpng.cmd/LocalZlibpng.cmake: libpng 1.6.58
  - Fix memory leak of altICC if avifDecoderFindGainMapItem
    returns early.
  - Avoid MT loop restoration crash in libaom < 3.13.3
  - Fix decoding layered image with multiple scaled alpha layers
  - Fix NaN bypass of AVIF_CLAMP in gain map tone mapping (use
    fminf/fmaxf)
  - Fix null pointer dereference in avifImageCopy() when
    avifImageCreateEmpty() fails to allocate the destination
    gain map image.
  - avifenc: reject mismatched --depth for Y4M input
  - Use libaom AOMD_SET_FRAME_SIZE_LIMIT if available
  - Fix bug in transfer function 11 (used for gain map
    creation/tone mapping)

++++ azure-storage-azcopy:

  - Increase mininum Go version in BuildRequires to 1.26.3

++++ devscripts-checkbashisms:

  - version update to 2.26.9:
    * various fixes, see /usr/share/doc/packages/devscripts/changelog
  - modified patches
    * devscripts-debcommit-hg16.patch (refreshed)
    * devscripts-fix-build.patch (refreshed)
    * devscripts-fix-python-install-layout.patch (refreshed)

++++ cowsql:

  - fix build, add cowsql-1.15.9-fix-Wdiscarded-qualifiers.patch
    from upstream

++++ curl:

  - Backport fix for issue gh#curl/curl#21547 and gh#Nheko-Reborn/nheko#2054
    which caused applications to busy loop with 100% CPU usage
    * Add libcurl-fix-wakeup-consumption.patch

++++ dabstar:

  - Update to version 5.1.0
    * This release does not introduce any new features compared to
    version V5.0.0. The main change is that the dependency on the
    Qwt library has been completely removed. As a result, you may
    notice some minor visual differences in the user interface,
    although the overall behavior and usability should remain the
    same.
  - Use custom desktop file.

++++ deadbeef:

  - enable i586 architecture

++++ devilspie2:

  - Modernize spec file:
    * Use https for Source URL
    * Use %{_sysconfdir} macro instead of hardcoded /etc

++++ devscripts:

  - version update to 2.26.9:
    * various fixes, see /usr/share/doc/packages/devscripts/changelog
  - modified patches
    * devscripts-debcommit-hg16.patch (refreshed)
    * devscripts-fix-build.patch (refreshed)
    * devscripts-fix-python-install-layout.patch (refreshed)

++++ dqlite:

  - Update to 1.18.6:
    * set SOCK_CLOEXEC on socket creation to prevent FD leak to child
    processes
    * fix null deref when stopping or handing over before start

++++ dracut:

  - Update to version 110+suse.32.g36b00ba7:
    * fix(systemd-*): add new dlopen dependencies to modules lists

++++ gdal:

  - Update to version 3.13.0 "Iowa City":
    * New 'gdal' command line interface subcommands: vector
    combine, concave-hull, convex-hull, create, dissolve,
    export-schema, update, rename-layer and sort; dataset
    check; driver cog/gpkg validate; and a pipeline 'external'
    step to run an external command
    * New E57 read-only raster driver (2D images from ASTM E2807
    E57 files)
    * New SAR Compensated Phase History Data (CPHD) multidimensional
    read-only driver
    * New JP2GROK read/write JPEG-2000 driver using the Grok
    toolkit (AGPLv3)
    * COG driver: implement Create() for random write creation
    * S102/S104/S111 drivers: add write support
    * MiraMonRaster: add creation support
    * NITF driver: add CADRG writing support
    * Zarr: various Zarr V3 improvements (sharding), multiscales,
    and spatial/proj extensions for EOPF products
    * Add support for INTERLIS 2.4
    * Restore the OGR Tiger and UK.NTF drivers (previously removed)
    * Add compatibility with Poppler up to 26.04.00
  - Bump soversion to 39 (libgdal38 -> libgdal39)
  - Convert several -devel BuildRequires to pkgconfig() form
  - Add curl-devel >= 7.68 (minimum required by GDAL 3.13)
  - Package the new gdal CLI subcommand man pages

++++ gemini-cli:

  - update to 0.45.0:
    * chore(release): bump version to
    0.45.0-nightly.20260521.g854f811be
    * fix(cli): prevent Termux relaunch and resize remount loops
    * Feat/a2a expose usage metadata
    * feat(context): Complete simplification work.
    * fix(core): force update_topic tool to execute sequentially
    * Revert "fix(core): prevent SIGHUP kills in PTY environments"
    * fix(cli): filter internal session context from history during
    resumption
    * Update default auto routing
    * fix(core): bypass routing classifiers to prevent orphaned
    function response errors
    * fix(core): suppress PTY resize EBADF errors
    * fix(core): prevent blacklist bypass in mcp list
    * fix(cli): ignore unmapped vim normal keys
    * fix(patch): cherry-pick bd53951 to
    release/v0.45.0-preview.0-pr-27496 to patch version
    v0.45.0-preview.0 and create version 0.45.0-preview.1
  - update to 0.44.1:
    * fix(patch): cherry-pick bd53951 to release/v0.44.0-pr-27496
    [CONFLICTS]

++++ ghc-crypton:

  - Update crypton to version 1.1.4.
    [#]# 1.1.4
    * Generic instance for RSA PublicKey and PrivateKey
    [#]# 1.1.3
    * Ensure that `pointAdd` in `PubKey.ECC.P256` treats the point at infinity as the additive identity.
    [#73](https://github.com/kazu-yamamoto/crypton/pull/73)
    [#]# 1.1.2
    * Preparing `ram` v0.22.
    * Generalizing RSA encrypt/decrypt to manipulate ScrubbedBytes directly.
    [#]# 1.1.1
    * On iOS, ScrubbedBytes based hashing is used for seedNew. On other
    plateforms, entropy is used directly as used to be.
    [#71](https://github.com/kazu-yamamoto/crypton/pull/71)
    [#]# 1.1.0
    * Removing "basement" and "memory".
    [#67](https://github.com/kazu-yamamoto/crypton/pull/67)
    [#]# 1.0.7
    * Stop depending on basement, use upstream dependencies instead
    * Stop transitively depending on basement by depending on ram.

++++ ghc-crypton-x509:

  - Update crypton-x509 to version 1.9.1.
    * Implementing the X509 name constrains extension. [CVE-2026-9648, bsc#1268157]
    * Using "ram" instead of "memory"
    * Depend on package `time-hourglass`, rather than `hourglass`. Date and
    time-related types and classes are now those from the former package.
    [#18](https://github.com/kazu-yamamoto/crypton-certificate/pull/18)
    * Depend on package `crypton-asn1-types >= 0.4.1` rather than `asn1-types`.
    ASN.1-related types and classes are now those from the former package.

++++ ghc-crypton-x509-validation:

  - Update crypton-x509-validation to version 1.9.1 revision 1.
    * Implementing the X509 name constrains extension. [CVE-2026-9648, bsc#1268157]
    * Using "ram" instead of "memory".
    * Depend on package `time-hourglass`, rather than `hourglass`. Date and
    time-related types and classes are now those from the former package.
    [#18](https://github.com/kazu-yamamoto/crypton-certificate/pull/18)
    * Depend on package `crypton-asn1-types >= 0.4.1` rather than `asn1-types`.
    ASN.1-related types and classes are now those from the former package.

++++ ghc-doclayout:

  - Update doclayout to version 0.5.0.3.
    [#]# 0.5.0.3
    * Tests: Go back to using withMaxSuccess for compatibility with older
    QuickCheck versions.
    [#]# 0.5.0.2
    * Performance optimizations:
    + Fuse double modify calls in outp, newline, and FCookedText handler.
    + Cache polymorphic prefix in RenderState. Add prefixA, prefixTrimmedA,
    and prefixLen fields to RenderState that cache the polymorphic
    conversions of the Text prefix. This eliminates
    the per-line fromString/T.unpack/realLength conversions in outp,
    newline, and the FCookedText handler. Add a setPrefix helper that
    updates all cached fields atomically. The block handler computes the
    space-appended prefix incrementally to avoid expensive recomputation
    on deeply nested blocks.
    + Avoid redundant realLength calls in mergeBlocks padding.
    Thread precomputed line widths through the merge process by changing
    the internal representation from (Int, [a]) to (Int, [(Int, a)]) where
    the inner Int is each line's rendered width. This avoids calling
    realLength on every line during every merge pass; widths are computed
    once in toBlockSpec and carried through.
    + Remove redundant normalize in flatten for Prefixed. renderList
    already normalizes when processing FPrefixed. This removes the
    double traversal.
    + Use strict foldl' in Attributed foldlChar instance.
    + Add shortcuts for Thai, emoji modifiers, CJK, and fullwidth chars.
    Add new shortcuts to updateMatchStateNarrow and updateMatchStateWide:
  - Thai script (U+0E00-U+0E7F) with combining marks for vowels/tones
  - Zero-width joiner (U+200D) with inline emoji-joining logic
  - Emoji presentation variation selector (U+FE0F)
  - Emoji skin tone modifiers (U+1F3FB-U+1F3FF)
  - CJK Compatibility Ideographs (U+F900-U+FAFF)
  - Fullwidth forms (U+FF01-U+FF60, U+FFE0-U+FFE6)
  - Supplementary CJK Extension B+ (U+20000-U+3FFFF)
    * Use withNumTests instead of deprecated withMaxSuccess in test suite.

++++ ghc-tls:

  - Update tls to version 2.4.3.
    Upstream has edited the change log file since the last release in
    a non-trivial way, i.e. they did more than just add a new entry
    at the top. You can review the file at:
    http://hackage.haskell.org/package/tls-2.4.3/src/CHANGELOG.md

++++ gleam:

  - Update to 1.17.0:
    * Fixed security vulnerabilities:
  - Restrict custom documentation page `path` and `source` values so
    `gleam docs build` cannot escape the docs output directory or project
    root (bsc#1267396, CVE-2026-32685)
  - Restrict publication tarball creation so they cannot contain files
    from outside the project root (bsc#1267397, CVE-2026-42795)
  - Stricter deserialisation rules for files internal the build directory
    to reject corrupted data (bsc#1267398, CVE-2026-43965)
    * All features and bug fixes are extensively highlighted with
    examples in the upstream blog post at
    https://gleam.run/news/single-file-gleam-beam-programs-with-escript/
    and changelog at
    https://github.com/gleam-lang/gleam/blob/v1.17.0/CHANGELOG.md some of
    the highlights include:
  - Various JavaScript code generation fixes and optimization
  - Various compiler error handling improvements
  - Ability to use the `todo` keyword in constants
  - Improved handling of Git monorepos during package management
  - Ability to create escripts from Gleam programs
  - Various language server improvements like reference highlighting,
    record hovering and code actions

++++ gnome-keyring:

  - Add 04a6bc68ff4350676c5fc55d1b244a17224fbea2.patch: Fix: avoid
    potential FD leak in gkm_rpc_layer_startup.
  - Rebase gnome-keyring-pam-auth-prompt-password.patch with quilt.
  - Use autosetup/patch macros.

++++ halloy:

  - Update to version 2026.7.1:
    Fixed:
    * Panic when a reply contains a multibyte character near the
    start of message
    * Ensure messages don't get formatted if channel has +c mode
    (colour filter)
    * User highlighting incorrectly matching contraction suffixes

++++ haproxy:

  - Update to version 3.4.0+git0.64a335366:
  - https://www.haproxy.com/blog/announcing-haproxy-3-4
  - https://www.mail-archive.com/haproxy@formilux.org/msg47182.html
  - Update apparmor profile to match 3.4
  - The package can now be built with opentelemetry support (off by
    default) at 849ecaf
    In opentelemetry mode, 2 new subpackages get created with the
    haproxy binary
  - haproxy-opentelemetry
  - haproxy-normal
    By default it will pull haproxy-normal but it can be replaced
    with haproxy-opentelemetry

++++ helm-schema:

  - Update to version 0.23.4:
    * Chores
  - version++ by @dadav
    * Documentation
  - Update mapping table by @dadav
    * Testing
  - Test helm-docs mappings by @dadav

++++ hplip:

  - hp-plugin: fix plugin installation from local file (lp#2154206)
    * add pluginhandler-fix-plugin-installation-from-local-fil.patch

++++ hwdata:

  - Update to version 0.408:
    * Update pci and vendor ids

++++ ifuse:

  - Update to version 1.2.1:
    * Fixed several issues and updated compatibility with newer iOS
    devices.
  - Delete ifuse-1.1.4-fuse3.patch

++++ international-doom:

  - Initial version

++++ ipxe:

  - Restrict the build to x86_64 and aarch64, due to dependencies and
    to the fact that these arch-es are the only ones where the ROMs
    are useful.

++++ jfrog-cli:

  - Update to version 2.106.0:
    * New Features
  - [build-info-go] Added poetry and yarn package support to
    recognize 403 Forbidden output #387 (@Phavya-jfrog)
  - [jfrog-cli-artifactory] RTECO-1272 - Implement agent plugins
    install command #463 (@udaykb2)
  - [jfrog-cli-artifactory] Add delete Subcommand to jf agent
    plugins for Removing Plugin Versions from Artifactory #464
    (@agrasth)
  - [jfrog-cli-artifactory] feat(agent/plugins): add delete
    commands (RTECO-1269) #466 (@agrasth)
  - [jfrog-cli-artifactory] RTECO-1268 - Implement plugins update
    command #468 (@udaykb2)
  - [jfrog-cli-artifactory] RTECO-1270 - Add backward
    compatability for skills #469 (@udaykb2)
  - [jfrog-cli-security] XRAY-141568 - Added graceful error when
    jf ca breaks due to cvs issue at RT server side #761
    (@gauriy-tech)
  - [jfrog-cli-security] Support all attributes in Central
    Configs #670 (@attiasas)
    * Bug Fixes
  - [jfrog-cli-artifactory] Added logic for fat manifest file
    [#452] (@naveenku-jfrog)
    * Other Changes
  - [jfrog-cli-artifactory] Poetry update error output handling
    [#462] (@Phavya-jfrog)
  - [jfrog-cli-artifactory] RTECO-1270 - move skills under agent
    namespace #461 (@udaykb2)
  - [jfrog-client-go] XSC - Update params in config profile #1344
    (@attiasas)

++++ keybase-client:

  - Update to version 6.6.3
    * Various bug fixes
  - Drop update-go-crypto.patch which has been adopted upstream.
  - Drop update-go-net.patch which has been adopted upstream.

++++ kernel-default:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-source:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-source-longterm:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f

++++ kernel-docs:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-kvmsmall:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-longterm:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f

++++ kernel-obs-build:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-obs-qa:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-syms:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kernel-syms-longterm:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f

++++ kernel-vanilla:

  - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
    This is a further optimization of kernel packaging rust-enablement.
    Add the check of CONFIG_RUST at creating the spec for each kernel
    flavor, and set BuildRequires conditionally only for archs that have
    CONFIG_RUST.  This avoids the unnecessary dependency chains due to
    unused rust.
    The main knob ENABLE_RUST is still needed because otherwise we can't
    know whether to pass the dummy-tools or not at processing
    run_oldconfig.
  - commit ccf4b93
  - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
    Those configs may be dynamically changed at the build time
  - commit 5251980
  - rpm: Add BuildRequires for Rust enablement (bsc#1258538)
    Update mkspec and template to generate the spec files with
    BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
    rpm/config.sh.
  - commit d0f276f
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
    (cherry picked from commit 5d98aa3da261a44f676d60ae2e11bfbf8f691928)
  - ima: return error early if file xattr cannot be changed (bsc#1261041).
  - commit c8ca8cf

++++ kind:

  - Update to version 0.32.0:
    This release contains critical dependency updates, bug fixes, and
    defaults to Kubernetes 1.36.1.
    * Breaking Changes
  - The default node image is now
    kindest/node:v1.36.1@sha256:3489c7674813ba5d8b1a9977baea8a6e553784dab7b84759d1014dbd78f7ebd5
  - New node images requiring upgrading kind to kind load ...:
    Due to a containerd upgrade, you must upgrade kind to this
    release or newer to use kind load ... with the newly
    published node images. As always, we cannot gurantee full
    compatibility of node images between kind releases. You can
    use the digests from previous releases, upgrade kind, or
    build your own node-images.
  - kubeadm v1beta4 config format is now used for Kubernetes
    1.36.0+ If you are using versioned config patches, you must
    update to target v1beta4. Unversioned patches kind will
    attempt to convert as needed (more below in New Features).
    This change is required for Kubernetes 1.37+ which drops
    kubeadm v1beta3 config.
  - Adoption of Envoy for Load Balancing in multi-control-plane
    node clusters: HAProxy has been replaced by Envoy
    (docker.io/envoyproxy/envoy:v1.36.2) as the load balancer in
    multi-control-plane (HA) clusters. If you rely on custom
    HAProxy loadbalancer configurations or images, please note
    that Envoy is now used.
  - cgroup v1 warning: A warning is now printed if cgroup v1 is
    detected on the host. Kubernetes has deprecated support for
    cgroup v1, and at some point in the future KIND releases /
    node-images will also drop support for cgroup v1.
    * New Features
  - kubeadm v1beta4 configuration support: KIND now uses the
    v1beta4 config format for Kubernetes v1.36.0+ while
    maintaining v1beta3 for v1.23.0 up to v1.35.x, and v1beta2
    for older versions.
  - Custom Merging & Version-Awareness for Kubeadm Config
    Patches:
  - KIND now automatically translates old-style map-based
    extraArgs / kubeletExtraArgs patches to the list-based
    v1beta4 format when targeting v1beta4 configs.
  - Config patches now append to extraArgs / kubeletExtraArgs /
    certSANs reliably. To overwrite or make other more precise
    patching, use json6902 patches.
  - Support for containerd config v4 format: Enabled support for
    containerd's config v4 format in kind load and snapshotter
    parsing, which is required for newer containerd versions.
  - Building Node Images from CI Artifacts: Added support to
    build node images from Kubernetes CI artifacts (resolving
    endpoints like https://dl.k8s.io/ci/latest.txt or CI build
    prefixes).
  - Support for containerd version-aware containerd config
    patching: Like kubeadmConfigPatches, containerd config
    patching is now aware of version and if specified in patches
    will only apply patches that match the containerd config
    being used.
  - Assorted dependency updates.
    * Images pre-built for this release:
  - v1.36.1:
    kindest/node:v1.36.1@sha256:3489c7674813ba5d8b1a9977baea8a6e553784dab7b84759d1014dbd78f7ebd5
  - v1.35.5:
    kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
  - v1.34.8:
    kindest/node:v1.34.8@sha256:02722c2dedddcfc00febf5d27fbeb9b7b2c14294c82109ff4a85d89ac9ba3256
  - v1.33.12:
    kindest/node:v1.33.12@sha256:3f5c8443c620245e4d355cfe09e96a91ead32ceaa569d3f1ca9edf0cb2fe2ff4
    NOTE: You must use the @sha256 digest to guarantee an image
    built for this release, until such a time as we switch to a
    different tagging scheme. Even then we will highly encourage
    digest pinning for security and reproducibility reasons.
    * Fixes
  - Fix permission error when creating pods with hostUsers: false
    (Kubernetes 1.36+).
  - Handle registry ports correctly in image normalization logic
    (e.g., registry running on ports like localhost:5000/...).
  - Handle empty port mapping listen addresses correctly
    (defaults to wildcard address).
  - Skip /dev/mapper mount on rootless Docker.
  - Assorted documentation fixes and improvements.
    * Dependencies
  - bump local-path-provisioner to v20260521-9fb22683
  - bump base image to v20260521-9fb22683
  - bump qemu
  - bump base again, to current latest with containerd 2.2.3
  - bump local-path-provisioner image
  - bump kindnetd image
  - bump base image
  - bump containerd back to 2.2.3 due to 2.3.0 regression, bump
    runc to 1.3.5 to match
  - bump go to 1.26.2
  - bump cni plugins to 1.9.1
  - bump crictl to 1.36.0
  - bump runc to 1.4.2 to match containerd
  - bump containerd to 2.3.0
  - Bump actions/cache from 5.0.4 to 5.0.5 in the actions group
  - Bump actions/upload-artifact from 6.0.0 to 7.0.1
  - Bump actions/setup-go from 6.3.0 to 6.4.0 in the actions
    group
  - Bump actions/cache from 5.0.3 to 5.0.4 in the actions group
  - Bump actions/setup-go from 6.2.0 to 6.3.0 in the actions
    group
  - bump golang images
  - bump go to 1.25.7
  - Bump the actions group across 1 directory with 2 updates
  - bump base image
  - bump local-path-provisioner
  - bump kindnetd
  - bump go to 1.25.6
  - bump local-path-provisioner to 0.0.34
  - bump local-path-provisioner to trixie
  - bump distroless-iptables to latest
  - bump containerd to 2.2.1
  - bump base image to trixie
  - bump haproxy image
  - Bump the actions group with 2 updates
  - bump base image
  - upgrade to runc 1.3.4
  - bump haproxy to 2.6.x
  - bump docs to 0.31.0
  - Bump image from bullseye to bookworm for
    local-path-helper,local-path-provisioner,haproxy

++++ lego:

  - Update to version 5.2.2:
    * namecheap: fix record key sub domain

++++ libb64:

  - Update to version 2.0.0.1:
    * Introduce version macros for API/version detection
    * Use size_t arguments to allow longer base64 strings
    * Re-introduce configurable line-break functionality
    * Add encoder flags field and output-buffer length helpers
    * Change in/out pointers to void*
    * Integer-overflow and coder-state initialization fixes are
    now included upstream
  - Switch Source to the upstream GitHub release tarball
  - Bump soversion to 1 (manually maintained soname; ABI changed)
  - Drop patches now included upstream:
    * initialize-coder-state.diff
    * integer-overflows.diff
    * static-chars-per-line.diff
  - Rebase bufsiz-as-buffer-size.diff for the new sources
  - Drop no longer needed unzip BuildRequires
  - Modernize spec file (drop Group tag, use https URL)

++++ curl-mini:

  - Backport fix for issue gh#curl/curl#21547 and gh#Nheko-Reborn/nheko#2054
    which caused applications to busy loop with 100% CPU usage
    * Add libcurl-fix-wakeup-consumption.patch

++++ libdispatch:

  - Update to version 6.1.1 (swift-6.1.1-RELEASE):
    * Tracks the upstream Swift 6.1.1 release of the
    swift-corelibs-libdispatch sources (90 commits since
    5.6.3)
    * Add support for the Musl libc
    * Enable build IDs on Linux
    * Add the missing include needed for PATH_MAX on Linux
    * Un-hardcode the CMake install directories so GNUInstallDirs
    is honoured
    * Install the correct module map for static builds
    * On Android use posix_memalign() where aligned_alloc() is
    unavailable (API < 28)
    * Numerous Windows fixes: x86, ARM64 and MinGW build repair,
    multibyte path handling, semaphore/pipe behaviour
    * The project moved from the apple to the swiftlang GitHub
    organisation; update URL and Source accordingly
  - Drop patches merged upstream:
    * prevent_unused.patch
    * disable-cast-function-type-mismatch.patch
  - Rebase soversion.patch onto the 6.1.1 sources (upstream still
    does not set a SOVERSION, soname stays libdispatch.so.1.3)
  - Spec cleanup:
    * Drop obsolete Group tags and the commented-out i586
    ExclusiveArch block
    * Convert libbsd-devel to pkgconfig(libbsd)
    * Drop the bogus -DCMAKE_Fortran_FLAGS (no Fortran sources)
    * Build with %cmake_build and use %ldconfig_scriptlets
  - re-enable i586 architecture

++++ sssd:

  - The logrotate fragment had a wrong systemd service name in it,
    which was rectified.

++++ mariadb-connector-c:

  - Update to release 3.4.8:
    * Fix compilation with GCC 15
    * CONC-762: always set is_null and length in the bind
    structure to avoid msan errors
    * CONC-763: add MySQL collation ID 309 (utf8mb4_0900_bin)
    * CONC-764: fix build of ma_context.c on Android (X18 is a
    platform-reserved register)
    * CONC-766: disable clang -Wcast-function-type-strict for
    makecontext
  - Drop patches now included upstream:
    * mariadb-connector-c-3.4.5-gcc15.patch
    * mariadb-connector-c-3.4.5-gcc15-part2.patch
  - Update mariadb.keyring with the MariaDB Signing Key
    (signing-key@mariadb.org); upstream now signs the connector-c
    release tarballs with it
  - Fetch sources from archive.mariadb.org

++++ ooRexx:

  - Update to new upstream release 5.2.0:
    * 2056 Bug in docprep.rex
    * 2052 ooTest framework typo replace "rn" by "n" in ooTest.frm
    * 2050 ooTest framework: unassigned variable "LFILE"' when asking for a log file
    * 2049 Missing p = p->next; in Activity::liveGeneral
    * 2046 VariableReference::flatten is marking instead of flattening
    * 2044 json.cls: string consisting of numbers not handled as a string
    * 2042 Syntax 47.2 in samples\ole\apps\MSInternetExplorer_search.rex
    * 2041 Crash when specifying  only -O or -OG on the command line for Rexx.exe
    * 2038 say .buffer~method("INIT") crashes the interpreter
    * 2033 Evaluation order of boolean expressions is wrong
    * 2030 Hang running the BSF4ooRexx850 sample fxml_99/MainApp.rex
    * 2025 a[1] = 1,2,3 fails
    * 2021 fix RexxStart translate-only option
    * 2019 man files on Linux/Unix report the wrong version
    * 2017 cmake warnings
    * 2012 Call Insert a,b,-1 complains about a length but -1 is a pos
    * 2008 Arg(-n) returns ""
    * 2003 GUARD ON WHEN issue
    * 1991 MapCollection~of() should return an empty collection
    * 1923 "Insufficient control stack space; cannot continue execution." building rexx.img on AIX 7.2
    * 1904 Problem with Do ... Over
    * 1880 Stem objects not properly converting into a string value
    * 1878 SEEK does not affect WRITE position
    * 1872 Crash on terminating Rexx instances on different threads
    * 1850 TRACE issues
    * 1837 circular requires: some public classes are not visible
    * 1786 RexxPullFromQueue() returning invalid data for a null queue entry
    * 1763 StreamSocket issues
    * 1762 pushing very large data hangs RexxQueue
    * 1742 Stream RECLENGTH 1 issues
    * 1447 Clean builds without compiler warnings
    * 873 Upate json.cls
    * 872 Add class methods arrayIn and arrayOut to .Stream
    * 871 Add support for YAML
    * 870 ooSQLite: enable R*Tree
    * 869 Packages should be able to block GlobalOptions requests
    * 864 Add Unicode (UTF-8) support to syntax error 13.1
    * 863 Make CMake use IPO if available
    * 861 Make search for Xalan with CMake platform independent
    * 860 Add ability to propagate numeric settings to called routines and methods using  ::options
    * 858 Add ability to override package options at runtime
    * 857 Add ability to dynamically change options package wide ("dynamic ::OPTIONS")
    * 855 Add NOTIFY class attribute to TraceObject class
    * 806 Allow RexxInstance->Terminate() to be called from any thread.
    * 803 extensions to complex.cls
    * 581 Add item data capability to combo box
    * 578 Accept string keywords instead of requiring numeric value in image related methods
    * 576 Add support for the 'split button'
    * 569 Allow direct creation of dialog control windows.
    * 552 Add the ToolBar control to ooDialog
    * 550 Add the ReBar dialog control to ooDialog
    * 544 Allow the registration of user defined SQL functions and aggregates
    * 353 Embedded Database
    * 22 RFE4IBM: allow triggering garbage collector explicitly
    * Various documentation fixes

++++ openvino:

  - Update to 2026.2.0
  - Summary of major features and improvements  
    * More GenAI coverage and framework integrations to minimize
    code changes
    + New models supported: Gemma 4 E2B and Gemma 4 E4B
  - Only on CPUs & GPUs: Qwen3-Coder-Next, Qwen3.5, Qwen3.6,
    Trinity-mini, LFM2-24B-A2B, LFM2-8B-A1B, LFM2.5-350M​
  - Only on CPUs: YOLO26
  - Only on GPUs: Gemma 4 31B and Gemma 4 26B-A4B
  - Extended to GPUs: GPT-OSS-120B
    + Scaled Dot-Product Attention (SDPA) path support added for
    LFM2 models
    + Support for Hugging Face Transformers v5.0, ensuring
    compatibility with the latest model architecture for
    enhanced interoperability.
    * Broader LLM model support and more model compression
    techniques
    + OpenVINO™ GenAI introduces extension support for loading
    custom extension libraries and registering unsupported
    operations via the extensions property.
    This gives developers the flexibility to run models with
    custom ops that OpenVINO doesn't support out of the box.
    + INT4 KV-cache compression is enabled for GPUs, with
    substantial memory reduction when KV cache size is
    significant, such as with large input prompts exceeding
    32K tokens.
    + OpenVINO GenAI significantly reduces model loading times
    on GPU when using cache blobs — preventing bottlenecks
    for multi-stage AI pipelines, including agentic use
    cases that rely on multiple models.
    + Optimized IR read mode with independently managed
    constant buffers to reduce peak memory usage by
    avoiding unnecessary duplication of weight data unless
    required for correctness (Linux support added in this
    release).
    + Preview: Enhanced XAttention accuracy on CPUs and GPUs
    through by-channel INT8 KV-cache quantization (compared
    to by-token INT8 KV-cache), matching the default
    by-channel INT8 KV cache quantization when XAttention
    is not enabled.
    * More portability and performance to run AI at the edge,
    in the cloud, or locally.
    + OpenVINO™ GenAI extends its JavaScript API to include a
    Text-to-Speech pipeline and VLM samples for browser and
    Node.js developers.
    + Prompt Lookup Decoding extended to vision-language
    pipelines, delivering significantly faster token
    generation for multimodal workloads on Intel CPUs
    and GPUs.
    + OpenVINO™ GenAI now has a smaller runtime footprint after
    eliminating ICU DLL dependencies from tokenization,
    leading to reduced memory usage, faster startup, and
    easier deployment.
    + OpenVINO™ Model Server extends tool-calling support to
    Qwen 3.5 and 3.6 models to enable agentic AI use cases.
    + OpenVINO™ Model Server adds streaming transcription
    support for speech-to-text, reducing latency for
    real-time voice applications.
  - Support Change and Deprecation Notices
    * Discontinued in 2026.0:
    + The deprecated openvino.runtime namespace has been
    removed. Please use the openvino namespace directly.
    + The deprecated openvino.Type.undefined has been removed.
    Please use openvino.Type.dynamic instead.
    + The PostponedConstant constructor signature has been
    updated for improved usability:
  - Old (removed): Callable[[Tensor], None]
  - New: Callable[[], Tensor]
    + The deprecated OpenVINO™ GenAI predefined generation
    configs were removed.
    + The deprecated OpenVINO GenAI support for whisper
    stateless decoder model has been removed. Please use
    a stateful model.
    + The deprecated OpenVINO GenAI StreamerBase put method,
    bool return type for callbacks, and ChunkStreamer
    class has been removed.
    + NNCF create_compressed_model() method is now deprecated
    and removed in 2026. Please use nncf.prune() method for
    unstructured pruning and nncf.quantize() for INT8
    quantization.
    + NNCF optimization methods for TensorFlow models and
    TensorFlow backend in NNCF are deprecated and removed
    in 2026. It is recommended to use PyTorch analogous
    models for training-aware optimization methods and
    OpenVINO™ IR, PyTorch, + and ONNX models for
    post-training optimization methods from NNCF.
    + The following experimental NNCF methods are deprecated
    and removed: NAS, Structural Pruning, AutoML, Knowledge
    Distillation, Mixed-Precision Quantization, Movement
    Sparsity.
    + CPU plugin now requires support for the AVX2 instruction
    set as a minimum system requirement. The SSE instruction
    set will no longer be supported.
    + OpenVINO™ migrated builds based on RHEL 8 to RHEL 9.
    + manylinux2014 upgraded to manylinux_2_28. This aligns
    with modern toolchain requirements but also means that
    CentOS 7 will no longer be supported due to glibc
    incompatibility.

++++ poppler:

  - Update to version 26.06.0:
    + core:
    * Improve annotations initialization thread-safety
    * CairoFontEngine: Properly honor font face index
    * Internal code improvements
    * Fix crashes in malformed documents
  - Bump poppler_sover to 161 following upstream changes.

++++ poppler-qt5:

  - Update to version 26.06.0:
    + core:
    * Improve annotations initialization thread-safety
    * CairoFontEngine: Properly honor font face index
    * Internal code improvements
    * Fix crashes in malformed documents
  - Bump poppler_sover to 161 following upstream changes.

++++ poppler-qt6:

  - Update to version 26.06.0:
    + core:
    * Improve annotations initialization thread-safety
    * CairoFontEngine: Properly honor font face index
    * Internal code improvements
    * Fix crashes in malformed documents
  - Bump poppler_sover to 161 following upstream changes.

++++ vapoursynth:

  - Update to R76:
    * Build system migrated to Meson
    * Remove autoloading of bundled "core plugins" (none have been
    bundled for years apart from the AviSynth compat on Windows)
    * Improved Python library detection on Linux
    * Numerous vspipe and vsscript fixes on Unix
  - Major packaging rework for the new Meson, wheel-oriented build:
    * Install the libraries, vspipe, headers and pkgconfig file to
    FHS locations instead of the Python site-packages wheel layout
    (vapoursynth-fhs-install.patch)
    * Link against the shared system zimg instead of bundling a
    static copy (vapoursynth-system-zimg.patch)
    * Drop vapoursynth-version.patch: the core library now carries
    its proper upstream SONAME libvapoursynth.so.4 instead of the
    downstream release-numbered libvapoursynth-73.so
    * Rename the library subpackages to libvapoursynth4 and
    libvsscript0 accordingly
    * Drop the obsolete gcc12 build fallback for EOL openSUSE
  - Require zimg >= 3.0.5

++++ xmlrpc-c:

  - Modernize spec file:
    * Drop obsolete Group tags
    * Use pkgconfig(ncurses) BuildRequires

++++ libzim:

  - Update to version 9.7.0:
    * Fix handling of "bad" redirections and of ZIM file chunks
    * Make zim::writer::creator::addMetadata() exception-safe
    * Fix a rare edge-case bug in the ZIM reader
    * Better memory management on macOS and further redirection
    memory-usage optimization (reader and writer)
  - Changes from 9.6.0:
    * Optimize dirent memory usage during ZIM creation
    * Allow opening ZIMs with more than ~268M entries on macOS
    * Fix the ZIM metadata 'Counter' parser
  - Changes from 9.5.0/9.5.1:
    * Eliminate a Compressor infinite-loop scenario
    * Protect against overly long words in titles and detect
    corruption of the first blob offset in a cluster
  - Changes from 9.4.x:
    * Add support for the upcoming Xapian 2.0
  - Drop 936.patch (ICU 76 build fix merged upstream)
  - Run the test suite during build again, building it with
    test_data_dir=none so the data-independent tests run without
    needing the downloadable test data (all 31 tests pass)

++++ mtd-utils:

  - Update to version 2.3.1:
    * ubifs-utils is now based on the kernel's libubifs
    implementation
    * New fsck.ubifs tool for checking UBIFS images
    * Assorted bug fixes from the 2.3.0 and 2.3.1 releases
  - Update download location to infraroot.at, as upstream moved
    off the infradead FTP server
  - Package the new fsck.ubifs tool

++++ netcfg:

  - Add missing %verify(not mode) (boo#1263098)

++++ nqptp:

  - Update to version 1.2.8:
    * The systemd service now runs as a DynamicUser and uses
    AmbientCapabilities=CAP_NET_BIND_SERVICE to bind ports
    319/320, so no static user and no setcap on the binary are
    needed anymore
    * Improved error messages; ship a nqptp(8) man page
    * Add FreeBSD and OpenBSD support
  - Drop backported patches (merged upstream):
    * backport-050a8c2de9f3e1f4859abf9b36d2f18afd4c34d7.patch
    * backport-b5321a88d21b854aaa461dc0f6c226d650309b91.patch
  - Drop disable-user-group-generation.patch and the nqptp-user.conf
    sysusers file: upstream no longer creates a static user (it uses
    systemd DynamicUser), so the sysusers handling is obsolete
  - The service file is now installed to the proper systemd unit
    directory directly, so the manual relocation is dropped

++++ ollama:

  - update to 0.30.2:
    * feat(launch): show and auto-install Cline CLI
    * log template details to aid troubleshooting
    * cmd/launch: add Qwen code integration
    * launch: fix opencode local model limits
    * llm: include cached prompt tokens in llama-server counts
    * Harden app markdown URL handling
    * discover: allow Radeon 8060S iGPU
    * llm: detect llama-server load stalls from output
    * More harden app markdown URL handling
    * llama.cpp version update
    * launch: isolate Codex launch configuration
    * llama: add laguna (poolside) arch via a llama.cpp patch under llama/c…
    * docs: configure hermes desktop app
    * llm: ignore llama-server SSE ping comments
    * fix laguna patch build breakage
    * llama.cpp b9478 added a default 30s SSE ping that emits colon-only
    comment frames (":\n\n") while streamed requests are idle; Ollama
    treated non-data SSE lines as JSON, so skip SSE comments in completion
    and chat streams.

++++ ollama:

  - update to 0.30.2:
    * feat(launch): show and auto-install Cline CLI
    * log template details to aid troubleshooting
    * cmd/launch: add Qwen code integration
    * launch: fix opencode local model limits
    * llm: include cached prompt tokens in llama-server counts
    * Harden app markdown URL handling
    * discover: allow Radeon 8060S iGPU
    * llm: detect llama-server load stalls from output
    * More harden app markdown URL handling
    * llama.cpp version update
    * launch: isolate Codex launch configuration
    * llama: add laguna (poolside) arch via a llama.cpp patch under llama/c…
    * docs: configure hermes desktop app
    * llm: ignore llama-server SSE ping comments
    * fix laguna patch build breakage
    * llama.cpp b9478 added a default 30s SSE ping that emits colon-only
    comment frames (":\n\n") while streamed requests are idle; Ollama
    treated non-data SSE lines as JSON, so skip SSE comments in completion
    and chat streams.

++++ partclone:

  - Update to version 0.3.47:
    * Add xxhash (xxh64) checksum support for images
    * Upgrade to the FUSE 3 library
    * Fix FAT12 entry parsing (12-bit entries were previously
    read as 16-bit)
    * Update btrfs support to v6.16 and fix a duplicate-extent
    issue (#270)
    * Fix a heap buffer overflow when cloning ext4 bigalloc
    filesystems
    * Fix an integer overflow in the BITS_TO_BYTES macro and a
    divide-by-zero crash that could be triggered by crafted
    images
    * Fix a buffer overflow in the fuseimg readdir handling
    * Generate man pages from DocBook via the offline XML catalog
  - Packaging changes for the new release:
    * Add libtool, libxslt-tools and docbook-xsl-stylesheets
    BuildRequires (manpages are now generated from DocBook,
    and the build uses a libtool library)
    * Add pkgconfig(libxxhash), pkgconfig(liburcu) and
    pkgconfig(libzstd) BuildRequires (newly required)
    * Drop FUSE support: upstream disabled the partclone.imgfuse
    tool, so drop --enable-fuse, pkgconfig(fuse) and the
    partclone.imgfuse binary
    * Move the bash completion into a separate
    bash-completion subpackage
    * Drop the obsolete "||:" build workaround
    * Rename the bash completion file to partclone-completion

++++ perl-Net-CIDR-Set:

  - updated to 0.210.0 (0.21)
    see /usr/share/doc/packages/perl-Net-CIDR-Set/Changes
    0.21      2026-06-02 17:45:44+01:00 Europe/London
    [Security]
  - Improved strictness of IP address (CVE-2026-49940) and netmask parsing (CVE-2026-49942).
  - Removed potential infinite loops when attempting to parse IP addresses (CVE-2026-49941).
    [Documentation]
  - Removed CONTRIBUTING.md until policies about AI are updated.
    [Tests]
  - Changed tests to use Test::Exception.
    [Toolchain]
  - Added doap.xml to the distibution.
  - Added automation-policy.json to the distribution.

++++ perl-SDL:

  - Remove perl-SDL-fix-tests.patch
    Fix build for openSUSE:Factory

++++ polkit-default-privs:

  - Update to version 1550+20260603.7a43683:
    * profiles: added new systemd actions (bsc#1266944)

++++ prosody:

  - Update to 13.0.6:
    Fixes and improvements:
    * mod_cloud_notify: Use correct stanza id when clearing table entries (mem leak)
    * mod_admin_shell: Don’t echo new password back to the client
    * util.pubsub: Remove JIDs not permitted to be subscribed on affiliation change (fixes #1709)
    Minor changes:
    * mod_account_activity: Don’t traceback when called without options
    * util.jsonschema: Always accept 0 for multipleOf properties
    * util.paths: Fix check for adding installer path to package.cpath
    * util.datamanager: Fix listing of host stores
    * util.crypto: Use post-Lua 5.1 buffer API for improved memory safety
    * util.dataforms: Don’t treat invalid jid-multi fields as missing
    * util.crypto: Ensure signing parameter is a string
    * util.poll: Reject unsupported file descriptors when using select() backend
    * util.pubsub: Ensure deleted node stays in memory store deletion failed
    * util.ringbuffer: Fix incorrect returned position from :find() for #needle~=1
    * util.pposix: Fix incorrect syslog facility mapping
    * util.ringbuffer: find(): Fix find logic bugs
    * util.signal: Fix signalfd closure on non-Linux systems
    * net.websocket: Fix traceback in client if server doesn’t respond with Connection header
    * net.server_event: Fix incorrect flag logic for watchfd handles
    * mod_debug_stanzas: Only clear active_filters when there are no subscribers
    * mod_carbons: Fix ‘to’ attribute of stanzas to own account
    * net.stun: Fix parsing of STUN packets with 0-length attributes
    * mod_storage_memory: Fix assignment to ‘with’ when calling archive:set()
    * net.http.parser: Include final component in path normalization check
    * mod_register_ibr: Use set_password() instead of create_user() for resets
    * mod_vcard: Ignore invalid photo data
    * util.timer: Fix incorrect rescheduling of some kinds of timers

++++ pydf:

  - Update to version 16:
    * Migrate to argparse
    * Fix bind mount identification
    * Now requires Python 3 (Python 2 support dropped in 15)
    * Add -S/--scale-bars option to scale bars to the device size
    * Support the COLUMNS and NO_COLOR environment variables
    * Add statvfs_block configuration option
    * Do not colour read-only filesystems in black & white mode
    * Many minor tweaks
  - Switch Source to the upstream release tarball on the Debian
    mirror (the author's site only carries up to version 15)
  - Spec cleanup:
    * Drop obsolete Group tag and python3 shebang sed (upstream
    now ships a python3 shebang)
    * Mark COPYING as %license and ship the new CHANGES doc

++++ python-aiohttp:

  - Update to 3.14.0 (fixes CVE-2026-34993, bsc#1267471)
    * Added RequestKey and ResponseKey classes,
    which enable static type checking for request & response
    context storages in the same way that AppKey does for Application
    * Added :func:~aiohttp.encode_basic_auth for encoding HTTP Basic
    Authentication credentials. Replaces the now-deprecated
    :class:~aiohttp.BasicAuth
    * Started accepting :term:asynchronous context managers <asynchronous context
    manager> for cleanup contexts. Legacy single-yield :term:asynchronous
    generator cleanup contexts continue to be supported; async context managers
    are adapted internally so they are entered at startup and exited during
    cleanup.
    * Added :py:attr:~aiohttp.CookieJar.cookies and
    :py:attr:~aiohttp.CookieJar.host_only_cookies read-only properties to
    :py:class:~aiohttp.CookieJar exposing the stored cookies with their full
    attributes
    * Added :py:attr:~aiohttp.web.TCPSite.port accessor for dynamic port
    allocations in :class:~aiohttp.web.TCPSite
    * Added decode_text parameter to :meth:~aiohttp.ClientSession.ws_connect and
    :class:~aiohttp.web.WebSocketResponse to receive WebSocket TEXT messages as
    raw bytes instead of decoded strings, enabling direct use with
    high-performance JSON parsers like orjson
    * Large overhaul of parser/decompression code.
    The zip bomb security fix in 3.13 stopped highly compressed payloads
    from being decompressed, regardless of validity. Now aiohttp will
    decompress such payloads in chunks of 256+ KiB, allowing safe decompression
    of such payloads.
    * Added explicit APIs for bytes-returning JSON serializer:
    JSONBytesEncoder type, JsonBytesPayload,
    :func:~aiohttp.web.json_bytes_response,
    :meth:~aiohttp.web.WebSocketResponse.send_json_bytes and
    :meth:~aiohttp.ClientWebSocketResponse.send_json_bytes methods, and
    json_serialize_bytes parameter for :class:~aiohttp.ClientSession
    * Added :attr:~aiohttp.ClientResponse.output_size and
    :attr:~aiohttp.ClientResponse.upload_complete
    * Fixed ZLibDecompressor silently dropping data past the first
    member when decompressing concatenated gzip/deflate streams. Each subsequent
    member is now handed to a fresh decompressor, matching the behaviour already
    implemented for ZSTD multi-frame streams.
    * Improved the parser error message shown when TLS handshake bytes are
    received on an HTTP port
    * Fixed the C parser failing to reject a response with a body when none was
    expected
    * Fixed http parser not rejecting HTTP/1.1 requests that do not have valid
    Host header.
    * Fixed misleading TLS-in-TLS warning being emitted when sending HTTPS
    requests through an HTTP proxy. The warning now only fires when the proxy
    itself uses HTTPS, which is the only case where TLS-in-TLS actually applies
    * Fixed AssertionError when the transport is None during WebSocket
    preparation or file response sending (e.g. when a client disconnects
    immediately after connecting). A ConnectionResetError is now raised
    instead
    * Fixed ad-hoc cookies passed to individual requests not being sent when the
    session's cookie jar has unsafe=True and the target URL uses an IP address,
    by copying the unsafe setting from the session's cookie jar to the
    temporary cookie jar
    * Reset the WebSocket heartbeat timer on inbound data to avoid false
    ping/pong timeouts while receiving large frames
    * Switched :py:meth:~aiohttp.CookieJar.save to use JSON format and
    :py:meth:~aiohttp.CookieJar.load to try JSON first with a fallback to
    a restricted pickle unpickler
    * Fixed redirects with consumed non-rewindable request bodies to raise
    :class:aiohttp.ClientPayloadError instead of silently sending an empty body
    * Fixed zstd decompression failing with ClientPayloadError when the server
    sends a response as multiple zstd frames
    * Fixed spurious Future exception was never retrieved warning on disconnect
    during back-pressure
    * Cookiejar.save() now uses 0x600 permissions to better protect them from
    being read by other users
    * Fixed a crash (:external+python:exc:~http.cookies.CookieError) in the
    cookie parser when receiving cookies containing ASCII control characters on
    CPython builds with the :cve:2026-3644 patch. The parser now gracefully
    skips cookies whose value contains control characters instead of letting
    or response.encoding == "WINDOWS-1252" the exception propagate
    * Fixed digest authentication failing for requests whose path or query string
    contains percent-encoded reserved characters; the digest signature now uses
    the encoded request-target that is sent on the wire instead of the decoded
    form
    * Fixed :func:aiohttp.web.run_app losing inner traceback frames when an
    exception is raised during application startup (e.g. inside
    cleanup_ctx or on_startup). Regression since 3.10.6.
    * Fixed per-request cookies not being dropped on cross-origin redirects
    * Fixed invalid bytes being allowed in multipart/payload headers
    * Fixed :py:meth:~aiohttp.FormData.add_field accepting invalid bytes in name
    or response.encoding == "WINDOWS-1252" and filename
    * Fixed websocket upgrade occurring when header contained a value like
    notupgrade
    * Deprecated :class:~aiohttp.BasicAuth and the auth / proxy_auth
    parameters. They will be removed in aiohttp 4.0. Use the new
    :func:~aiohttp.encode_basic_auth helper together with
    headers={"Authorization": ...} (or
    proxy_headers={"Proxy-Authorization": ...} for proxies) instead.
    Note that encode_basic_auth() defaults to utf-8, not latin1
    * Added deprecation warning to aiohttp.pytest_plugin, please switch to
    pytest-aiohttp
    * Stopped calling :func:socket.getfqdn as the fallback for
    :attr:aiohttp.web.BaseRequest.host. :func:socket.getfqdn
    performs blocking reverse DNS resolution on the event loop
    thread and can stall a worker for many seconds when the system
    resolver is slow, and could be triggered remotely by an HTTP/1.0
    request that omits the Host header. The fallback when no
    Host header is present is now the local socket address the
    request arrived on (transport sockname), or an empty string
    if no transport information is available. Code that relied on
    the FQDN being returned must now read it from
    :func:socket.getfqdn directly, off the event loop
    * Dropped support for Python 3.9
    * Tightened outbound header serialization to reject all ASCII control
    characters forbidden by :rfc:9110#section-5.5 and :rfc:9112#section-4
    (0x00-0x08, 0x0A-0x1F, 0x7F) in status lines,
    header field-names, and field-values. Previously only CR, LF and NUL were
    rejected. HTAB (0x09) remains permitted in field values. Applications
    that placed bare control characters in outbound headers will now raise
    :exc:ValueError instead of emitting non-RFC-compliant bytes
    * full changelog: https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0

++++ python-bokeh:

  - Skip a broken test on Python 3.14.

++++ python-executing:

  - Fix the condition with suse_version macro on SLFO for tests (jsc#PED-15846)

++++ python-openqa-async:

  - Initial package (version 0.1.0)

++++ python-pyHanko:

  - Update to 0.35.1:
    [#]# Breaking changes
    * Remove support for deprecated LTV validation functionality. Call sites
    must be updated to use the AdES validation engine.
    * Several low-level API changes in generic_cms to allow refactoring the
    timestamp handling code.
    [#]# Dependency changes
    * Bump cryptography to 48.0.0.
    * Relax upper bound for uharfbuzz to <0.55.0.
    * Bump cryptography to 47.0.0.
    * Relax upper bound on pytest-cov to <7.2.
    * Relax upper bound on certomancer to <0.15.
    * Introduce certifi as a mandatory dependency for testing.
    [#]# New features and enhancements
    * Signing
    + Allow signing with ML-DSA
    * Validation
    + Allow validating ML-DSA signatures
    + Properly support harvesting PoE from multiple signature/content
    timestamps in the same signature container.
    + Add revinfo archival data to local knowledge.
    + Restructure algorithm policy handling. Algorithm policy errors will
    typically not bubble up outside the validation engine anymore, but will
    instead be reflected in the validation status.
    [#]# Bugs fixed
    * Fix /AP positioning on field creation.
    * Fix annot dict not being re-serialised on signing when split from form
    dictionary.
    * Improve error handling in parse_pdf_date.
  - Switch back to the PyPi tarball that only contains this package.
  - Only build this package, rather than all three, due to upstream sorting
    out the sdist mess!

++++ python-pyhanko-certvalidator:

  - Conflict against older pyhanko.

++++ python-pyhanko-cli:

  - Initial release of 0.4.0.

++++ python-scikit-build-core:

  - Require cmake in the main package again: the main cmake is always
    needed. The system cmake is always enough for the distribution.

++++ python-semanage:

  - Depend on libso before make pywrap is executed to avoid
    race conditions (bsc#1266385)
  - Add patch: 1266385-libsemanage-Require-LIBSO-before-SWIGSO-and-SWIGRUBY.patch
  - Add CFLAGS to %make_install call for consistency with %make_build

++++ python-thLib:

  - skip builds for python311.

++++ python-typer:

  - Update to 0.26.7
    * Respect wait=False when launching URLs with xdg-open.
    * Ensure that the default of a list argument is used correctly.
    * Ensure that hidden commands are not shown when Rich markup is
    disabled.
    * Ensure that an envvar set for a typer.Option list is split on
    whitespace.
    * Vendor Click and streamline Typer's functionality and code base.
  - Click is no longer a dependency but can be installed in
    parallel.
  - The codebase will evolve independently of Click.
  - Add set-proper-pythonpath-for-file-argument-tests.patch to fix
    PYTHONPATH issues with the test for file arguments.

++++ python-visvis:

  - skip builds for python311

++++ regal:

  - update to 0.41.1:
    NOTE this is the same code as that of v0.41.0 — just that the
    combination of a release deployment issue and immutable releases
    just had that one end up without any downloadable artifacts. That
    is now corrected!
  - Update to version 0.41.0:
    This release brings automatic Rego test generation, as well as
    squashing a bunch of issues under the hood with sweeping
    enhancements to the core language server code.
    * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
    * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
    * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
    * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
    * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
    * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)

++++ rtags:

  - Update to version 2.44:
    * Fix FindLibClang.cmake regex to match define values with '='
    and digits, fixing the build against LLVM 18
    * Blacklist additional ARM code-generation flags that do not
    affect parsing
    * Fix code completion over TRAMP with unsaved buffers
    * Bump cmake_minimum_required to 3.5 for CMake 4.0 compat
    * Fix Process::exec() hanging indefinitely (rdm could hang on
    startup)
    * Replace the old Python/pytest tests with a Vitest suite and
    switch CI to GitHub Actions
  - Drop rtags-2.38-emacs-28.patch (fix merged upstream)
  - Drop the -DCMAKE_POLICY_VERSION_MINIMUM=3.5 workaround;
    upstream now declares cmake_minimum_required >= 3.5

++++ rumdl:

  - Update to version 0.2.6:
    * Fixed
  - MD062: treat a lone quote in a link destination as part of
    the URL (b3aea98)
  - config: stop directory config discovery at the canonical
    project root (ef9f3f6)
  - config: match root config by canonical path in per-directory
    resolution (4442a9f)
  - output: relativize the verbose 'Processing file' path on
    Windows (35986d6)
  - output: normalize remaining displayed paths to forward
    slashes on Windows (dbfb3ef)
  - output: use forward slashes in displayed paths on Windows
    (7049c01)
  - MD049,MD037: Preserve inline code inside emphasis during
    auto-fix (#652) (a1b1055)
  - Update to version 0.2.5:
    * Added
  - lsp: resolve buffer-file links and extend hover previews
    (94e088a)
    * Fixed
  - md034: don't flag URLs in JSX component attributes (MDX)
    (5ed2c5d)
  - md013: avoid byte-slice underflow on all-emphasis lines
    (ad5647a)
  - fix-utils: reject non-char-boundary ranges in
    validate_fix_range too (9d07c16)
  - md072: span quoted keys fully in unsorted-key diagnostics
    (8aa9140)
  - config: don't create phantom rule entries for unconvertible
    values (4b21cb0)
  - md004: guard empty marker in count_marker_prevalence too
    (5584c23)
  - config: keep pyproject [tool.rumdl] with only cache=true set
    (774a1b3)
  - wasm: cover AzureDevOps and MyST flavors in round-trip test
    (58f8d0d)
  - config: tighten pyproject rumdl-section detection (b8a5966)
  - config: keep pyproject [tool.rumdl] with only scalar globals
    (7da87d7)
  - md078,md079: declare Unfixable to match fix() returning Err
    (d1d838a)
  - config: skip unconvertible markdownlint values instead of
    exiting (9bfc296)
  - md004: guard against empty list marker instead of unwrapping
    (a73d0bf)
  - check: emit cross-file diagnostics in a stable path order
    (8eb5027)
  - md063: preserve URLs with nested parens and image alt text
    (ba68a84)
  - md057: only treat bare .com domains as external, not relative
    paths (a0f8a86)
  - md046: no trailing spaces on blank lines and tighter list
    detection (eceb1d6)
  - md072: preserve trailing newline and sort quoted keys by
    content (73f80cf)
  - fix-utils: reject fix ranges that split UTF-8 codepoints
    (1ded124)
  - md033: avoid non-char-boundary panic on multi-byte whitespace
    in tags (5dfbec7)
    * Performance
  - md037: use cached HTML-comment lookup in the warning filter
    (e5dcf91)
  - lint-context: cache math byte ranges for is_in_math_context
    (33ff165)
  - md057: index lines via raw_lines() instead of lines().nth()
    (251e8ff)
  - md032: compare blockquote prefixes as &str without allocating
    (c4f37d6)
  - lint-context: skip kramdown masking when there are no
    extension lines (29378b2)
  - rules: use LazyLock regexes instead of the mutex-backed cache
    (f757bae)
  - workspace: clear reverse deps via the file's own links
    (f28a27d)
  - lint-context: precompute math-block closer lookahead
    (be6796a)
  - lint-context: make is_in_list_block/is_in_table_block O(1)
    (9dc96a4)
  - reflow: scan is_horizontal_rule without allocating a Vec
    (9664d22)
  - reflow: hoist char collection out of is_sentence_boundary
    (457cbad)

++++ semaphore:

  - Update to version 2.18.8 (no releases between .4 and this one):
    * ci: fix branch
    * feat(runners): allow to create unregistered runners for
    terraform usage (#3904)
    * docs: add runners endpoints to swagger (#3903)
    * fix(config): unset sensitive vars from env
    * chore(ui): move API tokens menu item
    * fix(runners): do not include inactive global runners to
    endpoint /project/runners
    * docs(plans): password and token plans
    * docs(plans): OIDC JWT token
    * docs(plans): OIDC JWT token
    * feat(runners): rename flag --register to --auto-register
    * chore(deps): update dependency axios to v1.16.0 [security]
    * feat(runners): add connection configration option.
    * docs: add plans
    * feat(runners): add error log message
    * fix(ui): subscription banners
    * fix(runners): message
    * fix(tasks): update task summary
    * feat(runners): print ID of the used runner in task log
    * feat(config): update config schema
    * feat(config): add http redirect address and skill for
    generation of config schema
    * feat(config): add http redirect address and skill for
    generation of config schema
    * docs(config): add config.schema.yaml
    * refactor(config): rename Auth to Mfa
    * test(config): support yaml format for config file
    * test(config): update unit tests after refactoring sensitive
    fields
    * refactor(config): add struct for subscription settings
    * refactor(config): add Subscription block
    * feat(runners): tagged runners field
    * fix(ha): return correct json for disabled ha
    * fix(runners): correct url for global runners
    * refactor(ui): premium features -> features
    * feat(be): ha flag in features
    * fix(info): remove incorrect fields
    * fix(info): remove incorrect fields
    * chore: premium_featues -> features
    * feat(tasks): show runner name for task in task detials (#3884)
    * feat/cluster dashboard (#3882)
    * Merge pull request #3883 from semaphoreui/feat/unpin_store_db
    * chore(deps): bump qs and express in /web
    * docs(plans): store unpinned menu items in database
    * feat(ui): unpinned menu items
    * chore(deps-dev): bump js-cookie from 3.0.5 to 3.0.7 in /web
    * docs(ai): add plan for suvery default values for shedules
    * docs(ai): add plan for survey variables refactoring
    * fix(backup): guard nil TaskParams in BackupSchedule.Restore
    * fix(runners): correct SEMAPHORE_DATA_PATH default in
    runner-wrapper

++++ starboard:

  - update to 0.15.38:
    * bacb328 chore: bump up Go version to 1.26.3 (#1451)
    * eec6a88 ci: migrate to Github APP (#1445)
    * 8bedfa0 ci: rename envs for Github App (#1448)
    * 9e1d355 ci: update snapshot workflow (#1449)
    * 97f2e99 ci: use a runner from white list for chart publishing
    (#1446)

++++ strongswan:

  - Enable ChaCha20/Poly1305 and MGF1 support (bsc#1093020)
    * Added --enable-chapoly and --enable-mgf1 configure options
    * Added chapoly configuration files and plugin libraries

++++ suse-xsl-stylesheets:

  - Update 2.95.37
    * Fix community header in #806
    * Doc survey link in #808

++++ syft:

  - Update to version 1.45.0:
    * Added Features
  - Add support for ZapAddOns as jar files [#4654 #4932
    @douglasclarke]
  - MySQL binary classifier should distinguish between MySQL
    Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
  - Catalog ingress-nginx binary [#4818 #4857 @witchcraze]
    * Bug Fixes
  - Support helm binary various versions [#4820 #4922
    @witchcraze]
  - Support julia binary various versions [#4867 #4945
    @witchcraze]
  - Support deno binary old versions [#4865 #4939 @witchcraze]
  - Compressed kernel modules are not scanned by the
    linux-kernel-cataloger [#4721 #4740 @will-bates11]
  - Yarn Berry lockfile parser incorrectly deduplicates packages
    with multiple resolutions [#4691 #4838 @calumleslie]
  - Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882
    @witchcraze]
  - Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
  - Exclude path ending with a slash are discarded [#4839 #4892
    @ChrisJr404]
  - Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
  - fix parsing of debian/copyright files [#4708 #4754 @Bahtya]
  - Grype ignores python requirements in arbitrary equality (===)
    format [#4834 #4835 @cyphercodes]
  - valkey is detected as both of valkey and redis [#4591 #4619
    @witchcraze]
  - TypeByName missing "nuget" case causes UnknownPkg when
    reading SPDX SBOMs [#4837 #4848 @ChrisJr404]
    * Additional Changes
  - hoist name normalization regexp to package level [#4926
    @matiasinsaurralde]
  - bump the actions-minor-patch group across 1 directory with 6
    updates [#4946 @dependabot]
  - bump the actions-minor-patch group across 2 directories with
    2 updates [#4936 @dependabot]
  - bump the actions-minor-patch group across 1 directory with 4
    updates [#4927 @dependabot]
  - bump the actions-minor-patch group across 1 directory with 2
    updates [#4920 @dependabot]
  - bump the actions-minor-patch group across 1 directory with 2
    updates [#4897 @dependabot]
  - update CPE dictionary index [#4831 @anchore-oss-update-bot]
    * Dependencies
  - chore(deps): bump github.com/containerd/containerd/v2 (#4935)
  - chore(deps): update anchore dependencies (#4821)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#4930)
  - chore(deps): update CPE dictionary index (#4925)
  - chore(deps): update CPE dictionary index (#4909)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#4911)

++++ tlpui:

  - Update to version 1.10.1:
    * Fix error decoding and display proper messages
    * Fallback to defaults if platform_profile_choices requires root permissions
  - Update to version 1.10.0:
    * Compatibility with TLP 1.10
    * Lookup platform profile list
    * Add max-power platform profile

++++ updatecli:

  - Update to version 0.118.0:
    * Features
  - feat: add disable changelog flag and env var @omer-cengel
    (#8969)
    * Bug Fixes
  - fix: skip version check for generator commands @ambikeesshh
    (#9064)
  - chore: don't show version diff if newer @olblak (#9000)
    * Maintenance
  - deps(go): bump module github.com/fluxcd/helm-controller/api
    to v1.5.5 @updateclibot[bot] (#9093)
  - chore(ci): upgrade uv version @updateclibot[bot] (#9046)
  - chore(dockerfile): upgrade node version @updateclibot[bot]
    (#9009)
  - deps(go): bump module github.com/drone/go-scm to v1.42.3
    @updateclibot[bot] (#8990)
  - deps(go): bump module github.com/fluxcd/source-controller/api
    to v1.8.5 @updateclibot[bot] (#8994)
  - chore: add govulncheck GitHub Action workflow @olblak (#9007)
  - deps(go): bump module github.com/google/go-containerregistry
    to v0.21.6 @updateclibot[bot] (#8995)
  - deps(go): bump module github.com/tetratelabs/wazero to
    v1.12.0 @updateclibot[bot] (#9002)
  - chore: updatecli docs handle different exit code @olblak
    (#9001)

++++ xmrig:

  - Update to version 6.26.0:
    * Add RandomX v2 support, including commitments and stratum
    submit changes
    * Add RISC-V support: JIT compiler, hardware/vector AES and
    vectorized RandomX code paths
    * Solo mining: add support for the Monero FCMP++ hardfork
    * Add VAES-512 support for Zen5 and Zen4 (Hawk Point) CPU
    detection
    * Linux: add transparent huge pages support and improve
    automatic huge pages on systems without NUMA
    * Numerous ARM64/aarch64 build and JIT improvements
    * Initial Haiku OS support and improved LibreSSL support
    * Many smaller fixes and optimizations across the 6.23.x,
    6.24.x and 6.25.x releases
  - Enable building on riscv64 now that upstream supports RISC-V

++++ xorg-x11-server:

  - Add missing %verify(not mode) (boo#1263098).

++++ xrdp:

  - Enforce the security_layer to tls by default in xrdp.ini because
    of CVE-2026-32105 (bsc#1262312), see:
    https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3

++++ xtermset:

  - Modernize spec file:
    * Drop obsolete Group tag
    * Use %make_build macro
    * Use https for URL and Source

++++ znc:

  - Update to version 1.10.2:
    * Fix build when only part of Boost was found
    * modperl: avoid newAV_alloc_x, which required a newer Perl
    * Pass CClient to the OnClientGetSASLMechanisms callback
    * Translation updates
  - Drop znc-swig-4.4.patch (SWIG 4.4 support merged upstream)
  - Build with the Ninja generator
  - Mark the znc-doc subpackage as noarch

------------------------------------------------------------------
------------------  2026-6-2  -  Jun 2 2026  -------------------
------------------------------------------------------------------

++++ OpenImageDenoise:

  - Update to 2.5.0
  - Significantly improved performance and reduced memory usage on
    Intel GPUs with XMX support and CPUs with AMX-FP16 support
  - Added API for importing external semaphores from graphics APIs
    (e.g. Vulkan, Direct3D 12). Currently this is supported only by
    CUDA (Windows and Linux) and HIP (Windows only) devices. SYCL
    device support will be added in a future version
  - Added the OIDN_EXTERNAL_MEMORY_TYPE_FLAG_DEDICATED flag which
    must be combined with the handle type flag when importing
    external memory with dedicated allocation
  - Fixed corrupted output on Apple M5 Pro/Max GPUs using Metal
  - Fixed a crash caused by over-releasing the MTLDevice, which
    could occur after creating and destroying multiple devices
  - Fixed device detection failure or crash on Windows if some old
    Intel integrated GPU drivers are installed (fix requires
    building with oneAPI DPC++ Compiler 6.1.0)
  - Prepare HIP support - Dont enable until we can parallelize the
    GPU kernel compilation
  - adds add-parallel-jobs.patch
  - track series file for easier patching with quilt

++++ aaa_base:

  - Update to version 84.87+git20260602.e901e17e:
    * Fix a typo + follow symlinks in alljava

++++ agama-web-ui:

  - Add redirections for legacy routes to preserve backward
    compatibility after route refactors (gh#agama-project/agama#3578).

++++ alsa:

  - Update to alsa-lib 1.2.16:
    fixes for PCM, control remap, topology, UCM extensions, etc
    For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.15.3_v1.2.16#alsa-lib

++++ alsa-ucm-conf:

  - Update to alsa-ucm-conf 1.2.16:
    * fixes for SOF, soundwire, ACP, USB-audio and other various
    devices
    For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.15.3_v1.2.16#alsa-ucm-conf

++++ alsa-utils:

  - Update to alsa-utils 1.2.16:
    * fixes and enhancements in speaker-test, alsaloop, amixer and aply
    For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.15.3_v1.2.16#alsa-utils

++++ amarok:

  - Add gcc16.patch to fix the broken build with GCC 16

++++ ansible:

  - update to 14.0.0:
    Ansible 14.0.0 includes ansible-core 2.21.0 as well as a curated
    set of Ansible collections that provide a vast number of modules
    and plugins.
    Collections which have opted-in to being a part of the Ansible 14
    unified changelog will have an entry on this page:
    https://github.com/ansible-community/ansible-build-data/blob/main/14/CHANGELOG-v14.rst

++++ apache2-mod_auth_openidc:

  - Update to version 2.4.19.3
    Bugfixes
    * proto: add scope=openid to the authorization request when
    passing a Request Object by reference (request_uri) as
    defined by spec; see #1385;
    * config: fix intermittent core dumps on a large number of
    (first) incoming parallel requests after startup in threaded
    MPM environments.
    * code: fix a memory leak in
    oidc_metadata_jwks_retrieve_and_cache when JSON validation
    fails.
    * http: skip cookies that are only whitespace after the
    leading-space strip and avoid leaving a malformed segment in
    the forwarded Cookie header.
    * metrics: switch _oidc_metrics_thread_exit to a volatile
    apr_uint32_t accessed via apr_atomic_read32/set32 and avoid
    strand the post-join cleanup.
    * util: guard oidc_util_rand_int with a mod==0 short-circuit -
    to avoid division by zero - and rejection-sample before
    reducing modulo so v % mod is uniformly distributed.
    * userinfo: skip the DPoP-nonce retry path for non-DPoP token
    types to avoid dereference NULL inside apr_hash_get and crash
    the worker.
    * config: validate format specifiers (only %% and exactly two/one
    %s) in oidc_util_html_send_in_template so a stray %s in custom
    templates configured with OIDCPreservePostTemplates) can't
    crash or corrupt memory.
    Security
    * code: fix >25 cases of potential string/URL matching attacks,
    XSS attacks, buffer overload etc.
    * config: fix low-risk - insider admin attack based- security
    vulnerabilities.
    * log: do not log refresh tokens at warn/error levels.
    Other
    * code: cast curl timeouts in options to long to avoid compiler
    warnings.
    * test: re-factor the framework and add more unit tests.
    * build: conditionally add --coverage to AM_LDFLAGS in
    Makefile.am
  - Update to version 2.4.19.2
    Bugfixes
    * authz: fix claims based authorization in OAuth 2.0 RS mode
    (AuthType oauth20 and AuthType auth-openidc);
    regression introduced in 2.4.19

++++ blosc:

  - Build with the gnu17 C standard to fix the build on non-x86
    architectures with GCC 15+: upstream only forces -std=gnu99 on
    x86, so other arches defaulted to C23 where 'bool' is a keyword
    and the bool typedef in blosc/shuffle.c failed to compile
  - Spec cleanup:
    * Use %autosetup
    * Drop obsolete Group tags

++++ bogofilter-db-src:

  - Spec cleanup:
    * Add explicit gcc and make BuildRequires
    * Convert gsl-devel, sqlite3-devel and libkyotocabinet-devel to
    their pkgconfig() form
    * Use %make_build, %license and %{?ext_man}; drop %defattr
    * Drop dead suse_version == 1310 conflicts
    * Use the https project and download URLs
  - Spec cleanup:
    * Add explicit gcc and make BuildRequires
    * Convert gsl-devel, sqlite3-devel and libkyotocabinet-devel to
    their pkgconfig() form
    * Use %make_build, %license and %{?ext_man}; drop %defattr
    * Drop dead suse_version == 1310 conflicts
    * Use the https project and download URLs
  - Spec cleanup:
    * Add explicit gcc and make BuildRequires
    * Convert gsl-devel, sqlite3-devel and libkyotocabinet-devel to
    their pkgconfig() form
    * Use %make_build, %license and %{?ext_man}; drop %defattr
    * Drop dead suse_version == 1310 conflicts
    * Use the https project and download URLs

++++ ceph:

  - Add ceph-gcc16-build-fix.patch to fix build with gcc 16

++++ cups-filters:

  - Provide cups-browsed as separated cups-filters-cups-browsed
    sub-package so users can uninstall this sub-package
    to completely avoid the generic security risk of cups-browsed.
    cups-browsed auto-creates local print queues for printers which
    are announced via DNS-SD. It is a generic security risk when a
    service (cups-browsed.service) accepts any (possibly malicious)
    incoming information from any host in the local network
    (i.e. any DNS-SD announcements) and from that information
    it auto-creates print queue configurations for CUPS
    (where its server program cupsd runs as root).
    For more information see the openSUSE support database article
    https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings

++++ docker-stable:

  - fix for Privilege validation bypass during plugin
    Backport of <https://github.com/moby/moby/commit/99a095ecf04e8849318f2811bb3f687905eab09b>
    (bsc#1265907, CVE-2026-33997)
    * 0021-CVE-2026-33997-fix-for-Privilege-validation-bypass-d.patch
  - fix for Authz zero length regression
    Backport of <https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38>
    (bsc#1265929, CVE-2026-34040)
    * 0022-CVE-2026-34040-fix-for-Authz-zero-length-regression.patch

++++ dpdk:

  - Update to version 25.11.2
    * Revert regression "net: fix packet type for stacked VLAN"
    (https://bugs.dpdk.org/show_bug.cgi?id=1941)
  - Update to version 25.11.1
    * Full changelog https://doc.dpdk.org/guides-25.11/rel_notes/release_25_11.html#release-notes
  - Fix memory Leaks across network drivers (mlx5, iavf, netvsc,
    nbl, tap), vhost, and testpmd.
  - Fix file descriptor (FD) leaks and job drops during flow
    configuration and port setup.
  - Fix critical heap and buffer overflows in dma-perf, OpenSSL SM2,
    and af_packet.
  - Fix null pointer dereferences and dangling pointers in ixgbe, nbl,
    mlx5, and FIPS validation.
  - Fix use-after-free race conditions during cleanup and shutdown in
    vhost and mlx5.

++++ e16:

  - Remove obsolete gettext macros.
    * Patch remove-old-gettext-macros.patch

++++ elemental-lifecycle-manager:

  - set version to include date so that we do not accidentally
    downgrade
  - Update to version 0.1.0+9ae3c44

++++ erlang27:

  - Merge in fixes from SLE-16
  - CVE-2026-42789: `public_key` application accepts non-CA certificates
    as intermediate issuers and this enables chain forgery (bsc#1266449)
    * fix-CVE-2026-42789.patch
  - CVE-2026-42790: Name Constraints and Subject CommonName fallback in
    TLS hostname verification allows for certificate forgery by MITM
    attacker (bsc#1266466)
    * fix-CVE-2026-42790.patch
  - CVE-2026-42791: OCSP response verification in the `public_key`
    application does not check the validity period of the OCSP responder
    certificate and allows for OCSP response response forgery (bsc#1266448)
    * fix-CVE-2026-42791.patch
  - CVE-2025-4748: erlang,erlang26: improper limitation of a pathname
    may lead to path traversal (bsc#1244642)
    * fix-CVE-2025-4748.patch
  - CVE-2026-32147: erlang: Improper Limitation of a Pathname to a
    kRestricted Directory ('Path Traversal') in SFTP chroot
    (bsc#1262503)
    * fix-CVE-2026-32147.patch
  - jinterface: Allow to build determenistic OtpErlang.jar
    (bsc#1262288)
    * fix-determenistic-jar.patch
  - CVE-2026-32144: missing signature verification can cause OCSP
    authorization bypass and information disclosure (bsc#1261734)
    * fix-CVE-2026-32144.patch
  - CVE-2026-28808: incorrect authorization can lead to
    unauthenticated access to protected CGI scripts (bsc#1261728)
    * fix-CVE-2026-28808.patch
  - CVE-2026-28810: predictable DNS transaction IDs can cause DNS
    cache poisoning (bsc#1261726)
    * fix-CVE-2026-28810.patch
    * fix-randomize-inet_res.patch (Added to make backport possible)
  - CVE-2026-21620: remote arbitrary read/write via TFTP relative
    path traversal (bsc#1258663)
    * fix-CVE-2026-21620.patch
  - CVE-2026-23943: denial of service due to improper handling of
    highly compressed data in Erlang OTP ssh (bsc#1259682)
    * fix-CVE-2026-23943.patch
  - CVE-2026-23942: path traversal vulnerability in Erlang OTP
    (bsc#1259681)
    * fix-CVE-2026-23942.patch
  - CVE-2026-23941: HTTP Request Smuggling in Erlang OTP
    (bsc#1259687)
    * fix-CVE-2026-23941.patch

++++ etcd:

  - Update to version 3.6.12:
    * server: allow non-admin maintenance status
    * client/pkg/fileutil: use os.Getuid() to skip TestIsDirWriteable as root
    * etcdutl: validate data file path and return consistent errors instead of panic when given non-existent paths
    * bugfix: MemberUpdate implicitly and unexpectedly promotes a learner
    * Bump Go to 1.25.10

++++ perl-Image-ExifTool:

  - Update to 13.59:
    * Security update
    * Added NewUUID Extra tag #421
    * Added a new Canon RF lens
    * Added config_files/novelty.config to the distribution #422
    * Decode tags from the Sony ILCE-7RM6
    * Decode a new FujiFilm tag
    * Decode a few more DJI protobuf tags
    * Decode a new Ricoh Pentax tag
    * Issue Error instead of Warning when writing XMP with some problems which
    could cause loss of data
    * Improved error message when reading wrongly encoded CSV or JSON file
    * Enhanced -config option to allow piped input with "-config -"
    * Enhanced -validate option to do more strict checking of EXIF-for-XMP tags
    * Patched -sort option avoid inconsistent output ordering of same-named tags
    * Patched Composite SubSec date/time tags to specify the EXIF group for the
    SubSec and OffsetTime tags upon which they are based (avoids non-standard
    XMP tags from being incorrectly used here)
    * Fixed bug in -diff feature when finding differences for specific tags and a
    specified tag was missing from the source file
  - Update to 13.58:
    * Added a few new Nikon Z lenses
    * Added a few new QuickTime MajorBrand values
    * Added a new RAFCompression value
    * Added undocumented -eh option (alias for -E/-escapeHTML)
    * Decode timed GPS from INNOVV N2 TS videos
    * Improved decoding of Canon ColorData for some models
    * Changed the name of the RAFVersion tag to FirmwareVersion
    * Removed conversion for Garmin FIT DeviceIndex values
    * Properly parse XML CDATA and comment sections
    * Fixed issue which could cause failed Garmin test on some systems

++++ fast_float:

  - Update to release 8.2.6
    * Unrolled the integer-part digit scan (straight-line for the
    common 1-5 digit case).
    * Added a 4-digit SWAR follow-up to loop_parse_if_eight_digits.
    * Parallelized the exhaustive float32 sweeps across hardware
    threads.

++++ filezilla:

  - Update to 3.70.5
    * Fixed vulnerabilities:
  - Official binaries are now linked against GnuTLS 3.8.13
    * New features:
  - SFTP: Added a page with compatibility flags to the Site Manager
    * Bugfixes and minor changes:
  - SFTP: Updated to fzssh 1.2.1 to ignore items with invalid names
    directory listings instead of failing listings completely
  - SFTP: Fixed issue where some items were reported with the
    wrong type depending on server capabilities
  - SFTP: If keyboard-interactive authentication fails,
    automatically start a new authentication attempt

++++ flacon:

  - Update to 13.0.1:
    * Added "Catalog number" tag
    * The work of the program in console mode has been greatly improved
    * The program is available as an AppImage for ARM
    * Fixed incorrect tab order on tag fields
    * Fixed ReplayGain setting not persisting after restart
    * Minor fixes and improvements
  - Switched to QT6

++++ fontconfig:

  - Update to 2.18.0
    * test: Fix a build issue with musl libc
    * fc-lang: Add suz.orth for Sunuwar
    * test: add common helper class
    * test: port basic functionality check to Python
    * test: update to pass test cases on Win32
    * do not mix up a slash and a backslash in file object on Win32
    * meson: Add a missing fontconfig architecture test case
    * Add fontconfig version in FcCache
    * Improve a warning message
    * Better error message when missing default config
    * ci: install before test to avoid fontconfig error
    * Fix regex to pick up libtool version
    * Improve performance in FcConfigAdd
    * Improve log header in FcConfigSubstituteWithPat
    * meson: Update WrapDB files for v2 format migration
    * ci: add an option for the address sanitizer
    * Fix "UBSAN null pointer passed" to qsort
    * ci: Enable ASAN and UBSAN
    * Add genericfamily object in FcPattern
    * Add xsi:nil attribute support to limited elements
    * Get out from FcConfigAdd immediately if no valid pointer given
    * Bump the cache version again
    * fc-case: Update CaseFolding.txt to Unicode 17
    * Add obvious namespace to macros for FC_SPACING
    * Improve handling of constant name
    * test: fix pytest error when running on the top project directory
    * meson: Update wrapdb for expat to the latest
    * Use FcStrCopy instead of strdup
    * Fix -Wpointer-sign warnings
    * Do not store duplicate object name into FcObjectSet
    * Fix unused variable warning when iconv support disabled
    * doc: Fix a typo in FcPatternAdd description
    * Add fc-genconf the configuration generator tool
    * test-conf: Correct test results to display at the proper place
    * Fix unexpected priority change when looking up by specific family name
    * Return error code if FcPatternFormat failed
    * Add const converter for pattern format
    * fc-genconf: Add scan pattern to update genericfamily with commandline option
    * Fix dereferencing a null pointer of FcConfig in FcFontSetSort
    * conf.d: Fix a typo in 65-khmer.conf
    * Update doc for xsi:nil attribute support
    * test: add more conditional for bwrap sandbox test cases
    * meson: add tests-bwrap option
    * Avoid locale-dependent float-to-string
    * test-conf: add wrapper setenv for Win32
    * Fix invalid memory access on Win32
    * More fixes for locale-dependent float-to-string conversion
    * Replace strtod() with FcStrtod()
    * Explicitly declare FcPatternObjectCount as a public function
    * Update meson dependency to 1.11.0
  - modified patches
    * skip-network-test.patch (refreshed)

++++ libheif:

  - version update to 1.23.0:
    * add API functions to read and write metadata:
    ambient viewing environment
    nominal diffuse white luminance
    * adds a output_image_nclx_profile_passthrough option to heif_decoding_options
    * CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF
    sequence parser (stsz fixed-size mode missing bound check)
  - fixes [bsc#1267455]

++++ geos:

  - Minor spec cleanup

++++ ghc-asciidoc:

  - Update asciidoc to version 0.1.0.3.
    Upstream has edited the change log file since the last release in
    a non-trivial way, i.e. they did more than just add a new entry
    at the top. You can review the file at:
    http://hackage.haskell.org/package/asciidoc-0.1.0.3/src/CHANGELOG.md

++++ gkrellm:

  - update to 2.5.1:
    * Fix GKrellM freezing on exit on Windows when remote mail check
    (which uses a thread) ran at least once.
    * Meson: Skip translations when the `nls` option is disabled
    * Fix locale handling on Windows by always finding translations
    relative to the installation prefix.
    * Meson: Add missing handling for custom localedir
    * Fix X11 dependency handling in Meson build rules.
    * Linux: Fix user count on Linux distros that have disabled utmp
    writing but use systemd/logind. Only supported when building with Meson.
    * Solaris: Rework disk enumeration to fix a buffer overflow with
    longer disk names. Also fix a possible file descriptor leak.
    * Solaris: Fix network statistics (was broken since 2.4.0, tested
    on OpenIndiana)
    * Solaris: Fix gkrellmd build (tested on OpenIndiana)
    * DragonFlyBSD: Apply patch from DragonFlyBSD DeltaPorts to fix
    build, fix counting of logged-in users and extend hardware sensor
    support.
    * FreeBSD: Drop unnneded setgid kmem during installation as well as in code
    * Fix text alignment for power sensors. The text was not properly
    right-aligned like other floating point sensor values.
  - modified patches
    * gkrellm-lib64-plugins-dir.patch (refreshed)
  - deleted patches
    * d26f500ce30592313051e5c2f96b90cfd285791b.patch (upstreamed)

++++ glab:

  - Update to version 1.101.0:
    * Features
  - 98e075fb: feat(ci): add --force flag to glab ci cancel job
    (Filip Aleksic faleksic@gitlab.com)
  - 56083b99: feat(mr note create): add --resolvable flag (Silviu
    Marchis silviu.marchis@sygnum.com)
  - 3a8da34f: feat(orbit): add Windows support for orbit local
    (Bohdan Parkhomchuk bparkhomchuk@gitlab.com)
  - 1b8ac8a6: feat(orbit): add glab orbit setup guided onboarding
    command (Kai Armstrong karmstrong@gitlab.com)
  - 7c5c41f3: feat(stack): add --skip-mr-creation flag to stack
    sync command (Gary Holtz gholtz@gitlab.com)
  - 8a9f818d: feat: Display progress during glab mr checkout
    (Gabriel Mazzetto gabriel@gitlab.com)
    * Bug Fixes
  - 1db48d89: fix(ci): align ci delete and ci list default
    pagination (Kai Armstrong karmstrong@gitlab.com)
    * Documentation
  - 04deff1d: docs(config): add synopsis and improve examples for
    config commands (Brendan Lynch blynch@gitlab.com)
  - a4b6dc76: docs(deploy-key): add synopsis and examples to
    deploy-key commands (Brendan Lynch blynch@gitlab.com)
  - 700695f5: docs(gpg-key): add synopsis and examples to gpg-key
    commands (Brendan Lynch blynch@gitlab.com)
  - 684df227: docs(label): add synopsis and examples to label
    commands (Brendan Lynch blynch@gitlab.com)
  - c1a8d0e7: docs(milestone): add synopsis and examples to
    milestone commands (Brendan Lynch blynch@gitlab.com)
  - b1bff4ba: docs(schedule): add synopsis and examples to
    schedule commands (Brendan Lynch blynch@gitlab.com)
  - 9e7f7b38: docs(securefile): add synopsis and examples to
    securefile commands (Brendan Lynch blynch@gitlab.com)
  - 44ca2124: docs(ssh-key): add synopsis and examples to ssh-key
    commands (Brendan Lynch blynch@gitlab.com)
  - ac004c5d: docs: clarify --all and --per-page pagination
    behavior (Brendan Lynch blynch@gitlab.com)
    * Dependencies
  - dce8a8d0: chore(deps): update module
    github.com/modelcontextprotocol/go-sdk to v1.6.1 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - baf77b6b: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.34.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 8cd1295e: chore(deps): update module
    gitlab.com/gitlab-org/api/client-go/v2 to v2.36.0 (GitLab
    Renovate Bot gitlab-bot@gitlab.com)
  - 349287c5: chore(deps): update module golang.org/x/crypto to
    v0.52.0 (GitLab Renovate Bot gitlab-bot@gitlab.com)
    * Maintenance
  - 58f32068: chore: Ensure git exit error codes are wrapped as
    Error (Gabriel Mazzetto gabriel@gitlab.com)
  - 220d0473: chore: Extract GitRunner into
    internal/git/git_runner (Gabriel Mazzetto gabriel@gitlab.com)
    * Others
  - 12b11497: test(iostreams): isolate NO_COLOR in
    detectIsColorEnabled default case (Filip Aleksic
    faleksic@gitlab.com)

++++ go1.25:

  - go1.25.11 (released 2026-06-02) includes security fixes to the
    crypto/x509, mime, and net/textproto packages, as well as bug
    fixes to the compiler and the runtime.
    Refs boo#1244485 go1.25 release tracking
    CVE-2026-42504 CVE-2026-42507 CVE-2026-27145
    * go#79229 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in WordDecoder.DecodeHeader
    * go#79425 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included in errors without any escaping
    * go#79700 go#79694 boo#1267450 security: fix CVE-2026-27145 crypto/x509: split candidate hostname only once
    * go#79190 cmd/compile: Bug in rewrite rules for AMD64 causes SHL instruction overflow and miscompilation
    * go#79698 runtime/race: change in 93a4f03 leads to a failed build on Amazon Linux 2 and arm64

++++ go1.26:

  - go1.26.4 (released 2026-06-02) includes security fixes to the
    crypto/x509, mime, and net/textproto packages, as well as bug
    fixes to the compiler, the runtime, the go fix command, and the
    crypto/fips140 package.
    Refs boo#1255111 go1.26 release tracking
    CVE-2026-42504 CVE-2026-42507 CVE-2026-27145
    * go#79230 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in WordDecoder.DecodeHeader
    * go#79426 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included in errors without any escaping
    * go#79701 go#79694 boo#1267450 security: fix CVE-2026-27145 crypto/x509: split candidate hostname only once
    * go#79191 cmd/compile: Bug in rewrite rules for AMD64 causes SHL instruction overflow and miscompilation
    * go#79226 crypto/internal/fips140/drbg: backport CL 774221 to Go 1.26
    * go#79349 cmd/fix: x/tools/go/analysis/passes/modernize: slicescontains hoists needle expression, changing side effect count
    * go#79686 runtime/race: change in 93a4f03 leads to a failed build on Amazon Linux 2 and arm64

++++ govulncheck-vulndb:

  - Update to version 0.0.20260602T213947 2026-06-02T21:39:47Z.
    Refs jsc#PED-11136
    Go CVE Numbering Authority IDs added or updated with aliases:
    * GO-2026-4960 CVE-2026-39386 GHSA-2gw9-c2r2-f5qf
    * GO-2026-5031 CVE-2026-42500
    * GO-2026-5032 CVE-2026-46599
    * GO-2026-5037 CVE-2026-27145
    * GO-2026-5038 CVE-2026-42504
    * GO-2026-5039 CVE-2026-42507

++++ gpsbabel:

  - Ship the GUI (gpsbabelfe), its desktop file and icon in the
    previously empty gpsbabel-gui subpackage; CLI-only installs of
    gpsbabel no longer pull in the Qt6 WebEngine stack
  - Spec cleanup:
    * Drop the obsolete update-desktop-files Requires(post)/
    Requires(postun) and the desktop/icon-cache scriptlets
    (handled by file triggers)
    * Drop the dead gcc12 fallback (no built target is older than
    Leap 15.6)
    * Drop Group tags, the obsolete BuildRoot and %defattr
    * Convert libusb-1_0-devel to pkgconfig(libusb-1.0); use https

++++ grafana:

  - Update to version 11.6.14+security-04:
    Security:
    * CVE-2026-28374: Fix insecure direct object reference in
    Annotations API (bsc#1265290)
    * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live
    push endpoint (bsc#1265289)
    * CVE-2026-28383: Fix unbounded memory allocation in Grafana
    plugin resources (bsc#1265286)
    * CVE-2026-28380: Fix broken access control in Snapshot API
    (bsc#1265287)
    * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass
    (bsc#1265285)
    * CVE-2026-28379: Fix viewer-triggered race condition in
    Grafana Live (bsc#1265288)
    * CVE-2026-33377: Fix dashboard Editor Privilege Escalation
    (bsc#1265284)
    * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin
    (bsc#1265283)
    * CVE-2026-33381: Prevent users from generating Service Account
    tokens after permissions removal (bsc#1265281)
    * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing
    an authenticated attacker to read arbitrary files from the
    Grafana server’s filesystem (bsc#1265282)

++++ graphite2:

  - version update to 1.3.15:
    . Bug fixes.
    . Update graphite website documentation.
    . Use SPDX lines, and improve license declarations.
    . Fix incorrectly generated graphite2.pc pkgconf file.
  - modified patches
    * graphite2-1.2.0-cmakepath.patch (refreshed)
    * link-gcc-shared.diff (refreshed)
  - deleted patches
    * graphite2-1.3.14-gcc15.patch (upstreamed)
  - fixes CVE-2026-50593 [bsc#1267734]

++++ harfbuzz:

  - Update to version 14.2.1:
    + Various AAT shaping fixes: legacy mort contextual offsets
    (which could produce out-of-font glyph IDs), in-place
    deleted-glyph replacements, and overflow in obsolete offset
    math.
    + Fix Arabic PUA fallback shaping for the isolated
    lam-alef-maksura ligature.
    + Fix float-to-int overflow in avar2 mapping with malformed
    fonts.
    + Harden buffer verification after detecting non-monotone
    clusters.
    + Various COLR v1 fixes: fix handling of .notdef without paint,
    round alpha consistently, and report the root clip under the
    font transform.
    + Various Glyph-extents fixes: inclusive rounding, and
    floating-point scaling before rounding so the reported box
    always covers the glyph.
    + Various Subsetting fixes: keep the palt spacing feature by
    default, raise the repacker MAX_SPACES limit, fix a repacker
    crash on shared LigatureSet nodes, guard gvar size overflow on
    32-bit, and fix the post glyph-name sort comparator on macOS.
    + Replace std::sort with an internal quicksort, removing leaked
    std:: symbols from the libharfbuzz ABI.
    + Harden size computations with saturating arithmetic against
    32-bit overflow.
    + Various improvements to the experimental Rust shaper (HarfRust)
    and font functions (fontations): honor custom font funcs, key
    shape plans on features, faster buffer handling, and update to
    HarfRust 0.8.
    + Various fixes to the experimental harfbuzz-gpu and
    harfbuzz-vector libraries, including a harfbuzz-vector heap
    buffer overflow and Windows build fixes.
    + Map the Hrkt (Katakana or Hiragana) script tag to the kana
    OpenType tag.
    + Build configuration: new HB_CONFIG_OVERRIDE_LAST_H override
    header, decouple HB_NO_DRAW from HB_NO_CFF, and an optional
    hb-allocator Cargo feature.
    + Various build, CI, and fuzzing fixes.

++++ libdnf:

  - version update to 0.75.0
    * context: Support libdnf5 drop-in directories and repository overrides. This
    * allows applications using the context part of libdnf (e.g. microdnf,
    PackageKit) to take into account the main configuration from drop-in
    * directories and repository overrides, similar to how libdnf5 does.
    These directories are also monitored for changes (except when using non-root
    installroot path.)
    This feature can be disabled at build time (ENABLE_DNF5_CONF_DROP_IN,
    ENABLE_DNF5_CONF_REPOS_OVERRIDE CMake options).
    * context: dnf_context_set_install_root() now sets installroot also to global
    mainConf configuration.
    * IniParser: Support glob range definition in section names
    * history database: Add "persistence" column (possible values are UNKNOWN,
    PERSIST, or TRANSIENT).
    * conf: Add usr_drift_protected_paths configuration option which can be
    configured by adding .conf files to the drop-in directory
    /etc/dnf/usr-drift-protected-paths.d, similar to /etc/dnf/protected.d.
    * Distributions will be able to add paths that are known to cause problems
    when their contents drift with respect to /usr, e.g. /etc/pam.d.
    * context: Save repository configuration with dnf_repo_commit() to override file.
    Previously, repository configuration changes were written directly to the
    original configuration file. Now they are written to the overwrite file
    "99-config_manager.repo" for compatibility with the dnf5 config-manager.
    * config: Convert "protected_packages" to an append option
    * Don't prepend installroot to varsdir in libdnf::dnf_context_load_vars()
    * Fix file name comparison in filesystem::createSortedFileList()
    * Stop importing subkeys to RPM >= 5.99.90 because RPM 6 handles subkeys
    automatically.
    * Fix typos in messages in package problems dictionary
    * build: Fix searching libdnf header files when generating bindings with Swig
    * build: Don't probe for libcheck dependency if no tests are going to be built
    * spec: Consistently use CMake RPM macros
    * tests: Replace deprecated "check" macros
    * tests: Verify "fopen" return value otherwise we could crash
    * New functions filesystem::pathJoin(), filesystem::createSortedFileList(),
    filesystem::getRealpath(), filesystem::isSubdirectory().
    * Add libdnf::MergedTransaction::listPersistences() method.
    * Always use result config.optBinds() by reference, not copy
    * Remove unused functions with a bug
    * config: Support optionTListAppend for options lacking fromString
  - modified patches
    * libdnf-0.55.0-Switch-allow_vendor_change-off.patch (refreshed)
    * libdnf-0.72.0-with-static-libsolvext.patch (refreshed)

++++ hwinfo:

  - merge gh#openSUSE/hwinfo#181
  - fix redundant conditions in smbios memory device map
  - 25.4
  - merge gh#openSUSE/hwinfo#182
  - fix memory leaks (bsc#1267348)
  - merge gh#openSUSE/hwinfo#180
  - fix(core): free modinfo_ext instead of modinfo in hd_free_hd_data
  - merge gh#openSUSE/hwinfo#179
  - Fix: fix sizeof in joystick allocation to use struct size instead
    of pointer size (bsc#1267348)

++++ hyphen:

  - Update to version 2.8.9
  - new public API: hnj_hyphen_load_data, loads a dictionary from a
    raw memory buffer (Resolves #4, contributed by Roman "SBKarr"
    Katuntsev). Useful for Android, embedded systems, and any caller
    holding dict bytes in memory.
  - Windows long-path support via _wfopen (fdo#48017, originally from
    LibreOffice)
  - many memory-safety fixes for malformed dictionaries and adversarial
    word input, found via libFuzzer + ASan + LSan: crashes
    in the rep-application loop, lhmin/rhmin loops, hyphword/norm
    compaction; infinite-recursion guards in the compound hyphenation
    path; leak fixes in the dict parser and in every site that writes
    into the (*rep)/(*pos)/(*cut) arrays
  - fuzz harness (fuzz/) shipping with the source

++++ inspektor-gadget:

  - Update to version 0.53.0:
    * Welcome to the v0.53.0 of Inspektor Gadget. These are the most
    important changes:
  - Add new gadget trace_link by @burak-ok in #5317
  - ustack,ebpf,symbolizer: remove [N] prefix from stack symbols
    and show binary+offset by @alban in #5527
  - go.mod: update otel-ebpf-profiler to ig branch based on
    v0.0.202610 (Python 3.13 TLS support) by @alban in #5488
    * Breaking Changes
  - cmd: Add --tls-insecure to ig daemon. by @eiffel-fl in #5484
    * General Improvements
  - Artifact Hub: Update gadgets version to v0.52.0 by
    @github-actions[bot] in #5491
  - gadgets/trace_capabilities: reduce current_syscall map size
    from 1M to 10K by @matthyx in #5468
  - Use Go 1.26.3 for CI and container builds by @Copilot in
    [#5519]
  - go.mod: update otel-ebpf-profiler to ig branch based on
    v0.0.202610 (Python 3.13 TLS support) by @alban in #5488
  - ustack,ebpf,symbolizer: remove [N] prefix from stack symbols
    and show binary+offset by @alban in #5527
  - pkg/oci: Use Lock in newLocalOciStore by @burak-ok in #5540
  - go.mod: update opentelemetry-ebpf-profiler by @alban in #5538
  - Add new gadget trace_link by @burak-ok in #5317
    * Security Improvements
  - secureopen: Add O_CLOEXEC flag to O_PATH openat2 call by
    @alban in #5508
    * Bug Fixes
  - fix(bpfstats): reset method to MethodNone after
    DisableBPFStats to av… by @tushar743-ui in #5450
  - Account for lost samples in gadget_output_buf() by @Sefi4 in
    [#5513]
  - fix: trimmed gadget to the right by @ask-elad in #5528
  - gadgets/top_cuda_memory: Fix implicit free on thread exit by
    @burak-ok in #5492
    * Documentation Improvements
  - Add missing docs symlink for top_cuda_memory by @Copilot in
    [#5520]
    * Dependencies updates
  - ci: bump github/codeql-action from 4.35.2 to 4.35.3 by
    @dependabot[bot] in #5489
  - Dockerfiles: bump debian from f9c6a2f to 67b30a6 in
    /Dockerfiles by @dependabot[bot] in #5498
  - ci: bump actions/dependency-review-action from 4.9.0 to 5.0.0
    by @dependabot[bot] in #5497
  - go: bump the golang-x group across 2 directories with 4
    updates by @dependabot[bot] in #5499
  - ci: bump github/codeql-action from 4.35.3 to 4.35.4 by
    @dependabot[bot] in #5496
  - ci: bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by
    @dependabot[bot] in #5480
  - go: bump github.com/in-toto/attestation from 1.1.2 to 1.2.0
    by @dependabot[bot] in #5397
  - ci: bump softprops/action-gh-release from 2.6.1 to 3.0.0 by
    @dependabot[bot] in #5437
  - ci: bump actions/setup-node from 6.3.0 to 6.4.0 by
    @dependabot[bot] in #5457
  - ci: bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by
    @dependabot[bot] in #5516
  - ci: bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by
    @dependabot[bot] in #5518
  - ci: bump benchmark-action/github-action-benchmark from 1.22.0
    to 1.22.1 by @dependabot[bot] in #5517
  - ci: bump github/codeql-action from 4.35.4 to 4.35.5 by
    @dependabot[bot] in #5514
  - ci: bump aws-actions/configure-aws-credentials from 6.1.0 to
    6.1.1 by @dependabot[bot] in #5515
  - go: bump github.com/docker/cli from 29.4.1+incompatible to
    29.5.2+incompatible in the docker group across 1 directory by
    @dependabot[bot] in #5526
  - Dockerfiles: bump debian from 67b30a6 to 0104b33 in
    /Dockerfiles by @dependabot[bot] in #5525
  - go: bump github.com/containerd/containerd from 1.7.30 to
    1.7.32 in /examples by @dependabot[bot] in #5530
  - go: bump github.com/containerd/containerd from 1.7.30 to
    1.7.32 by @dependabot[bot] in #5529
  - go: bump the golang-x group across 2 directories with 2
    updates by @dependabot[bot] in #5536
  - ci: bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by
    @dependabot[bot] in #5533
  - ci: bump github/codeql-action from 4.35.5 to 4.36.0 by
    @dependabot[bot] in #5531
  - ci: bump docker/build-push-action from 7.1.0 to 7.2.0 by
    @dependabot[bot] in #5535
  - ci: bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by
    @dependabot[bot] in #5532
  - ci: bump docker/login-action from 4.1.0 to 4.2.0 by
    @dependabot[bot] in #5534
  - go: bump the aws-sdk group across 1 directory with 3 updates
    by @dependabot[bot] in #5543
  - ci: bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by
    @dependabot[bot] in #5545
  - ci: bump aws-actions/configure-aws-credentials from 6.1.1 to
    6.1.3 by @dependabot[bot] in #5544

++++ ispc:

  - Update to 1.30.0
    https://github.com/ispc/ispc/releases/tag/v1.30.0
  - Updated skip-tests.patch to skip another test which errors out
    weirdly

++++ kargo-cli:

  - Update to version 1.10.5:
    * CVE Remediation
  - Go module dependency upgrades (#6328): A sweep of go.mod
    dependency bumps to clear additional advisories.

++++ kernel-default:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-source:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-docs:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-kvmsmall:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-obs-build:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-obs-qa:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-syms:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kernel-vanilla:

  - Update
    patches.kernel.org/7.0.10-0148-bpf-fix-end-of-list-detection-in-cgroup_stora.patch
    (bsc#1012628 CVE-2026-45838 bsc#1266396).
  - Update
    patches.kernel.org/7.0.10-0155-bpf-reject-negative-CO-RE-accessor-indices-in.patch
    (bsc#1012628 CVE-2026-45839 bsc#1266399).
  - Update
    patches.kernel.org/7.0.10-0802-openvswitch-cap-upcall-PID-array-size-and-pre.patch
    (bsc#1012628 CVE-2026-45840 bsc#1266397).
  - Update
    patches.kernel.org/7.0.10-0805-netfilter-nfnetlink_osf-fix-divide-by-zero-in.patch
    (bsc#1012628 CVE-2026-45841 bsc#1266390).
  - Update
    patches.kernel.org/7.0.10-0812-slip-reject-VJ-receive-packets-on-instances-w.patch
    (bsc#1012628 CVE-2026-45842 bsc#1266400).
  - Update
    patches.kernel.org/7.0.10-0813-slip-bound-decode-reads-against-the-compresse.patch
    (bsc#1012628 CVE-2026-45843 bsc#1266395).
  - Update
    patches.kernel.org/7.0.10-0860-eventpoll-fix-ep_remove-struct-eventpoll-stru.patch
    (bsc#1012628 CVE-2026-46242).
  - Update
    patches.kernel.org/7.0.10-0888-netfilter-arp_tables-fix-IEEE1394-ARP-payload.patch
    (bsc#1012628 CVE-2026-45844 bsc#1266392).
  - Update
    patches.kernel.org/7.0.10-0939-net-sched-taprio-fix-NULL-pointer-dereference.patch
    (bsc#1012628 CVE-2026-45845 bsc#1266393).
  - Update
    patches.kernel.org/7.0.10-0981-bareudp-fix-NULL-pointer-dereference-in-bareu.patch
    (bsc#1012628 CVE-2026-45846 bsc#1266394).
  - Update
    patches.kernel.org/7.0.10-1139-net-rds-reset-op_nents-when-zerocopy-page-pin.patch
    (bsc#1012628 CVE-2026-43494 bsc#1265626).
  - Update
    patches.kernel.org/7.0.10-1142-net-skbuff-preserve-shared-frag-marker-during.patch
    (bsc#1012628 CVE-2026-46300 bsc#1265209).
  - Update
    patches.kernel.org/7.0.10-1143-net-skbuff-propagate-shared-frag-marker-throu.patch
    (bsc#1012628 CVE-2026-43503 bsc#1266229).
  - Update
    patches.kernel.org/7.0.11-004-smb-client-reject-userspace-cifs.spnego-descri.patch
    (bsc#1012628 CVE-2026-46243).
  - Update
    patches.kernel.org/7.0.4-001-ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_N.patch
    (bsc#1012628 CVE-2026-46018 bsc#1266751).
  - Update
    patches.kernel.org/7.0.4-008-LoongArch-Add-spectre-boundry-for-syscall-dispa.patch
    (bsc#1012628 CVE-2026-45993).
  - Update
    patches.kernel.org/7.0.4-009-drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-b.patch
    (bsc#1012628 CVE-2026-46006).
  - Update
    patches.kernel.org/7.0.4-012-greybus-gb-beagleplay-fix-sleep-in-atomic-conte.patch
    (bsc#1012628 CVE-2026-46041).
  - Update
    patches.kernel.org/7.0.4-013-misc-ibmasm-fix-OOB-MMIO-read-in-ibmasm_handle_.patch
    (bsc#1012628 CVE-2026-46022).
  - Update
    patches.kernel.org/7.0.4-014-ibmasm-fix-OOB-reads-in-command_file_write-due-.patch
    (bsc#1012628 CVE-2026-45994).
  - Update
    patches.kernel.org/7.0.4-015-ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_me.patch
    (bsc#1012628 CVE-2026-46064).
  - Update
    patches.kernel.org/7.0.4-022-fs-afs-revert-mmap_prepare-change.patch
    (bsc#1012628 CVE-2026-46100).
  - Update
    patches.kernel.org/7.0.4-029-mm-fix-deferred-split-queue-races-during-migrat.patch
    (bsc#1012628 CVE-2026-46017 bsc#1267241).
  - Update
    patches.kernel.org/7.0.4-030-ocfs2-split-transactions-in-dio-completion-to-a.patch
    (bsc#1012628 CVE-2026-46080).
  - Update
    patches.kernel.org/7.0.4-031-Input-edt-ft5x06-fix-use-after-free-in-debugfs-.patch
    (bsc#1012628 CVE-2026-46097).
  - Update
    patches.kernel.org/7.0.4-032-zram-do-not-forget-to-endio-for-partial-discard.patch
    (bsc#1012628 CVE-2026-46089).
  - Update
    patches.kernel.org/7.0.4-033-wifi-rtw88-check-for-PCI-upstream-bridge-existe.patch
    (bsc#1012628 CVE-2026-46092).
  - Update
    patches.kernel.org/7.0.4-034-wifi-mwifiex-fix-use-after-free-in-mwifiex_adap.patch
    (bsc#1012628 CVE-2026-46069).
  - Update
    patches.kernel.org/7.0.4-038-vfio-cdx-Serialize-VFIO_DEVICE_SET_IRQS-with-a-.patch
    (bsc#1012628 CVE-2026-46036).
  - Update
    patches.kernel.org/7.0.4-039-vfio-cdx-Fix-NULL-pointer-dereference-in-interr.patch
    (bsc#1012628 CVE-2026-46034 bsc#1266757).
  - Update
    patches.kernel.org/7.0.4-041-thermal-core-Fix-thermal-zone-governor-cleanup-.patch
    (bsc#1012628 CVE-2026-46021 bsc#1267220).
  - Update
    patches.kernel.org/7.0.4-042-spi-imx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-45996).
  - Update
    patches.kernel.org/7.0.4-043-spi-ch341-fix-memory-leaks-on-probe-failures.patch
    (bsc#1012628 CVE-2026-46074).
  - Update
    patches.kernel.org/7.0.4-044-crypto-algif_aead-snapshot-IV-for-async-AEAD-re.patch
    (bsc#1012628 CVE-2026-46028).
  - Update
    patches.kernel.org/7.0.4-048-of-unittest-fix-use-after-free-in-testdrv_probe.patch
    (bsc#1012628 CVE-2026-45989 bsc#1266676).
  - Update
    patches.kernel.org/7.0.4-049-hwmon-powerz-Fix-missing-usb_kill_urb-on-signal.patch
    (bsc#1012628 CVE-2026-46073).
  - Update
    patches.kernel.org/7.0.4-050-EDAC-versalnet-Fix-device_node-leak-in-mc_probe.patch
    (bsc#1012628 CVE-2026-46030).
  - Update
    patches.kernel.org/7.0.4-052-media-amphion-Fix-race-between-m2m-job_abort-an.patch
    (bsc#1012628 CVE-2026-46058 bsc#1266677).
  - Update
    patches.kernel.org/7.0.4-053-ALSA-control-Validate-buf_len-before-strnlen-in.patch
    (bsc#1012628 CVE-2026-46088 bsc#1267226).
  - Update
    patches.kernel.org/7.0.4-054-net-caif-clear-client-service-pointer-on-teardo.patch
    (bsc#1012628 CVE-2026-46098).
  - Update
    patches.kernel.org/7.0.4-055-net-strparser-fix-skb_head-leak-in-strp_abort_s.patch
    (bsc#1012628 CVE-2026-46102).
  - Update
    patches.kernel.org/7.0.4-056-media-mtk-jpeg-fix-use-after-free-in-release-pa.patch
    (bsc#1012628 CVE-2026-46011).
  - Update
    patches.kernel.org/7.0.4-058-PCI-endpoint-pci-epf-ntb-Remove-duplicate-resou.patch
    (bsc#1012628 CVE-2026-46009 bsc#1266684).
  - Update
    patches.kernel.org/7.0.4-064-net-qrtr-ns-Fix-use-after-free-in-driver-remove.patch
    (bsc#1012628 CVE-2026-46047 bsc#1267229).
  - Update
    patches.kernel.org/7.0.4-065-ext2-reject-inodes-with-zero-i_nlink-and-valid-.patch
    (bsc#1012628 CVE-2026-46002).
  - Update
    patches.kernel.org/7.0.4-070-ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PD.patch
    (bsc#1012628 CVE-2026-46049).
  - Update
    patches.kernel.org/7.0.4-072-erofs-fix-the-out-of-bounds-nameoff-handling-fo.patch
    (bsc#1012628 CVE-2026-46078).
  - Update
    patches.kernel.org/7.0.4-073-ipmi-ssif-Clean-up-kthread-on-errors.patch
    (bsc#1012628 CVE-2026-46044).
  - Update
    patches.kernel.org/7.0.4-074-jbd2-fix-deadlock-in-jbd2_journal_cancel_revoke.patch
    (bsc#1012628 CVE-2026-46061 bsc#1266454).
  - Update
    patches.kernel.org/7.0.4-076-md-raid10-fix-deadlock-with-check-operation-and.patch
    (bsc#1012628 CVE-2026-46050 bsc#1266686).
  - Update
    patches.kernel.org/7.0.4-077-media-rc-igorplugusb-heed-coherency-rules.patch
    (bsc#1012628 CVE-2026-46091 bsc#1267238).
  - Update
    patches.kernel.org/7.0.4-082-mm-damon-core-fix-damon_call-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46025).
  - Update
    patches.kernel.org/7.0.4-083-mm-damon-core-fix-damos_walk-vs-kdamond_fn-exit.patch
    (bsc#1012628 CVE-2026-46008 bsc#1266689).
  - Update
    patches.kernel.org/7.0.4-093-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-dest.patch
    (bsc#1012628 CVE-2026-46084 bsc#1266758).
  - Update
    patches.kernel.org/7.0.4-094-remoteproc-xlnx-Only-access-buffer-information-.patch
    (bsc#1012628 CVE-2026-46016 bsc#1266729).
  - Update
    patches.kernel.org/7.0.4-098-landlock-Fix-LOG_SUBDOMAINS_OFF-inheritance-acr.patch
    (bsc#1012628 CVE-2026-46057 bsc#1266683).
  - Update
    patches.kernel.org/7.0.4-104-rbd-fix-null-ptr-deref-when-device_add_disk-fai.patch
    (bsc#1012628 CVE-2026-46079 bsc#1266452).
  - Update
    patches.kernel.org/7.0.4-112-io_uring-zcrx-fix-user_struct-uaf.patch
    (bsc#1012628 CVE-2026-45995 bsc#1267242).
  - Update
    patches.kernel.org/7.0.4-119-ALSA-caiaq-Handle-probe-errors-properly.patch
    (bsc#1012628 CVE-2026-46004 bsc#1267222).
  - Update
    patches.kernel.org/7.0.4-126-rxrpc-Fix-potential-UAF-after-skb_unshare-failu.patch
    (bsc#1012628 CVE-2026-45998).
  - Update
    patches.kernel.org/7.0.4-127-rxrpc-Fix-memory-leaks-in-rxkad_verify_response.patch
    (bsc#1012628 CVE-2026-46012).
  - Update
    patches.kernel.org/7.0.4-128-rxrpc-Fix-conn-level-packet-handling-to-unshare.patch
    (bsc#1012628 CVE-2026-46000).
  - Update
    patches.kernel.org/7.0.4-129-rxrpc-Fix-rxkad-crypto-unalignment-handling.patch
    (bsc#1012628 CVE-2026-46085 bsc#1266724).
  - Update
    patches.kernel.org/7.0.4-130-rxrpc-Fix-error-handling-in-rxgk_extract_token.patch
    (bsc#1012628 CVE-2026-46010 bsc#1266760).
  - Update
    patches.kernel.org/7.0.4-131-rxrpc-Fix-re-decryption-of-RESPONSE-packets.patch
    (bsc#1012628 CVE-2026-45988 bsc#1266455).
  - Update
    patches.kernel.org/7.0.4-138-net-qrtr-ns-Limit-the-maximum-number-of-lookups.patch
    (bsc#1012628 CVE-2026-46026 bsc#1266876).
  - Update
    patches.kernel.org/7.0.4-139-net-qrtr-ns-Free-the-node-during-ctrl_cmd_bye.patch
    (bsc#1012628 CVE-2026-46038 bsc#1266695).
  - Update
    patches.kernel.org/7.0.4-140-net-qrtr-ns-Limit-the-total-number-of-nodes.patch
    (bsc#1012628 CVE-2026-46003 bsc#1267210).
  - Update
    patches.kernel.org/7.0.4-141-net-rds-fix-MR-cleanup-on-copy-error.patch
    (bsc#1012628 CVE-2026-46053).
  - Update
    patches.kernel.org/7.0.4-143-net-smc-avoid-early-lgr-access-in-smc_clc_wait_.patch
    (bsc#1012628 CVE-2026-46027 bsc#1266744).
  - Update
    patches.kernel.org/7.0.4-144-net-ks8851-Reinstate-disabling-of-BHs-around-IR.patch
    (bsc#1012628 CVE-2026-46031).
  - Update
    patches.kernel.org/7.0.4-145-net-bridge-use-a-stable-FDB-dst-snapshot-in-RCU.patch
    (bsc#1012628 CVE-2026-46086).
  - Update
    patches.kernel.org/7.0.4-150-slub-fix-data-loss-and-overflow-in-krealloc.patch
    (bsc#1012628 CVE-2026-45990 bsc#1267225).
  - Update
    patches.kernel.org/7.0.4-152-RDMA-rxe-Validate-pad-and-ICRC-before-payload_s.patch
    (bsc#1012628 CVE-2026-46043 bsc#1266901).
  - Update
    patches.kernel.org/7.0.4-154-ipv4-icmp-validate-reply-type-before-using-icmp.patch
    (bsc#1012628 CVE-2026-46037).
  - Update
    patches.kernel.org/7.0.4-155-libceph-Prevent-potential-null-ptr-deref-in-cep.patch
    (bsc#1012628 CVE-2026-46024 bsc#1267218).
  - Update
    patches.kernel.org/7.0.4-156-spi-fix-resource-leaks-on-device-setup-failure.patch
    (bsc#1012628 CVE-2026-46083 bsc#1266696).
  - Update
    patches.kernel.org/7.0.4-157-apparmor-Fix-string-overrun-due-to-missing-term.patch
    (bsc#1012628 CVE-2026-46055 bsc#1266682).
  - Update
    patches.kernel.org/7.0.4-162-fbdev-defio-Disconnect-deferred-I-O-from-the-li.patch
    (bsc#1012628 CVE-2026-46065).
  - Update
    patches.kernel.org/7.0.4-165-hwmon-powerz-Avoid-cacheline-sharing-for-DMA-bu.patch
    (bsc#1012628 CVE-2026-46007).
  - Update
    patches.kernel.org/7.0.4-170-selinux-fix-overlayfs-mmap-and-mprotect-access-.patch
    (bsc#1012628 CVE-2026-46054).
  - Update
    patches.kernel.org/7.0.4-171-hwmon-pt5161l-Fix-bugs-in-pt5161l_read_block_da.patch
    (bsc#1012628 CVE-2026-46001 bsc#1266736).
  - Update
    patches.kernel.org/7.0.4-176-crypto-qat-fix-IRQ-cleanup-on-6xxx-probe-failur.patch
    (bsc#1012628 CVE-2026-46060).
  - Update
    patches.kernel.org/7.0.4-178-xfs-fix-a-resource-leak-in-xfs_alloc_buftarg.patch
    (bsc#1012628 CVE-2026-46005).
  - Update
    patches.kernel.org/7.0.4-184-tpm2-sessions-Fix-missing-tpm_buf_destroy-in-tp.patch
    (bsc#1012628 CVE-2026-46096).
  - Update
    patches.kernel.org/7.0.4-190-mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
    (bsc#1012628 CVE-2026-46093).
  - Update
    patches.kernel.org/7.0.4-191-mm-memfd_luo-fix-physical-address-conversion-in.patch
    (bsc#1012628 CVE-2026-46013).
  - Update
    patches.kernel.org/7.0.4-192-mm-mempolicy-fix-memory-leaks-in-weighted_inter.patch
    (bsc#1012628 CVE-2026-46042).
  - Update
    patches.kernel.org/7.0.4-193-mm-damon-stat-fix-memory-leak-on-damon_start-fa.patch
    (bsc#1012628 CVE-2026-46087).
  - Update
    patches.kernel.org/7.0.4-194-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46020).
  - Update
    patches.kernel.org/7.0.4-195-mm-damon-core-validate-damos_quota_goal-nid-for.patch
    (bsc#1012628 CVE-2026-46067).
  - Update
    patches.kernel.org/7.0.4-204-KVM-nSVM-Sync-interrupt-shadow-to-cached-vmcb12.patch
    (bsc#1012628 CVE-2026-45987 bsc#1267213).
  - Update
    patches.kernel.org/7.0.4-205-KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch
    (bsc#1012628 CVE-2026-46082).
  - Update
    patches.kernel.org/7.0.4-208-KVM-nSVM-Always-use-NextRIP-as-vmcb02-s-NextRIP.patch
    (bsc#1012628 CVE-2026-46059).
  - Update
    patches.kernel.org/7.0.4-212-KVM-nSVM-Avoid-clearing-VMCB_LBR-in-vmcb12.patch
    (bsc#1012628 CVE-2026-46071).
  - Update
    patches.kernel.org/7.0.4-215-KVM-SVM-Add-missing-save-restore-handling-of-LB.patch
    (bsc#1012628 CVE-2026-46014).
  - Update
    patches.kernel.org/7.0.4-219-KVM-nSVM-Triple-fault-if-restore-host-CR3-fails.patch
    (bsc#1012628 CVE-2026-46032).
  - Update
    patches.kernel.org/7.0.4-227-KVM-nSVM-Raise-UD-if-unhandled-VMMCALL-isn-t-in.patch
    (bsc#1012628 CVE-2026-46076).
  - Update
    patches.kernel.org/7.0.4-231-ext4-fix-bounds-check-in-check_xattrs-to-preven.patch
    (bsc#1012628 CVE-2026-46094 bsc#1266927).
  - Update
    patches.kernel.org/7.0.4-232-ext4-fix-missing-brelse-in-ext4_xattr_inode_dec.patch
    (bsc#1012628 CVE-2026-46046 bsc#1266726).
  - Update
    patches.kernel.org/7.0.4-233-udf-fix-partition-descriptor-append-bookkeeping.patch
    (bsc#1012628 CVE-2026-45991 bsc#1267227).
  - Update
    patches.kernel.org/7.0.4-237-md-md-llbitmap-skip-reading-rdevs-that-are-not-.patch
    (bsc#1012628 CVE-2026-46045).
  - Update
    patches.kernel.org/7.0.4-238-md-md-llbitmap-raise-barrier-before-state-machi.patch
    (bsc#1012628 CVE-2026-46095).
  - Update
    patches.kernel.org/7.0.4-239-md-raid5-fix-soft-lockup-in-retry_aligned_read.patch
    (bsc#1012628 CVE-2026-46051).
  - Update
    patches.kernel.org/7.0.4-240-md-raid5-validate-payload-size-before-accessing.patch
    (bsc#1012628 CVE-2026-46070).
  - Update
    patches.kernel.org/7.0.4-244-inotify-fix-watch-count-leak-when-fsnotify_add_.patch
    (bsc#1012628 CVE-2026-46040).
  - Update
    patches.kernel.org/7.0.4-246-x86-shstk-Prevent-deadlock-during-shstk-sigretu.patch
    (bsc#1012628 CVE-2026-46063 bsc#1267228).
  - Update
    patches.kernel.org/7.0.4-248-tcp-call-sk_data_ready-after-listener-migration.patch
    (bsc#1012628 CVE-2026-46015).
  - Update
    patches.kernel.org/7.0.4-254-Bluetooth-hci_event-fix-potential-UAF-in-SSP-pa.patch
    (bsc#1012628 CVE-2026-46056).
  - Update
    patches.kernel.org/7.0.4-256-can-ucan-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46103).
  - Update
    patches.kernel.org/7.0.4-257-crypto-acomp-fix-wrong-pointer-stored-by-acomp_.patch
    (bsc#1012628 CVE-2026-46081 bsc#1266453).
  - Update
    patches.kernel.org/7.0.4-259-crypto-atmel-aes-Fix-3-page-memory-leak-in-atme.patch
    (bsc#1012628 CVE-2026-46019 bsc#1266732).
  - Update
    patches.kernel.org/7.0.4-262-crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch
    (bsc#1012628 CVE-2026-45986 bsc#1266739).
  - Update
    patches.kernel.org/7.0.4-263-crypto-atmel-tdes-fix-DMA-sync-direction.patch
    (bsc#1012628 CVE-2026-46077).
  - Update
    patches.kernel.org/7.0.4-265-crypto-atmel-sha204a-Fix-potential-UAF-and-memo.patch
    (bsc#1012628 CVE-2026-46075).
  - Update
    patches.kernel.org/7.0.4-267-crypto-nx-fix-bounce-buffer-leaks-in-nx842_cryp.patch
    (bsc#1012628 CVE-2026-46068).
  - Update
    patches.kernel.org/7.0.4-270-dm-mirror-fix-integer-overflow-in-create_dirty_.patch
    (bsc#1012628 CVE-2026-46023).
  - Update
    patches.kernel.org/7.0.4-271-erofs-fix-unsigned-underflow-in-z_erofs_lz4_han.patch
    (bsc#1012628 CVE-2026-45999 bsc#1266750).
  - Update
    patches.kernel.org/7.0.4-272-ceph-fix-num_ops-off-by-one-when-crypto-allocat.patch
    (bsc#1012628 CVE-2026-46066).
  - Update
    patches.kernel.org/7.0.4-273-ceph-only-d_add-negative-dentries-when-they-are.patch
    (bsc#1012628 CVE-2026-46052).
  - Update
    patches.kernel.org/7.0.4-278-ntfs3-add-buffer-boundary-checks-to-run_unpack.patch
    (bsc#1012628 CVE-2026-46072).
  - Update
    patches.kernel.org/7.0.4-279-ntfs3-fix-integer-overflow-in-run_unpack-volume.patch
    (bsc#1012628 CVE-2026-46062).
  - Update
    patches.kernel.org/7.0.4-281-rxgk-Fix-potential-integer-overflow-in-length-c.patch
    (bsc#1012628 CVE-2026-46039).
  - Update
    patches.kernel.org/7.0.4-283-scsi-sd-fix-missing-put_disk-when-device_add-di.patch
    (bsc#1012628 CVE-2026-45997 bsc#1266740).
  - Update
    patches.kernel.org/7.0.4-294-crypto-authencesn-reject-short-ahash-digests-du.patch
    (bsc#1012628 CVE-2026-46033 bsc#1266692).
  - Update
    patches.kernel.org/7.0.4-296-ALSA-caiaq-Fix-potentially-leftover-ep1_in_urb-.patch
    (bsc#1012628 CVE-2026-45992 bsc#1267231).
  - Update
    patches.kernel.org/7.0.4-301-ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-f.patch
    (bsc#1012628 CVE-2026-46048).
  - Update
    patches.kernel.org/7.0.4-302-ALSA-aloop-Fix-peer-runtime-UAF-during-format-c.patch
    (bsc#1012628 CVE-2026-46090).
  - Update
    patches.kernel.org/7.0.4-304-mm-page_alloc-return-NULL-early-from-alloc_froz.patch
    (bsc#1012628 CVE-2026-46035 bsc#1266756).
  - Update
    patches.kernel.org/7.0.4-305-mm-slab-return-NULL-early-from-kmalloc_nolock-i.patch
    (bsc#1012628 CVE-2026-46029).
  - Update
    patches.kernel.org/7.0.4-306-net-ipv6-fix-NOREF-dst-use-in-seg6-and-rpl-lwtu.patch
    (bsc#1012628 CVE-2026-46099 bsc#1266722).
  - Update
    patches.kernel.org/7.0.4-307-netfilter-reject-zero-shift-in-nft_bitwise.patch
    (bsc#1012628 CVE-2026-46101 bsc#1266878).
  - Update
    patches.kernel.org/7.0.7-001-scsi-target-configfs-Bound-snprintf-return-in-t.patch
    (bsc#1012628 CVE-2026-46149).
  - Update
    patches.kernel.org/7.0.7-002-ipmi-Add-limits-to-event-and-receive-message-re.patch
    (bsc#1012628 CVE-2026-46177).
  - Update
    patches.kernel.org/7.0.7-003-ipmi-Check-event-message-buffer-response-for-ba.patch
    (bsc#1012628 CVE-2026-46128).
  - Update
    patches.kernel.org/7.0.7-004-ipmi-si-Return-state-to-normal-if-message-alloc.patch
    (bsc#1012628 CVE-2026-46108).
  - Update
    patches.kernel.org/7.0.7-011-tracepoint-balance-regfunc-on-func_add-failure-.patch
    (bsc#1012628 CVE-2026-46196 bsc#1266848).
  - Update
    patches.kernel.org/7.0.7-013-ASoC-SOF-Don-t-allow-pointer-operations-on-unco.patch
    (bsc#1012628 CVE-2026-46179).
  - Update
    patches.kernel.org/7.0.7-017-KVM-x86-Fix-shadow-paging-use-after-free-due-to.patch
    (bsc#1012628 CVE-2026-46113 bsc#1266969).
  - Update
    patches.kernel.org/7.0.7-021-exit-prevent-preemption-of-oopsing-TASK_DEAD-ta.patch
    (bsc#1012628 CVE-2026-46173).
  - Update
    patches.kernel.org/7.0.7-024-wifi-mt76-mt7921-fix-a-potential-clc-buffer-len.patch
    (bsc#1012628 CVE-2026-46136 bsc#1266831).
  - Update
    patches.kernel.org/7.0.7-026-wifi-b43legacy-enforce-bounds-check-on-firmware.patch
    (bsc#1012628 CVE-2026-46163 bsc#1266863).
  - Update
    patches.kernel.org/7.0.7-027-wifi-mac80211-drop-stray-static-from-fast-RX-rx.patch
    (bsc#1012628 CVE-2026-46152 bsc#1266855).
  - Update
    patches.kernel.org/7.0.7-028-wifi-rsi-fix-kthread-lifetime-race-between-self.patch
    (bsc#1012628 CVE-2026-46187 bsc#1266842).
  - Update
    patches.kernel.org/7.0.7-029-wifi-mac80211-use-safe-list-iteration-in-radar-.patch
    (bsc#1012628 CVE-2026-46166 bsc#1266839).
  - Update
    patches.kernel.org/7.0.7-031-wifi-mac80211-remove-station-if-connection-prep.patch
    (bsc#1012628 CVE-2026-46125 bsc#1266879).
  - Update
    patches.kernel.org/7.0.7-032-wifi-b43-enforce-bounds-check-on-firmware-key-i.patch
    (bsc#1012628 CVE-2026-46122).
  - Update
    patches.kernel.org/7.0.7-033-wifi-brcmfmac-Fix-potential-use-after-free-issu.patch
    (bsc#1012628 CVE-2026-46180 bsc#1266813).
  - Update
    patches.kernel.org/7.0.7-034-usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-.patch
    (bsc#1012628 CVE-2026-46151).
  - Update
    patches.kernel.org/7.0.7-035-usb-usblp-fix-uninitialized-heap-leak-via-LPGET.patch
    (bsc#1012628 CVE-2026-46167 bsc#1266832).
  - Update
    patches.kernel.org/7.0.7-037-ALSA-usb-audio-Avoid-potential-endless-loop-in-.patch
    (bsc#1012628 CVE-2026-46146).
  - Update
    patches.kernel.org/7.0.7-042-usb-ulpi-fix-memory-leak-on-ulpi_register-error.patch
    (bsc#1012628 CVE-2026-46109 bsc#1266850).
  - Update
    patches.kernel.org/7.0.7-045-ALSA-pcm-oss-Fix-data-race-at-accessing-runtime.patch
    (bsc#1012628 CVE-2026-46157).
  - Update
    patches.kernel.org/7.0.7-052-sched_ext-Read-scx_root-under-scx_cgroup_ops_rw.patch
    (bsc#1012628 CVE-2026-46154 bsc#1266812).
  - Update
    patches.kernel.org/7.0.7-054-xfrm-defensively-unhash-xfrm_state-lists-in-__x.patch
    (bsc#1012628 CVE-2026-46116).
  - Update
    patches.kernel.org/7.0.7-055-ipv6-xfrm6-release-dst-on-error-in-xfrm6_rcv_en.patch
    (bsc#1012628 CVE-2026-46172 bsc#1266903).
  - Update
    patches.kernel.org/7.0.7-056-xfrm-ah-account-for-ESN-high-bits-in-async-call.patch
    (bsc#1012628 CVE-2026-46193).
  - Update
    patches.kernel.org/7.0.7-058-selinux-use-sk-blob-accessor-in-socket-permissi.patch
    (bsc#1012628 CVE-2026-46104).
  - Update
    patches.kernel.org/7.0.7-068-Bluetooth-virtio_bt-clamp-rx-length-before-skb_.patch
    (bsc#1012628 CVE-2026-46123).
  - Update
    patches.kernel.org/7.0.7-069-Bluetooth-virtio_bt-validate-rx-pkt_type-header.patch
    (bsc#1012628 CVE-2026-46186 bsc#1266917).
  - Update
    patches.kernel.org/7.0.7-070-Bluetooth-btmtk-validate-WMT-event-SKB-length-b.patch
    (bsc#1012628 CVE-2026-46140).
  - Update
    patches.kernel.org/7.0.7-071-Bluetooth-hci_conn-fix-potential-UAF-in-create_.patch
    (bsc#1012628 CVE-2026-46111).
  - Update
    patches.kernel.org/7.0.7-072-Bluetooth-hci_event-Fix-OOB-read-and-infinite-l.patch
    (bsc#1012628 CVE-2026-46138).
  - Update
    patches.kernel.org/7.0.7-073-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45835 bsc#1266411).
  - Update
    patches.kernel.org/7.0.7-074-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45834 bsc#1266412).
  - Update
    patches.kernel.org/7.0.7-075-Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_soc.patch
    (bsc#1012628 CVE-2026-45836 bsc#1266410).
  - Update
    patches.kernel.org/7.0.7-091-fanotify-fix-false-positive-on-permission-event.patch
    (bsc#1012628 CVE-2026-46150).
  - Update
    patches.kernel.org/7.0.7-093-mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-s.patch
    (bsc#1012628 CVE-2026-46190 bsc#1266934).
  - Update
    patches.kernel.org/7.0.7-098-net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-s.patch
    (bsc#1012628 CVE-2026-46132).
  - Update
    patches.kernel.org/7.0.7-110-sound-ua101-fix-division-by-zero-at-probe.patch
    (bsc#1012628 CVE-2026-46184 bsc#1266864).
  - Update
    patches.kernel.org/7.0.7-112-pseries-papr-hvpipe-Prevent-kernel-stack-memory.patch
    (bsc#1012628 CVE-2026-46182).
  - Update
    patches.kernel.org/7.0.7-113-pseries-papr-hvpipe-Fix-null-ptr-deref-in-papr_.patch
    (bsc#1012628 CVE-2026-46118 bsc#1267237).
  - Update
    patches.kernel.org/7.0.7-116-net-libwx-fix-VF-illegal-register-access.patch
    (bsc#1012628 CVE-2026-46142 bsc#1266824).
  - Update
    patches.kernel.org/7.0.7-117-ip6_gre-Use-cached-t-net-in-ip6erspan_changelin.patch
    (bsc#1012628 CVE-2026-46120).
  - Update
    patches.kernel.org/7.0.7-123-platform-chrome-cros_ec_typec-Init-mutex-in-Thu.patch
    (bsc#1012628 CVE-2026-46134 bsc#1266940).
  - Update
    patches.kernel.org/7.0.7-133-block-add-pgmap-check-to-biovec_phys_mergeable.patch
    (bsc#1012628 CVE-2026-46115 bsc#1266874).
  - Update
    patches.kernel.org/7.0.7-139-fbcon-Avoid-OOB-font-access-if-console-rotation.patch
    (bsc#1012628 CVE-2026-46191).
  - Update
    patches.kernel.org/7.0.7-146-ice-fix-double-free-in-ice_sf_eth_activate-erro.patch
    (bsc#1012628 CVE-2026-46162 bsc#1266840).
  - Update
    patches.kernel.org/7.0.7-149-spi-microchip-core-qspi-don-t-attempt-to-transm.patch
    (bsc#1012628 CVE-2026-46192 bsc#1266909).
  - Update
    patches.kernel.org/7.0.7-150-spi-microchip-core-qspi-control-built-in-cs-man.patch
    (bsc#1012628 CVE-2026-46148).
  - Update
    patches.kernel.org/7.0.7-172-ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-op.patch
    (bsc#1012628 CVE-2026-46143).
  - Update
    patches.kernel.org/7.0.7-175-btrfs-fix-btrfs_ioctl_space_info-slot_count-TOC.patch
    (bsc#1012628 CVE-2026-46159).
  - Update
    patches.kernel.org/7.0.7-176-btrfs-fix-double-free-in-create_space_info-erro.patch
    (bsc#1012628 CVE-2026-46129 bsc#1266828).
  - Update
    patches.kernel.org/7.0.7-177-btrfs-fix-double-free-in-create_space_info_sub_.patch
    (bsc#1012628 CVE-2026-46164 bsc#1266906).
  - Update
    patches.kernel.org/7.0.7-178-btrfs-fix-missing-last_unlink_trans-update-when.patch
    (bsc#1012628 CVE-2026-46160).
  - Update
    patches.kernel.org/7.0.7-179-dm-thin-fix-metadata-refcount-underflow.patch
    (bsc#1012628 CVE-2026-46107).
  - Update
    patches.kernel.org/7.0.7-182-eventfs-Hold-eventfs_mutex-and-SRCU-when-remoun.patch
    (bsc#1012628 CVE-2026-46106).
  - Update
    patches.kernel.org/7.0.7-186-dm-verity-fec-fix-reading-parity-bytes-split-ac.patch
    (bsc#1012628 CVE-2026-46130).
  - Update
    patches.kernel.org/7.0.7-189-isofs-validate-block-number-from-NFS-file-handl.patch
    (bsc#1012628 CVE-2026-46124 bsc#1266847).
  - Update
    patches.kernel.org/7.0.7-197-libceph-Fix-slab-out-of-bounds-access-in-auth-m.patch
    (bsc#1012628 CVE-2026-46119).
  - Update
    patches.kernel.org/7.0.7-198-md-raid10-fix-divide-by-zero-in-setup_geo-with-.patch
    (bsc#1012628 CVE-2026-46161 bsc#1266838).
  - Update
    patches.kernel.org/7.0.7-200-nvmet-tcp-fix-race-between-ICReq-handling-and-q.patch
    (bsc#1012628 CVE-2026-46135).
  - Update
    patches.kernel.org/7.0.7-202-openvswitch-vport-fix-self-deadlock-on-release-.patch
    (bsc#1012628 CVE-2026-46165 bsc#1266836).
  - Update
    patches.kernel.org/7.0.7-205-RDMA-hns-Fix-unlocked-call-to-hns_roce_qp_remov.patch
    (bsc#1012628 CVE-2026-46112).
  - Update
    patches.kernel.org/7.0.7-206-riscv-kvm-fix-vector-context-allocation-leak.patch
    (bsc#1012628 CVE-2026-46171 bsc#1266866).
  - Update
    patches.kernel.org/7.0.7-209-scsi-mpt3sas-Limit-NVMe-request-size-to-2-MiB.patch
    (bsc#1012628 CVE-2026-46105).
  - Update
    patches.kernel.org/7.0.7-210-smb-client-fix-out-of-bounds-read-in-smb2_compo.patch
    (bsc#1012628 CVE-2026-46155).
  - Update
    patches.kernel.org/7.0.7-211-smb-client-fix-out-of-bounds-read-in-symlink_da.patch
    (bsc#1012628 CVE-2026-46185 bsc#1266830).
  - Update
    patches.kernel.org/7.0.7-212-smb-client-use-kzalloc-to-zero-initialize-secur.patch
    (bsc#1012628 CVE-2026-46139).
  - Update
    patches.kernel.org/7.0.7-213-smb-client-validate-dacloffset-before-building-.patch
    (bsc#1012628 CVE-2026-46195 bsc#1266860).
  - Update
    patches.kernel.org/7.0.7-214-KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hyper.patch
    (bsc#1012628 CVE-2026-46131).
  - Update
    patches.kernel.org/7.0.7-219-mm-damon-sysfs-schemes-protect-memcg_path-kfree.patch
    (bsc#1012628 CVE-2026-46121 bsc#1266932).
  - Update
    patches.kernel.org/7.0.7-220-mm-damon-sysfs-schemes-protect-path-kfree-with-.patch
    (bsc#1012628 CVE-2026-46183 bsc#1266924).
  - Update
    patches.kernel.org/7.0.7-226-powerpc-xive-fix-kmemleak-caused-by-incorrect-c.patch
    (bsc#1012628 CVE-2026-46141 bsc#1266877).
  - Update
    patches.kernel.org/7.0.7-232-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp.patch
    (bsc#1012628 CVE-2026-46144 bsc#1266913).
  - Update
    patches.kernel.org/7.0.7-233-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-ma.patch
    (bsc#1012628 CVE-2026-46126).
  - Update
    patches.kernel.org/7.0.7-234-RDMA-mana-Remove-user-triggerable-WARN_ON-in-ma.patch
    (bsc#1012628 CVE-2026-46117).
  - Update
    patches.kernel.org/7.0.7-235-RDMA-mana-Validate-rx_hash_key_len.patch
    (bsc#1012628 CVE-2026-46145).
  - Update
    patches.kernel.org/7.0.7-236-RDMA-mlx4-Fix-mis-use-of-RCU-in-mlx4_srq_event.patch
    (bsc#1012628 CVE-2026-46181 bsc#1266826).
  - Update
    patches.kernel.org/7.0.7-237-RDMA-mlx4-Fix-resource-leak-on-error-in-mlx4_ib.patch
    (bsc#1012628 CVE-2026-46178).
  - Update
    patches.kernel.org/7.0.7-238-RDMA-mlx5-Fix-error-path-fall-through-in-mlx5_i.patch
    (bsc#1012628 CVE-2026-46176 bsc#1266816).
  - Update
    patches.kernel.org/7.0.7-239-RDMA-ocrdma-Don-t-NULL-deref-uctx-on-errors-in-.patch
    (bsc#1012628 CVE-2026-46127 bsc#1267236).
  - Update
    patches.kernel.org/7.0.7-240-RDMA-rxe-Reject-non-8-byte-ATOMIC_WRITE-payload.patch
    (bsc#1012628 CVE-2026-46114 bsc#1266972).
  - Update
    patches.kernel.org/7.0.7-241-RDMA-rxe-Reject-unknown-opcodes-before-ICRC-pro.patch
    (bsc#1012628 CVE-2026-46133 bsc#1266928).
  - Update
    patches.kernel.org/7.0.7-242-RDMA-vmw_pvrdma-Fix-double-free-on-pvrdma_alloc.patch
    (bsc#1012628 CVE-2026-46189 bsc#1266918).
  - Update
    patches.kernel.org/7.0.7-255-mptcp-fix-scheduling-with-atomic-in-timestamp-s.patch
    (bsc#1012628 CVE-2026-46168 bsc#1266869).
  - Update
    patches.kernel.org/7.0.7-260-mptcp-pm-ADD_ADDR-rtx-fix-potential-data-race.patch
    (bsc#1012628 CVE-2026-46137).
  - Update
    patches.kernel.org/7.0.7-261-mptcp-pm-ADD_ADDR-rtx-always-decrease-sk-refcou.patch
    (bsc#1012628 CVE-2026-46158 bsc#1266880).
  - Update
    patches.kernel.org/7.0.7-262-mptcp-pm-ADD_ADDR-rtx-free-sk-if-last.patch
    (bsc#1012628 CVE-2026-46170).
  - Update
    patches.kernel.org/7.0.7-271-f2fs-fix-node_cnt-race-between-extent-node-dest.patch
    (bsc#1012628 CVE-2026-46194).
  - Update
    patches.kernel.org/7.0.7-275-f2fs-fix-fsck-inconsistency-caused-by-FGGC-of-n.patch
    (bsc#1012628 CVE-2026-46175 bsc#1266865).
  - Update
    patches.kernel.org/7.0.7-281-KVM-arm64-Fix-pin-leak-and-publication-ordering.patch
    (bsc#1012628 CVE-2026-46147).
  - Update
    patches.kernel.org/7.0.7-282-LoongArch-Fix-potential-ADE-in-loongson_gpu_fix.patch
    (bsc#1012628 CVE-2026-46156).
  - Update
    patches.kernel.org/7.0.7-289-bpf-Fix-use-after-free-in-arena_vm_close-on-for.patch
    (bsc#1012628 CVE-2026-45837 bsc#1266398).
  - Update
    patches.kernel.org/7.0.7-290-octeon_ep_vf-add-NULL-check-for-napi_build_skb.patch
    (bsc#1012628 CVE-2026-46188 bsc#1266859).
  - Update
    patches.kernel.org/7.0.7-296-hfsplus-fix-uninit-value-by-validating-catalog-.patch
    (bsc#1012628 CVE-2026-46169).
  - Update
    patches.kernel.org/7.0.7-299-8021q-delete-cleared-egress-QoS-mappings.patch
    (bsc#1012628 CVE-2026-46153).
  - Update
    patches.kernel.org/7.0.7-303-net-stmmac-Prevent-NULL-deref-when-RX-memory-ex.patch
    (bsc#1012628 CVE-2026-46110 bsc#1266759).
  - Update
    patches.kernel.org/7.0.7-305-x86-CPU-AMD-Prevent-improper-isolation-of-share.patch
    (bsc#1012628 CVE-2026-46174).
  - Update
    patches.kernel.org/7.0.9-001-HID-playstation-Clamp-num_touch_reports.patch
    (bsc#1012628 CVE-2026-46232).
  - Update
    patches.kernel.org/7.0.9-002-HID-appletb-kbd-fix-UAF-in-inactivity-timer-cle.patch
    (bsc#1012628 CVE-2026-46213).
  - Update
    patches.kernel.org/7.0.9-003-HID-appletb-kbd-run-inactivity-autodim-from-wor.patch
    (bsc#1012628 CVE-2026-46202 bsc#1266849).
  - Update
    patches.kernel.org/7.0.9-028-staging-media-atomisp-Disallow-all-private-IOCT.patch
    (bsc#1012628 CVE-2026-46205 bsc#1266908).
  - Update
    patches.kernel.org/7.0.9-033-media-rc-xbox_remote-heed-DMA-restrictions.patch
    (bsc#1012628 CVE-2026-46236 bsc#1266910).
  - Update
    patches.kernel.org/7.0.9-035-media-i2c-ov5647-Fix-runtime-PM-refcount-leak-i.patch
    (bsc#1012628 CVE-2026-46239).
  - Update
    patches.kernel.org/7.0.9-040-media-rockchip-rkcif-Add-missing-MUST_CONNECT-f.patch
    (bsc#1012628 CVE-2026-46222).
  - Update
    patches.kernel.org/7.0.9-053-media-saa7164-add-ioremap-return-checks-and-cle.patch
    (bsc#1012628 CVE-2026-46235).
  - Update
    patches.kernel.org/7.0.9-070-media-iris-Fix-use-after-free-in-iris_release_i.patch
    (bsc#1012628 CVE-2026-46240 bsc#1266843).
  - Update
    patches.kernel.org/7.0.9-076-media-iris-fix-use-after-free-of-fmt_src-during.patch
    (bsc#1012628 CVE-2026-46210).
  - Update
    patches.kernel.org/7.0.9-079-drm-xe-hdcp-Add-NULL-check-for-media_gt-in-inte.patch
    (bsc#1012628 CVE-2026-46216 bsc#1267234).
  - Update
    patches.kernel.org/7.0.9-090-spi-ch341-fix-devres-lifetime.patch
    (bsc#1012628 CVE-2026-46228).
  - Update
    patches.kernel.org/7.0.9-092-spi-fsl-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46226).
  - Update
    patches.kernel.org/7.0.9-099-spi-rspi-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46225).
  - Update
    patches.kernel.org/7.0.9-110-spi-mpc52xx-fix-use-after-free-on-registration-.patch
    (bsc#1012628 CVE-2026-46241 bsc#1266931).
  - Update
    patches.kernel.org/7.0.9-111-spi-mpc52xx-fix-controller-deregistration.patch
    (bsc#1012628 CVE-2026-46200 bsc#1266835).
  - Update
    patches.kernel.org/7.0.9-112-spi-mpc52xx-fix-use-after-free-on-unbind.patch
    (bsc#1012628 CVE-2026-46219).
  - Update
    patches.kernel.org/7.0.9-120-spi-cadence-quadspi-fix-unclocked-access-on-unb.patch
    (bsc#1012628 CVE-2026-46203).
  - Update
    patches.kernel.org/7.0.9-121-drm-msm-gem-fix-error-handling-in-msm_ioctl_gem.patch
    (bsc#1012628 CVE-2026-46211).
  - Update
    patches.kernel.org/7.0.9-127-drm-amdkfd-Clear-VRAM-on-allocation-to-prevent-.patch
    (bsc#1012628 CVE-2026-46229).
  - Update
    patches.kernel.org/7.0.9-135-drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_.patch
    (bsc#1012628 CVE-2026-46218).
  - Update
    patches.kernel.org/7.0.9-136-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46204).
  - Update
    patches.kernel.org/7.0.9-138-drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46199).
  - Update
    patches.kernel.org/7.0.9-139-drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-.patch
    (bsc#1012628 CVE-2026-46230).
  - Update
    patches.kernel.org/7.0.9-141-drm-gem-Fix-inconsistent-plane-dimension-calcul.patch
    (bsc#1012628 CVE-2026-46209).
  - Update
    patches.kernel.org/7.0.9-143-drm-amdkfd-validate-SVM-ioctl-nattr-against-buf.patch
    (bsc#1012628 CVE-2026-46197).
  - Update
    patches.kernel.org/7.0.9-146-drm-xe-Fix-bo-leak-in-xe_dma_buf_init_obj-on-al.patch
    (bsc#1012628 CVE-2026-46224 bsc#1266845).
  - Update
    patches.kernel.org/7.0.9-148-drm-xe-Fix-dma-buf-attachment-leak-in-xe_gem_pr.patch
    (bsc#1012628 CVE-2026-46201 bsc#1266841).
  - Update
    patches.kernel.org/7.0.9-151-drm-Set-old-handle-to-NULL-before-prime-swap-in.patch
    (bsc#1012628 CVE-2026-46215 bsc#1267235).
  - Update
    patches.kernel.org/7.0.9-162-drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in.patch
    (bsc#1012628 CVE-2026-46220).
  - Update
    patches.kernel.org/7.0.9-169-sctp-revalidate-list-cursor-after-sctp_sendmsg_.patch
    (bsc#1012628 CVE-2026-46227).
  - Update
    patches.kernel.org/7.0.9-170-batman-adv-fix-integer-overflow-on-buff_pos.patch
    (bsc#1012628 CVE-2026-46198 bsc#1266854).
  - Update
    patches.kernel.org/7.0.9-171-batman-adv-reject-new-tp_meter-sessions-during-.patch
    (bsc#1012628 CVE-2026-46206 bsc#1266834).
  - Update
    patches.kernel.org/7.0.9-172-batman-adv-stop-tp_meter-sessions-during-mesh-t.patch
    (bsc#1012628 CVE-2026-46208 bsc#1266853).
  - Update
    patches.kernel.org/7.0.9-173-batman-adv-stop-caching-unowned-originator-poin.patch
    (bsc#1012628 CVE-2026-46238 bsc#1266846).
  - Update
    patches.kernel.org/7.0.9-175-batman-adv-bla-prevent-use-after-free-when-dele.patch
    (bsc#1012628 CVE-2026-46212).
  - Update
    patches.kernel.org/7.0.9-176-batman-adv-bla-only-purge-non-released-claims.patch
    (bsc#1012628 CVE-2026-46233).
  - Update
    patches.kernel.org/7.0.9-177-batman-adv-bla-put-backbone-reference-on-failed.patch
    (bsc#1012628 CVE-2026-46231).
  - Update
    patches.kernel.org/7.0.9-184-EDAC-versalnet-Fix-device-name-memory-leak.patch
    (bsc#1012628 CVE-2026-46221).
  - Update
    patches.kernel.org/7.0.9-188-cgroup-Defer-css-percpu_ref-kill-on-rmdir-until.patch
    (bsc#1012628 CVE-2026-46223).
  - Update
    patches.kernel.org/7.0.9-192-vsock-fix-buffer-size-clamping-order.patch
    (bsc#1012628 CVE-2026-46234 bsc#1266904).
  - Update
    patches.kernel.org/7.0.9-194-vsock-virtio-fix-empty-payload-in-tap-skb-for-n.patch
    (bsc#1012628 CVE-2026-46207).
  - Update
    patches.kernel.org/7.0.9-195-vsock-virtio-fix-accept-queue-count-leak-on-tra.patch
    (bsc#1012628 CVE-2026-46214).
  - Update
    patches.kernel.org/7.0.9-196-drm-amdgpu-vcn3-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46237 bsc#1266871).
  - Update
    patches.kernel.org/7.0.9-197-drm-amdgpu-vcn4-Avoid-overflow-on-msg-bound-che.patch
    (bsc#1012628 CVE-2026-46217).
    suse-add-cves
  - commit d1677f1
  - blk-mq: reinsert cached request to the list (git-fixes).
  - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
  - net: ethernet: cortina: No mapping is a dropped rx (git-fixes).
  - commit 6fbeab5
  - Linux 7.0.11 (bsc#1012628).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1012628).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1012628).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1012628).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1012628).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1012628).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1012628).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1012628).
  - sysfs: don't remove existing directory on update failure
    (bsc#1012628).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1012628).
  - ksmbd: fix null pointer dereference in proc_show_files()
    (bsc#1012628).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1012628).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1012628).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1012628).
  - x86/mm: Disable broadcast TLB flush when PCID is disabled
    (bsc#1012628).
  - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    (bsc#1012628).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1012628).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1012628).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1012628).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1012628).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1012628).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1012628).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1012628).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1012628).
  - ACPI: battery: Fix system wakeup on critical battery status
    (bsc#1012628).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1012628).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1012628).
  - io_uring/waitid: clear waitid info before copying it to
    userspace (bsc#1012628).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1012628).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1012628).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1012628).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1012628).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1012628).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1012628).
  - mm/migrate_device: fix spinlock leak in
    migrate_vma_insert_huge_pmd_page (bsc#1012628).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1012628).
  - mm/damon: fix damos_stat tracepoint format for sz_applied
    (bsc#1012628).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1012628).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1012628).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1012628).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1012628).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1012628).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1012628).
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    (bsc#1012628).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1012628).
  - Bluetooth: serialize accept_q access (bsc#1012628).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1012628).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1012628).
  - net: devmem: reject dma-buf bind with non-page-aligned size
    or SG length (bsc#1012628).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1012628).
  - net: hsr: defer node table free until after RCU readers
    (bsc#1012628).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1012628).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1012628).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1012628).
  - netfilter: ip6t_hbh: reject oversized option lists
    (bsc#1012628).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1012628).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1012628).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1012628).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1012628).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1012628).
  - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    (bsc#1012628).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1012628).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1012628).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1012628).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1012628).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1012628).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1012628).
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    (bsc#1012628).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1012628).
  - selftests: mptcp: drop nanoseconds width specifier
    (bsc#1012628).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1012628).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1012628).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1012628).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1012628).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1012628).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1012628).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1012628).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1012628).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1012628).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1012628).
  - mptcp: do not drop partial packets (bsc#1012628).
  - mptcp: reset rcv wnd on disconnect (bsc#1012628).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    (bsc#1012628).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1012628).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1012628).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1012628).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1012628).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1012628).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1012628).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1012628).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1012628).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1012628).
  - octeontx2-pf: avoid double free of pool->stack on AQ init
    failure (bsc#1012628).
  - cifs: Fix busy dentry used after unmounting (bsc#1012628).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1012628).
  - ASoC: codecs: pcm512x: fix null-ptr dereference in
    pcm512x_overclock_xxx_put() (bsc#1012628).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1012628).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1012628).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1012628).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1012628).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1012628).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1012628).
  - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    (bsc#1012628).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1012628).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1012628).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1012628).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1012628).
  - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis
    tables (bsc#1012628).
  - phy: qcom: edp: Add eDP/DP mode switch support (bsc#1012628).
  - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    (bsc#1012628).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1012628).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1012628).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1012628).
  - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    (bsc#1012628).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1012628).
  - s390/cio: Restore GFP_DMA for CHSC allocation (bsc#1012628).
  - s390/pai: Disable duplicate read of kernel PAI counter value
    (bsc#1012628).
  - s390/pai: Fix missing PAI counter increments under heavy load
    (bsc#1012628).
  - fwctl: pds: Validate RPC input size before parsing
    (bsc#1012628).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1012628).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1012628).
  - cpufreq: intel_pstate: Use correct scaling factor on Raptor
    Lake-E (bsc#1012628).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1012628).
  - drm/i915/display: Copy color pipeline from plane in the primary
    joiner pipe (bsc#1012628).
  - drm/msm: Fix shrinker deadlock (bsc#1012628).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1012628).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1012628).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1012628).
  - drm/xe/multi_queue: Fix secondary queue error case
    (bsc#1012628).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1012628).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1012628).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1012628).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1012628).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1012628).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1012628).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1012628).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1012628).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1012628).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1012628).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1012628).
  - batman-adv: clear current gateway during teardown (bsc#1012628).
  - batman-adv: dat: handle forward allocation error (bsc#1012628).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1012628).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1012628).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1012628).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1012628).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1012628).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1012628).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1012628).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1012628).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1012628).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1012628).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1012628).
  - batman-adv: tt: fix TOCTOU race for reported vlans
    (bsc#1012628).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1012628).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1012628).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1012628).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1012628).
  - batman-adv: tt: prevent TVLV entry number overflow
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1012628).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1012628).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1012628).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1012628).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1012628).
  - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    (bsc#1012628).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1012628).
  - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    (bsc#1012628).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1012628).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells
    (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1012628).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1012628).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1012628).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1012628).
  - kho: skip KHO for crash kernel (bsc#1012628).
  - mm/memfd_luo: report error when restoring a folio fails mid-loop
    (bsc#1012628).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1012628).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1012628).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1012628).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1012628).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1012628).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1012628).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata
    patching (bsc#1012628).
  - riscv: Fix register corruption from uninitialized cregs on error
    (bsc#1012628).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1012628).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1012628).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1012628).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1012628).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1012628).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1012628).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1012628).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1012628).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1012628).
  - ARM: integrator: Fix early initialization (bsc#1012628).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1012628).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1012628).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1012628).
  - netfilter: x_tables: allow initial table replace without
    emitting audit log message (bsc#1012628).
  - netfilter: x_tables: allocate hook ops while under mutex
    (bsc#1012628).
  - netfilter: x_tables: unregister the templates first
    (bsc#1012628).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1012628).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1012628).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1012628).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1012628).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1012628).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1012628).
  - netfilter: nf_conntrack_expect: restore helper propagation
    via expectation (bsc#1012628).
  - kprobes: skip non-symbol addresses in
    kprobe_add_ksym_blacklist() (bsc#1012628).
  - test_kprobes: clear kprobes between test runs (bsc#1012628).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1012628).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1012628).
  - net: shaper: Reject reparenting of existing nodes (bsc#1012628).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1012628).
  - ice: fix setting RSS VSI hash for E830 (bsc#1012628).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1012628).
  - ice: dpll: fix rclk pin state get for E810 (bsc#1012628).
  - ice: dpll: fix misplaced header macros (bsc#1012628).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1012628).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1012628).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1012628).
  - phy: spacemit: Remove incorrect clk_disable() in
    spacemit_usb2phy_init() (bsc#1012628).
  - NFSD: Fix infinite loop in layout state revocation
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1012628).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1012628).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1012628).
  - fs/statmount: fix slab out-of-bounds write in
    statmount_mnt_idmap (bsc#1012628).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1012628).
  - irqchip/ath79-cpu: Remove unused function (bsc#1012628).
  - fs: fix forced iversion increment on lazytime timestamp updates
    (bsc#1012628).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1012628).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1012628).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1012628).
  - nvme: fix bio leak on mapping failure (bsc#1012628).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1012628).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1012628).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1012628).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1012628).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1012628).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1012628).
  - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    (bsc#1012628).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1012628).
  - netfs: Fix missing locking around retry adding new subreqs
    (bsc#1012628).
  - netfs: Fix missing barriers when accessing stream->subrequests
    locklessly (bsc#1012628).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1012628).
  - netfs: Fix potential for tearing in ->remote_i_size and
  - >zero_point (bsc#1012628).
  - netfs: Fix zeropoint update where i_size > remote_i_size
    (bsc#1012628).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1012628).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1012628).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1012628).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1012628).
  - netfs: Fix streaming write being overwritten (bsc#1012628).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1012628).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1012628).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1012628).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1012628).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1012628).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1012628).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1012628).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1012628).
  - netfs: Fix netfs_read_folio() to wait on writeback
    (bsc#1012628).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1012628).
  - afs: Fix the locking used by afs_get_link() (bsc#1012628).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1012628).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1012628).
  - net: ethernet: cortina: Carry over frag counter (bsc#1012628).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS
    reference (bsc#1012628).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1012628).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1012628).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1012628).
  - net: shaper: flip the polarity of the valid flag (bsc#1012628).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1012628).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1012628).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1012628).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1012628).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1012628).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1012628).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1012628).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1012628).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1012628).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1012628).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1012628).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1012628).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1012628).
  - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    (bsc#1012628).
  - drm/msm/dpu: Fix Kaanapali CWB register configuration
    (bsc#1012628).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1012628).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1012628).
  - block: rename struct gendisk zone_wplugs_lock field
    (bsc#1012628).
  - block: allow submitting all zone writes from a single context
    (bsc#1012628).
  - block: fix handling of dead zone write plugs (bsc#1012628).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1012628).
  - x86/mce: Restore MCA polling interval halving (bsc#1012628).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1012628).
  - drm/msm: Fix GMEM_BASE for A650 (bsc#1012628).
  - drm/msm/a6xx: Add soft fuse detection support (bsc#1012628).
  - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    (bsc#1012628).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1012628).
  - drm/msm/a6xx: Restore sysprof_active (bsc#1012628).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1012628).
  - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    (bsc#1012628).
  - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    (bsc#1012628).
  - ASoC: sdw_utils: cs42l43: allow spk component names to be
    combined (bsc#1012628).
  - ASoC: sdw_utils: Check speaker component string allocation
    (bsc#1012628).
  - riscv: Docs: fix unmatched quote warning (bsc#1012628).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1012628).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1012628).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1012628).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1012628).
  - net: phy: DP83TC811: add reading of abilities (bsc#1012628).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1012628).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1012628).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1012628).
  - cifs: client: stage smb3_reconfigure() updates and restore
    ctx on failure (bsc#1012628).
  - phy: apple: atc: Fix typec switch/mux leak on unbind
    (bsc#1012628).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1012628).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1012628).
  - vfio/pci: Check BAR resources before exporting a DMABUF
    (bsc#1012628).
  - ovpn: disable BHs when updating device stats (bsc#1012628).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1012628).
  - net/mlx5: Do not restore destination-less TC rules
    (bsc#1012628).
  - net/mlx5: Skip disabled vports when setting max TX speed
    (bsc#1012628).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1012628).
  - ASoC: codecs: fs210x: fix possible buffer overflow
    (bsc#1012628).
  - iommupt: Directly call iommupt's unmap_range() (bsc#1012628).
  - iommupt: Avoid rewalking during map (bsc#1012628).
  - iommu: Fix loss of errno on map failure for classic ops
    (bsc#1012628).
  - iommu: Fix up map/unmap debugging for iommupt domains
    (bsc#1012628).
  - iommu: Handle unmap error when iommu_debug is enabled
    (bsc#1012628).
  - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    (bsc#1012628).
  - iommupt: Fix the end_index calculation in __map_range_leaf()
    (bsc#1012628).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1012628).
  - ALSA: hda/ca0132: Disable auto-detect on manual output select
    (bsc#1012628).
  - cachefiles: Fix error return when vfs_mkdir() fails
    (bsc#1012628).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1012628).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1012628).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1012628).
  - btrfs: fix squota accounting during enable generation
    (bsc#1012628).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1012628).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1012628).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1012628).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1012628).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1012628).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1012628).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1012628).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1012628).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1012628).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1012628).
  - drm/gem: Make the GEM LRU lock part of drm_device (bsc#1012628).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1012628).
  - drm/xe/vf: Fix signature of print functions (bsc#1012628).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_14019988906
    (bsc#1012628).
  - drm/xe: Consolidate workaround entries for Wa_18033852989
    (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    (bsc#1012628).
  - drm/xe/tuning: Apply windower hardware filtering setting on
    Xe3 and Xe3p (bsc#1012628).
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    (bsc#1012628).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1012628).
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only
    parsing (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1012628).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1012628).
  - io_uring: propagate array_index_nospec opcode into req->opcode
    (bsc#1012628).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1012628).
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1012628).
  - cifs: Fix undefined variables (bsc#1012628).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1012628).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1012628).
  - igc: set tx buffer type for SMD frames (bsc#1012628).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1012628).
  - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp
    swing config (bsc#1012628).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1012628).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1012628).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1012628).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1012628).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1012628).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1012628).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Properly initialize charging
    threshold (bsc#1012628).
  - platform/x86: uniwill-laptop: Accept charging threshold of 0
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Fix behavior of "force" module
    param (bsc#1012628).
  - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2
    devices (bsc#1012628).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1012628).
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti
    (v2) (bsc#1012628).
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    (bsc#1012628).
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    (bsc#1012628).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1012628).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1012628).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1012628).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1012628).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1012628).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1012628).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1012628).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1012628).
  - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    (bsc#1012628).
  - erofs: fix metabuf leak in inode xattr initialization
    (bsc#1012628).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1012628).
  - wifi: mac80211: fix MLE defragmentation (bsc#1012628).
  - wifi: mac80211: fix multi-link element inheritance
    (bsc#1012628).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1012628).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1012628).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1012628).
  - Bluetooth: hci_sync: Fix not setting mask for
    HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE (bsc#1012628).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1012628).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1012628).
  - udp: gso: Fix handling checksum in __udp_gso_segment
    (bsc#1012628).
  - udp: Fix UDP length on last GSO_PARTIAL segment (bsc#1012628).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1012628).
  - net: shaper: annotate the data races (bsc#1012628).
  - net: shaper: rework the VALID marking (again) (bsc#1012628).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1012628).
  - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer
    in recvmsg (bsc#1012628).
  - net: ag71xx: check error for platform_get_irq (bsc#1012628).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1012628).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1012628).
  - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    (bsc#1012628).
  - net: stmmac: eswin: clear TXD and RXD delay registers during
    initialization (bsc#1012628).
  - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    (bsc#1012628).
  - net: stmmac: eswin: validate RGMII delay values (bsc#1012628).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1012628).
  - gpio: aggregator: fix a potential use-after-free (bsc#1012628).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1012628).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1012628).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1012628).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1012628).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1012628).
  - ASoC: cs-amp-lib: Fix wrong sizeof() in
    _cs_amp_set_efi_calibration_data() (bsc#1012628).
  - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    (bsc#1012628).
  - selftests: net: Fix checksums in xdp_native (bsc#1012628).
  - nvme-pci: fix dma_vecs leak on p2p memory (bsc#1012628).
  - nvme-pci: fix dma mapping leak on data setup error
    (bsc#1012628).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1012628).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1012628).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1012628).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1012628).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1012628).
  - net: gro: don't merge zcopy skbs (bsc#1012628).
  - net: enetc: fix missing error code when pf->vf_state allocation
    fails (bsc#1012628).
  - io_uring/nop: pass all errors to userspace (bsc#1012628).
  - blk-mq: pop cached request if it is usable (bsc#1012628).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1012628).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1012628).
  - block: avoid use-after-free in disk_free_zone_resources()
    (bsc#1012628).
  - Documentation: laptops: Update documentation for uniwill laptops
    (bsc#1012628).
  - platform/x86: uniwill-laptop: Do not enable the charging limit
    even when forced (bsc#1012628).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1012628).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1012628).
  - Rename to
    patches.kernel.org/7.0.11-200-firmware-arm_ffa-Align-RxTx-buffer-size-before.patch.
  - Rename to
    patches.kernel.org/7.0.11-373-srcu-Don-t-queue-workqueue-handlers-to-never-o.patch.
  - Rename to
    patches.kernel.org/7.0.11-417-tracing-Avoid-NULL-return-from-hist_field_name.patch.
  - commit 9c40593

++++ kmscon:

  - Split mod_pango.so into an optional subpackage
  - Add patch to restore use of agetty (gh#kmscon/kmscon#407):
    * 0001-Revert-systemd-start-login-instead-of-agetty.patch
  - Add patch to avoid use of uncommon $TERM (gh#kmscon/kmscon#411):
    * 0002-Revert-Use-kmscon-has-default-TERM.patch

++++ kubectl-switch:

  - Update to version 2.4.20:
    * Bug Fixes
  - c757c38: fix(go): update charm.land/bubbletea/v2 ( v2.0.6 →
    v2.0.7 ) (@mr-borboto[bot])
    * CI/CD
  - a88df7e: ci(github-action): update
    actions/create-github-app-token ( v3.1.1 → v3.2.0 )
    (@mr-borboto[bot])
  - 07d6641: ci(github-action): update docker/login-action (
    v4.1.0 → v4.2.0 ) (@mr-borboto[bot])
    * Chores
  - b4fe013: chore(mise): update aqua:goreleaser/goreleaser (
    2.15.4 → 2.16.0 ) (@mr-borboto[bot])

++++ kvantum-qt6:

  - Version 1.1.8
    * Covered a rare case of finding the parent menu-bar of a menu,
    especially on Wayland.

++++ kvantum-qt5:

  - Version 1.1.8
    * Covered a rare case of finding the parent menu-bar of a menu,
    especially on Wayland.

++++ latex2html:

  - version update to 2026
    * fix CRLF format input files
    * fix links with -rootdir otpion
    * config.pl: svg support now works when ghostscript
    not installed.
    * comment out the hyperref support for the html.sty
    command \htmlref.  manual now compiles with pdflatex.
  - modified patches
    * latex2html-share-dir.diff (refreshed)

++++ live555:

  - Update to version 2026.06.01:
    + Updated the "RTSPServer" implementation of the "SETUP" command
    to make it more robust if subclassed code reimplements
    "lookupServerMediaSession()" as an asynchronous operation.

++++ libabw:

  - Update to 0.1.4:
  - Fix a memory access error found by oss-fuzz.
  - Configure with --disable-werror by default.
  - Disable expanding entities by XML parser as a vulnerability
    prevention measure. Abiword-saved documents do not contain entities,
    so there is no difference in behavior.

++++ libbluray:

  - version update to 1.4.1
    * Fix linking on Windows with Freetype enabled
    * Improve compilation with MSVC
    * Cleaning and improvements in Meson build files
    * Fix build with Java 23 for BD-J
    * Add SSIF files support to bd_open_file_dec()
    * Add player setting for UO restriction level
    * Add all UOs to BD_EVENT_UO_MASK_CHANGED
    * Improve resilence against invalid input
    * Fix memory leak in UHD playlists
    * BD-J: Implement TVTimer, TVTimerSpec
    * BD-J: Improve Java 1.4 compatibility
    * BD-J: Fix MediaPresentedEvent event emission on start
    * BD-J: Fix filesystem hooking in Java 25
    * BD-J: Fix locators from org.bluray.ti.[PlayItemImpl,TitleComponentImpl]
    * BD-J: Multiple compability and performance improvements
  - deleted patches
    * libbluray-java25.patch (upstreamed)

++++ libcacard:

  - Update to version 2.8.2
    * Sort certificates by underlying objects CKA_ID to provide deterministic
    object order
    * Avoid using uninitialized memory
    * Improve test coverage and build scripts
    * Improve compatibility with modern compilers (avoid strict warnings)

++++ libcdr:

  - version update to 0.1.9
    * Upgrade m4 macros.
    * Fix crash appear with format CDR 14 and Gradients (tdf#130914, tdf#158268)
    * Fixes parsing CDR7 files with no bbox surrounding text objects (tdf#98994)

++++ libcnotify:

  - Update to release 20260602
    * No changelog was provided

++++ libetonyek:

  - Force -std=gnu++17 when building with GCC >= 16

++++ libfilezilla:

  - Update to 0.56.0
    * New features:
  - event_loop timers are now processed in a round-robin fashion
    if there are multiple expired timers
  - Added shared_value::use_count
    * Bugfixes and minor changes:
  - HTTP client: Fixed handling of 1yz responses
  - fz::socket::connect now returns early on bind failure
  - Minor fixes to socket classes
  - Changes from 0.55.5
    * New features:
  - Added %o support to fz::sprintf
    * Bugfixes and minor changes:
  - Support building with Nettle version 4

++++ libfwnt:

  - Update to release 20260602
    * No changelog was provided

++++ libfzssh:

  - Update to 1.3.0
    * New features:
  - SFTP: Added compatibility flag to ignore unknown bits in
    flags field of File Attributes
    * Bugfixes and minor changes:
  - Added extra padding to SSH_MSG_USERAUTH requests to obfuscate
    the combined length of username and password
  - Fixed some issues when importing malformed private keys
  - Improved heuristic to decide on log level if an SSH connection
    unexpectedly closes
  - Diffie-Hellman Group Exchange: Check that modulus of received group
    is a safe prime and that the subgroup is of the correct order
  - Added additional checks for trailing data in incoming packets
  - Changes from 1.2.1
    * New features:
  - Added compatibility flag to allow use of agent keys of unknown type
    * Bugfixes and minor changes:
  - Use a two-step approach to extract names from SSH_FXP_NAME packet:
    If the name blob can be extracted, but the string fails the sanity check,
    ignore the item with the invalid name
  - Handle SSH_FXP_STATUS with missing description and language tag,
    but complain loudly
  - Support building with Nettle version 4

++++ libgpiod:

  - version update to 2.2.4
    * fix buffer over-read bugs when translating uAPI structs to library types
    * fix variable and argument types where necessary
    * sanitize values returned by the kernel to avoid potential buffer overflows
    * fix memory leaks in gpio-tools
    * add missing return value checks in gpio-tools
    * fix period parsing in gpio-tools
    * use correct loop counter in error path in gpio-manager
    * make tests work with newer coreutils by removing cases checking tools'
    behavior on SIGINT which stopped working due to changes in behavior of the
    timeout tool
    * don't try to export the same chip object twice in gpio-manager on duplicate
    uevents
    * use the "add"/"remove" uevents when watching for GPIO chips in the system as
    the "bind"/"unbind" pair is only emitted by linux for controllers which don't
    have a firmware node attached
    * don't allow clearing hogs on active devices in tests
    * don't install uneeded files
    * fix a pkgconfig check in configure
    * fix a return type check in test harness

++++ libgtop:

  - Add missing %verify(not mode) (boo#1263098).

++++ libiscsi:

  - Update to release 1.20.3:
    * Add initial multithreading support: mutex/spinlock/thread
    abstractions over the pthread and native win32 APIs, with
    multithreaded async and sync examples
    * Protect outqueue, waitpdu and other iscsi_context state with
    a spinlock; immediately trigger the service thread to write
    queued PDUs
    * Fix several multithreading races between queueing a PDU and
    updating task data
    * New iscsi-rtpg utility (REPORT TARGET PORT GROUPS)
    * Numerous bug fixes and code cleanups
  - Library soname bumped from 10 to 11; rename the library
    subpackage libiscsi10 -> libiscsi11 (and baselibs.conf)
  - Switch from a git snapshot to the upstream 1.20.3 release tag
    and use the upstream tarball directly; drop the obs_scm
    _service / _servicedata

++++ liblangtag:

  - version update to 0.6.8
    * Update configure.ac for obsolete function
    * Fix build fail when srcdir != builddir
    * Add --disable-locale-alias build option
    * Bump the libtool revision.
    * Do not include merge commits in NEWS
    * const up __lt_localealias_tables
    * configure.ac: check for dlfcn.h
    * configure.ac: support slibtool
    * configure.ac: fix typo
    * build: don't overwrite LIBS
    * update ax_pthread.m4
    * Fix building on MinGW-w64

++++ liblognorm:

  - version update to 2.1.0:
    * add TurboVM bytecode engine for high-performance log parsing
    Compiles rulebases into optimized bytecode executed by a linear VM
    with SIMD-accelerated parsing primitives (SSE4.2 on x86-64, NEON
    on ARM64, scalar fallback for other architectures).
    Key features:
  - arena-based allocation (single malloc per message, O(1) reset)
  - fast result structure (typed fields, zero JSON overhead)
  - snapshot support for async consumers (rsyslog worker queues)
  - automatic fallback to recursive walker on compilation failure
    New API: ln_turbo_normalize(), ln_fast_result_get_string/int(),
    ln_turbo_snapshot_result(). New context option: LN_CTXOPT_TURBO.
    Enabled via: ./configure --enable-turbo
    Contributed by Jérémie Jourdin / Advens.
    * pcre2 used instead of pcre (which is no longer supported)
    * add a parameter skipempty to the json field type.
    If skipempty is set as follows, empty json objects are dropped from
    the parsed result.
    %field_name:json:skipempty%
    If any parameter other than "skipempty" is given ("bogus" in this
    example), an error message "invalid flag for JSON parser: bogus"
    is issued.
    Thanks to Noriko Hosoi for the patch.
    * json parser: add optional "skipempty" flag
    This removes empty strings, empty arrays and empty objects from parsed
    JSON content before it is attached to the result tree.
    Thanks to Noriko Hosoi for the original patch. Follow-up work to rebase,
    document, and align validation tests was done by Adiscon.
    NOTE: This is a potential backward-compatibility change for malformed
    rulebases that used extra json parser flags such as
    "%field:json:bogus%". Such invalid flags were previously ignored and are
    now rejected during rule loading.
    * Op-quoted-string : Add support for escaped characters
    Thanks to Kevin Guillemot for the patch. Some follow up work
    was done by Adiscon.
    * parser(quoted-string): return the extracted value without the surrounding
    quote characters.
    * parser(name-value-list): add ignore_whitespaces option and accept trailing
    empty trimmed values.
    * parser(repeat): allow one named dot among unnamed parsers.
    * fixed error callback cookie - the wrong one was provided
    * hardening: fix empty-tag rulebase crash, repeat while validation crash,
    parser EOF handling, and harden GitHub Actions security.
    * improved CI with additional checks, including sanitizers and
    an rsyslog integration test
    * introduced doc for AI agents, e.g. AGENTS.md
  - deleted patches
    * liblognorm-2.0.6-pcre2.patch (upstreamed)

++++ libmspub:

  - Version update to 0.1.5:
    * Fix several problems found by oss-fuzz.
    * Fix regression in closing shape groups that caused missing shapes on
    second and subsequent pages. (tdf#116018)
  - deleted patches
    * fix-missing-include.patch (upstreamed)
    * libmspub-0.1.4-gcc15.patch (upstreamed)

++++ openvswitch:

  - Update ovn to 26.03.1
  - Fixes heap over-read in ICMP error response generation
    (CVE-2026-5265) (bsc#1262498).
  - Fixes heap over-read in OVN DHCPv6 client ID processing
    (CVE-2026-5367) (bsc#1262499).
  - Bug fixes

++++ proj:

  - Drop the dead gcc13 fallback and the matching %build compiler
    overrides (the suse_version < 1600 path only applied to the
    now-EOL Leap 15.6)
  - Fix the %install doc-dir cleanup to target %{_docdir}/%{name}
    instead of an empty-variable path

++++ qalculate:

  - Update to version 5.11
    * Add set functions (union, intersect, setdiff, setxor, isMember, isSubset) and operators (∪, ∩, ∖, ⊖, ∈, ⊆, etc.)
    * Add characters(), count(), digitSum(), and digitalRoot(), find(), popCount(), string(), and while() functions
    * Support negative row and column values in element(), row(), and column() functions
    * Support matrix[row][column] syntax
    * Support text objects in sort() function
    * Add third optional argument to interval() function to allow exclusion of exact endpoints
    * Ignore "to" and "where" (and equivalent symbols) inside quotation marks
    * Ignore dot in front of plus or minus (for consistent behavior in line with entrywise operators)
    * Show "Division by zero" warning for all divisions by zero
    * Make display of expressions with time units in time format more consistent
    * Fix support for vector in argument of many functions (erf, mod, exp, etc.)
    * Fix explicit conversion to mixed units for year variants
    * Fix first digit missing in return value of integerDigits() in some cases
    * Fix segfault when Calculator object is destroyed with uninitialized random state
    * Fix infinite loop when referencing subfunction in another subfunction
    * Fix segfault in replace() with variable specified using where expression, e.g. "replace(v, x, 1) where v = x"
    * Fix segfault when data set function name is followed immediately by a single dot
    * Fix v[i]=a syntax for vector element assignment
    * Do not bind escape key (fixes bad behavior with keys that generate escape sequences, e.g function keys) (CLI)
    * Fix use of x, y, z, without backslash, for arguments when using function command (CLI)
    * Fix parse status and calculate-as-you-type when "where" expression defines a new symbol (Gtk, Qt)
    * Convert degree Celsius to Fahrenheit and vice versa in Gnome search provider (Gtk)
    * Fix compilation on macOS (Gtk)
    * Minor bug fixes and feature enhancements

++++ libqxp:

  - update to 0.0.3:
    * Memory safety fixes

++++ rhash:

  - fixes SIGILL on pre-2007 x86 PCs not supporting SSE4, notably  making
    cmake (which depends on this package) unusable on these machines.
    By default, compile with --disable-shani on x86 to disable compilation
    with SSE4 instructions (-msse4)

++++ librsvg:

  - Update to version 2.62.3:
    + librsvg crate version 2.62.3
    + librsvg-rebind crate version 0.3.0
    + Remove loading limits from image-rs. This means that raster
    images, when embedded in SVG documents, have no limits for
    their size or memory consumption. The idea, for now, is that
    security-sensitive applications that use librsvg should do
    their own sandboxing if they want to impose memory limits.
    + Fix the logic for whether gdk-pixbuf-query-loaders should be
    run during cross-compilation. Native builds can of course use
    it; cross builds can use it if they can run host binaries *and*
    an executable wrapper has been set *and* the target sysroot
    contains the corresponding gdk-pixbuf-query-loaders executable

++++ libselinux:

  - Add patch for restorecon to log error on readonly fs (bsc#1232226)
  - Patch: restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
  - Can be dropped with the next toolchain release:
    https://github.com/SELinuxProject/selinux/commit/fd411d50ba1cb3e8ad5f8ce4e3c9bc7fcbe4340c

++++ libstoragemgmt:

  - Update to release 1.10.3:
    * Drop Python 2 support and the dependency on python-six
    * Use sysusers.d for adding the libstoragemgmt user/group
    * libsg: change sprintf to snprintf
    * Correct a capability bit mask and a string concatenation
    bug; suppress a clang var_arg warning
    * Misc fixes and CI/test improvements
  - Use the upstream-shipped sysusers.d file
    (%{_sysusersdir}/libstoragemgmt.conf) and drop the downstream
    system-user-libstoragemgmt.conf source
  - Drop python-six BuildRequires/Requires (no longer used)
  - Spec cleanup:
    * Remove the now-dead Python 2 conditionals and the unused
    python_sitelib/python_sitearch defines (use the python3
    macros directly)
    * Drop the obsolete --with-python3 configure switch (removed
    upstream)
    * Drop Group tags
  - Rebase move_to_run.patch onto 1.10.3; drop its obsolete
    bundled-spec and _common.py hunks (only the C sources still
    reference /var/run)

++++ libvisio:

  - version update to 0.1.11
    * Memory safety fixes
    * More work on better handling of theme colors (tdf#168475)

++++ xar:

  - Spec cleanup:
    * Add explicit gcc and make BuildRequires
    * Convert the library -devel BuildRequires to their pkgconfig()
    form (libacl, bzip2, libxml-2.0, zlib)
    * Drop obsolete Group tags

++++ zbar:

  - Correct the License tag to LGPL-2.1-or-later (the sources are
    LGPL 2.1 or later, not 2.0)
  - Minor spec cleanup

++++ logwatch:

  - Update to 7.14
    * Merge /u/opoplawski/logwatch/ branch archives into master
    * Add missing flag for Output_Generated
    * Merge /u/fcrawford/logwatch/ branch frank-zz-disk-space into master
    * Sort human order
    * [postfix] Support for Postfix version 3.11, by Michael Grimm
    * [dnf5] Exit gracefully if dnf not installed.
    * [clam-update] Clarified use of files in syslog format.
    * Merge /u/fcrawford/logwatch/ branch frank-misc into master
    * Match some updated output
    * Fix output of blank sendmail section when not running
    * Update termination message
    * [dovecot] Added support for Submission statements, by Bob Hockney
    * Suppress excess new line when no output generated
    * Exclude virtual FS nsfs
    * Remove tabs and clean up formatting
    * Handle dnf5 returning times as UTC
    * Add new script to process dnf5 reports
    * [dovecot] Fixed typos, by Vladimir Lomov
    * [dovecot] Support for dovecot version 2.4, by Vladimir Lomov.
    * [clam-update] Created specific $clam_update_detail variable, and added  debug statements showing how it is set.
    * [dovecot] Fixed spacing, by Vladimir Lomov
    * [chronyd] Initial submission of chronyd, by Miroslav Lichvar.
    * [sshd] Corrected port number in debug statement.  Reported by Andrew Myers.
    * [clam-update] Corrected instructions for using RemoveHeaders, per Nicolas Croiset
    * Update documentation to reflect that --archives is the default and allow disabling with --noarchives
  - modified sources
    * ChangeLog
  - deleted patches
    * 0001-Exclude-virtual-FS-nsfs.patch (upstreamed)

++++ lynx:

  - version update to 2.9.3
    * correct position of whereis highlighting in wrapped lines, e.g., in source
    view (report by Rajeev V Pillai) -TD
    * add option -fail_on_alert (WaitronCharm)
    * review manpage, adding default values for most boolean options -TD
    * implement formaction attribute for button and input tags in forms (report by
    Henning Haeske) -TD
    * add a null pointer check to MakeFormAction (Debian #1119084) -TD
    * do not report the case of a SELECT tag not within a FORM as Bad HTML (report
    by Jindrich Kolorenc) -TD
    * update wcwidth from xterm -TD
    * fix some inconsistencies in display of zero-width Unicode values (report by
    Russell Bell) -TD
    * change ifdef's for configuring compression encodings to require both the
    library and the related command-line tool to ensure that Accept-Encoding
    will work consistently for downloads (report by Riku Virtanen) -TD
    * increase the limit for color-style changes per line to work with pages such
    as https://nano-editor.org/ (report by Rajeev V Pillai) -TD
    * add configure option --with-man2html, to help with generating html file from
    the manpage -TD
    * modify --enable-locale-charset option to be enabled by default for ncurses,
    and change the compiled-in default for the corresponding option to true,
    for ncurses -TD
    * change default for --enable-wcwidth-support to enabled if built with wide
    character ncurses -TD
    * document link rel="author" in user's guide, use instead of link rev="made" in
    samples and documentation, cf: 2.8.7dev.11 -TD
    * use plink.sh script to trim unnecessary libraries when linking -TD
    * remove redundant configure macros -TD
    * remove --enable-gnutls-compat configure option -TD
    * remove --with-nss-compat configure option -TD
    see https://fedoraproject.org/wiki/Nss_compat_ossl
    * modify HTTPS connection to retry with different versions of SSL and TLS
    (patch by Nate Choe)
    * spelling fixes (Eric Lindblad)
    * fix typos in user guide (patch by David Apps)
    * correct parsing of named-entity, accepting ".", ":", "_", "-" -TD
    * update src/chrtrans/entities.h using https://www.w3.org/TR/xml-entity-names/
    (report by Brian Inglis) -TD
    * review/update copyright/licenses for test-package.
    add conditional macros for LY_TEST_FMTS to help check for format mismatch -TD
    * correct sprintf-format used for gopher telnet connections -Ben Collver
    * fix stricter gcc15 warnings -TD
    * update config.guess (2024-07-28), config.sub (2024-06-03)
    * update nl.po, add ka.po, kab.po from
    http://translationproject.org/latest/lynx
    * add support for zstd encoding / compression (patch by Steffen Nurpmeso).
    * changes to configure script:
    + improve file-globbing checks, e.g., for MingW
    + add option --enable-arc4random, normally enabled, to accommodate mawk's
    use of the CF_SRAND macro -TD
    + AM_WITH_NLS - don't define IGNOTE_MSGFMT_HACK on the command-line because
    that goes into the ".pc" and "*-config" files.  Replace this by a check
    which can define HAVE__NL_MSG_CAT_CNTR, which is more informative -- should
    only occur with GNU gettext -TD
    + CF_BUILD_CC - revert build-fix for PDCurses, because it interferes with
    other scripts -TD
    + CF_CURSES_FUNCS - modify to work with autoheader (Debian #1071581)
    + CF__INTL_BODY - replace ifdef for _nc_msg_cat_cntr -TD
    * update Debian test-package for renamed test-package of ncurses -TD
    * modify mailcap "test=" handling to redirect stdout/stderr to /dev/null
    (Debian #1072504) -TD
    * implement "%t" substitution for mailcap -TD
    * improve configure check for SOCKS library -TD
  - modified patches
    * lynx-default-image-viewer.patch (refreshed)

++++ lzfse:

  - Spec cleanup:
    * Build the header-only devel subpackage as noarch (fixes the
    no-binary error)
    * Add explicit gcc BuildRequires and use %autosetup
    * Reword the summary so it no longer repeats the package name
    * Drop obsolete Group tags

++++ melange:

  - Update to version 0.52.0:
    * feat(pipelines/xcover): add include-functions (#2551)

++++ mesheryctl:

  - update to 1.0.35:
    * General
  - [CI] Makefile: wasm-engine target compatibility with macOS
    @jamieplu (#19821)
  - fix wasm build @aabidsofi19 (#19817)
  - Add repository details for each maintainer @miacycle (#19773)
  - Governance scaled out @miacycle (#19772)
  - fix(make): run go mod tidy before wasm-engine build
    @ShubhamSoni09 (#19814)
  - [Server] Add doc.go for native Go policy engine @guan404ming
    (#19271)
    * Meshery CLI
  - fix(mesheryctl): bridge v1beta3 design parse output to
    v1beta1 for evaluation @PragalvaXFREZ (#19804)
  - Compile Golang Policy Engine to WASM @guan404ming (#18939)
  - [mesheryctl] add csv support on relationship generate
    @Omkar-Ugal (#19640)
  - add design evaluate subcommand @aabidsofi19 (#17897)
    * Meshery UI
  - [UI] Fix deploy icon color in design action menu
    @Rajesh-Nagarajan-11 (#19789)
  - Compile Golang Policy Engine to WASM @guan404ming (#18939)
  - [CI] Update .nvmrc files from Node 18 to Node 22 to match
    engines field @Pranav-d33 (#19511)
  - Fix discard button error background @Rajesh-Nagarajan-11
    (#19788)
    * Maintenance
  - feat: add hardened runner step to GitHub workflows for
    enhanced security @ianrwhitney (#19818)
  - Compile Golang Policy Engine to WASM @guan404ming (#18939)
    * Documentation
  - Compile Golang Policy Engine to WASM @guan404ming (#18939)
  - docs: Fix broken Contributing to Meshery UI links @aprv10
    (#19803)
  - [Docs] Add high-level overview of native Go policy engine
    @guan404ming (#19150)

++++ molequeue:

  - Spec cleanup:
    * Convert zeromq-devel to pkgconfig(libzmq)
    * Use %autosetup and the %{optflags} macro
    * Drop obsolete Group tags

++++ nbd:

  - Update to version 3.27.1:
    * Enable TLS 1.3 by default (while still disallowing TLS 1.1
    and below)
    * Set a sensible default port again: an nbdtab entry without a
    port specification is read as the default 10809 instead of 0
    * nbd-client: find the index when the device name is given
    without the /dev/ prefix
    * nbd-client now depends on the nbd kernel module being loaded
    * Refactor nbd-client argument parsing into a separate file
    * Fix configure --disable-manpages
    * Fix build on musl + gcc14 (incompatible-pointer-types)
    * Several clang-warning, formatting and cleanup fixes
  - Drop nbd-forgotten-sh.tmpl.patch: upstream moved the shell
    template to systemd/sh.tmpl and ships it in the tree
  - Build from the upstream git archive and regenerate the build
    system with autogen.sh; add autoconf, autoconf-archive,
    automake, flex and libtool BuildRequires

++++ nextcloud:

  - Update to 33.05
    * server
  - Refactor: move release changelog workflow to releases repo (server#60831)
    * notifications
  - Fix: Add missing DI for IAppConfig to Push.php (notifications#3039)
    * text
  - Fix(folderDescription): always use 'Readme.md' as filename (text#8658)
  - Fix(headings): skip headings in details in table of contents (text#8660)
  - Test(playwright): add summary job so we can add it to merge rules (text#8663)

++++ openQA:

  - Update to version 5.1780410522.ad58d974:
    * feat(tests): enable parallel-safe fullstack and developer mode tests
    * fix: ignore transient 'database is locked' errors in cache service
    * git subrepo pull (merge) --force external/os-autoinst-common
    * Revert "fix: avoid permission denied on cgroup creation for v2"
    * feat: add run-test-env target to start all local services
    * fix: add functional API keys for local test environment
    * fix: use absolute paths for local test environment
    * feat: Improve CLI retry error feedback with detailed messages
    * fix: avoid permission denied on cgroup creation for v2
    * ci: Auto-import keys to avoid interactive prompt for devel_openQA
    * docs: require atomic commits in agent guidelines
    * fix: include file paths in worker logging errors
    * chore(AGENTS.md): add rules for ensuring valid commits
    * fix: only report job limit in UI when globally reached
    * docs: Clarify wording in "Spawning multiple jobs …"
    * docs: Fix wrapping in "Medium Types" section
    * docs: Fix wrapping and use of blank lines in "Spawning multiple jobs …"

++++ opencloud-server:

  - Update to version 7.1.0:
    * Documentation
  - Release 7.1.0 [#2820]
  - docs(adr): Remove erroneous mention of kanidm [#2783]
    * Bug Fixes
  - Prevent personal space creation for service- and lightweight
    users [#2876]
  - chore: bump reva to 2.46.1 [#2869]
  - fix: Send SSE events for SpaceCreated/-Disabled/-Deleted
    [#2851]
  - Only try to limit search to spaces if there's a space id to
    limit to [#2834]
  - fix(init): Only log admin password if it was generated
    [#2839]
  - fix: translations for activities and others [#2836]
  - fix-2824. run tests without remote.php [#2826]
    * Enhancement
  - chore: bump web to v7.1.0 [#2870]
    * Dependencies
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from 1.43.0 to 1.44.0 [#2855]
  - build(deps-dev): bump license-checker-rseidelsohn from 4.4.2
    to 5.0.1 in /services/idp [#2854]
  - build(deps-dev): bump cldr from 7.9.0 to 8.0.0 in
    /services/idp [#2853]
  - build(deps): bump i18next from 26.1.0 to 26.3.0 in
    /services/idp [#2849]
  - build(deps-dev): bump sass-loader from 16.0.8 to 17.0.0 in
    /services/idp [#2845]
  - build(deps): bump google.golang.org/grpc from 1.80.0 to
    1.81.1 [#2848]
  - build(deps): bump
    go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
    from 0.68.0 to 0.69.0 [#2847]
  - build(deps-dev): bump typescript from 5.9.3 to 6.0.3 in
    /services/idp [#2846]
  - build(deps-dev): bump postcss-loader from 4.3.0 to 8.2.1 in
    /services/idp [#2830]
  - build(deps): bump github.com/riandyrn/otelchi from 0.12.2 to
    0.12.3 [#2814]
  - build(deps-dev): bump workbox-webpack-plugin from 7.4.0 to
    7.4.1 in /services/idp [#2781]

++++ openmpi5:

  - Backport upstream patches for GCC16 support
  - gcc16-initializers.patch
  - gcc16-inline.patch

++++ openmpi5-testsuite:

  - Backport upstream patches for GCC16 support
  - gcc16-initializers.patch
  - gcc16-inline.patch

++++ os-autoinst:

  - Update to version 5.1780410333.aed07e0:
    * fix(test): use linuxboot_dma.bin in 18-backend-qemu.t
    * feat: consolidate tidy targets into CMake
    * fix: fail explicitly on test module basename collisions
    * feat(mouse_drag): use the clickpoints
    * test: allow to configure full-stack test output directory
    * test: allow shortening long typing in full-stack tests

++++ ouch:

  - Update to 0.8.0:
    Packaging:
    * Reproducible builds (#973).
    New Features:
    * Releases: add Apple Silicon macOS (aarch64-apple-darwin) to assets.
    * Unpack into new folder by default (#962).
    * Add --here flag to unpack into current directory (#962).
    * List: show symlink targets (for tar and zip) (#934)
    * Add aliases for ebooks (.epub) (#981)
    Improvements:
    * Improve options for solving conflicts (#964)
    * Report mtime-set errors for .7z as warnings (#950)
    * list: also display symlink targets (#934)
    * Improve man pages for subcommands (#980)
    Bug Fixes:
    * Fix Ouch trying to overwrite current directory (#962)
    * Fix various panics not handled gracefully (#950)
    * Handle GNUSparse archive entries during tar decompression (#975)
    * Fix .rar being slow (#968)

++++ ovmf:

  - Update to edk2-stable202605
  - Patches (git log --oneline --date-order edk2-stable202602..edk2-stable202605)
    b03a21a63e3b UefiCpuPkg: Remove the absolute address jump in LoongArch exception handler
    e6863d9cb987 MdePkg: Disable AuditOnly Mode for Spell Check
    6f73fbea9778 MdePkg: Fix Spelling Errors in Comments
    27f83abf1b65 .pytool: Update cspell Allowed Words
    b5d4a2c4789d MdePkg,MdeModulePkg: Fix Spelling Error in Udf Definitions
    1efbb315fd43 MdePkg: Fix Spelling Errors in CXL Definitions
    627860407ae1 MdePkg: Fix Spelling Errors in HiiImageDecoder Definitions
    4da6018ffe6e MdePkg: Fix Spelling Errors in IPMI Definitions
    5981dfcb5f49 MdePkg: Fix Spelling Error in DriverConfiguration2 Definitions
    5aaf451f8b67 MdePkg: Fix Spelling Errors in ACPI Definitions
    efd3635d901e MdePkg: Fix Spelling Error in ScsiIo Definitions
    f3b29f03c4d6 MdePkg: Fix Spelling Error in Cper Definitions
    2ced4c80342a MdePkg: Fix Spelling Error in Hash Definitions
    208454c51def MdePkg: Fix Spelling Error in Nvme Definitions
    bf5ed9cc551b Global: Fix Spelling Errors in PCI/PCIe Definitions
    e6f401761a73 MdePkg: Fix Spelling Errors in SmBios Definitions
    7c440a7a2b55 MdePkg,MdeModulePkg: Fix Spelling Errors in Atapi Definitions
    81b7c2912bd6 MdePkg,SecurityPkg: Fix Spelling Errors in TCG/TPM Definitions
    4e5672043bd5 ManageabilityPkg: add configurable KCS status-check timeout PCD
    441873c2a987 SecurityPkg/SecureBootVariableLib: Cleanup debug print readability
    8add400a8be8 MdeModulePkg: Cleanup debug print readability
    5caf4c6aeb4a MdeModulePkg,MdePkg: Send I/O without FUA if necessary
    ee58614bbbb4 MdeModulePkg/ScsiDiskDxe: Check Write Caching and FUA support
    b8df7d9c8e1e ArmVirtPkg/ArmPlatformLibQemu: Support early ID map on LPA2 capable CPUs
    d73615b24ba4 Revert "ArmPlatformPkg,EmbeddedPkg,MdeModulePkg: Move RealTimeClockLib ..."
    f3d49c80246d MdePkg/Include: Add missing ACPI EINJ structure
    c00c1216ce7f ArmPkg/CpuDxe: Refuse to clear XN from device memory mappings
    99d8c3710a0f ArmPkg/CpuDxe: Drop GCD system memory check from MemoryAttribute protocol
    7ab771ddcf8d .github: Remove SignedCapsulePkg
    1c1f858a4df0 .pytool: Remove SignedCapsulePkg
    a3c4fd772a17 .azurepipelines/templates/pr-gate-build-job.yml: Remove SignedCapsulePkg
    111a799abd83 Maintainers.txt: Remove SignedCapsulePkg
    c00e8d0bcddf SignedCapsulePkg: Remove package
    6d4e97380784 NetworkPkg/DnsDxe: Refactor answer loop to for in ParseDnsResponse
    ccc95703cd8b NetworkPkg/Ip4Dxe: Fix missing Status check on Ip4Cfg2->SetData call
    f1f89f454cd8 ShellPkg/UefiShellLevel3: Lower indentation level in MainCmdXXX()
    8b5c970c55a7 ShellPkg/Help: Extract PrintMatchingHelp() function
    27c785b0df7f ShellPkg/UefiShellLevel3: Extract ProcessFileList() function
    014d8fb941f8 ShellPkg/UefiShellLevel3: Extract MainCmdXXX() function
    49ba46ec0ae6 ShellPkg/UefiShellLevel3: Return if ShellCommandLineParse() failed
    a219f8cfc541 ShellPkg/Help: Free package on all paths
    899b8b8550f8 ShellPkg/Type: Factorize character display
    680ee2e3e9b1 ShellPkg/Cls: Factorize color parsing
    68662fd712b9 ShellPkg: Add 'cxl' command
    d9c842477ec8 OvmfPkg: Include CxlDxe
    a87c9f062170 MdeModulePkg: Add CxlDxe driver
    6afdf4e7fbff MdeModulePkg: Add CxlIo.h protocol
    2a8ba80f276d MdePkg: Add CDAT structure definitions
    780a9c2dfccb MdePkg: Add Data Object Exchange interface
    50537c6a1171 OvmfPkg/OvmfXen: Remove SEC source level debug for Xen
    66820c9ace07 OvmfPkg: FSBClock moved to FixedAtBuild for platforms except Xen
    c801f959bba9 ShellPkg/UefiShellLevel1: Lower indentation level in MainCmdXXX()
    c50e5fe946ad ShellPkg/UefiShellLevel1: Extract MainCmdXXX() function
    e8036a9fbbe4 ShellPkg/UefiShellLevel1: Return if ShellCommandLineParse() failed
    d8b163508842 DynamicTablesPkg: add Hest table generator
    d9256a20ffb1 DynamicTablesPkg: add X64 objects for error sources
    829c70b9efe0 DynamicTablesPkg: add common objects for common error sources
    6bd553cc35fd MdeModulePkg: Remove duplicate library class in dsc file
    0bc238d06684 MdePkg/AdapterInformation: Add CDAT adapter information type
    3b899d2e586c MdeModulePkg/DxeCapsuleLibFmp: Tolerate EFI_ALREADY_STARTED in LockVariable
    5acaac4f322d NetworkPkg/Ip4Dxe: Reject IPv4 addresses ending with dot
    31ea9bcc70b0 ArmVirtPkg: Kvmtool: Init Arm CCA HOBs in PlatformPeim()
    9c05ec80a285 ArmVirtPkg: Add a helper function to initialise Arm CCA HOBs
    f8ca1db593f9 ArmVirtPkg: Add NULL instance of ArmCcaInitPeiLib
    15cf30827650 ArmVirtPkg: Add library for Arm CCA initialisation in PEI
    eee6ed8b117f OvmfPkg/XenBusDxe: Fix an error message
    0d6750b88cbc OvmfPkg/XenPlatformPei: Remove call to XenHypercallLibInit
    c4cdc1794a51 OvmfPkg/XenHypercallLib: Remove unused HobLib
    b6480f6270b3 ArmVirtPkg: Add a helper to check protected MMIO address
    1ae23a7acd13 ArmVirtPkg: Add Null instance of ArmCcaLib
    39ff71df13cb ArmVirtPkg: Add library for Arm CCA helper functions
    7c0fed45459b ArmVirtPkg: Add GUID HOBs to cache Realm IPA width and execution state
    351dfdb3836f MdeModulePkg: Remove duplicate procotols guid in INF files
    7d87a9d339c8 UefiPayloadPkg: Remove duplicate library and file name in INF file
    c86451e79bce UefiCpuPkg: Remove duplicate libraries in INF files
    34c7871fec1a SourceLevelDebugPkg/DebugAgent: Remove duplicate library in INF file
    25540b069f9f SecurityPkg: Remove duplicate file name in INF file
    687d8049f574 ShellPkg/Shell: Remove duplicate Guid in INF file
    42364d6c6f94 OvmfPkg/Sec: Remove duplicate PCD in INF file
    6d4f24a74900 NetworkPkg/GoogleTest: Remove duplicate file name in INF file
    35102d932fef IntelFsp2WrapperPkg: Remove duplicate library class in INF file
    1c39524aec65 EmbeddedPkg: Remove duplicate procotol in INF file
    482b4bf0a51a EmulatorPkg/Host: Remove duplicate procotol in INF file
    71bf0d807dc2 ArmPkg/ArmGicDxe: Remove duplicate library in INF file
    c8833afa7a46 MdeModulePkg/NvmExpressDxe: Mark CDW10/CDW11 valid for Format and Sanitize
    ae2d2d76c1b9 ArmPkg,MdePkg,MdeModulePkg: change ArmFfaLibGetVersion() with whole version
    50349c5e07e7 ArmPkg/Library: optimise StandaloneMmMmuLib with FF-A v1.3
    03a07cb0f5e9 OvmfPkg/IntelTdx: only add UI to NCCFV
    99148f1df884 DynamicTablesPkg: AcpiIortLibArm: Support SMMUv3 revision 5
    56a250ad9f84 DynamicTablesPkg: AcpiIortLibArm: Support IORT revision 6
    112a43a92d92 RedfishPkg/RedfishHttpDxe: Improve RedfishHttpOperation error handling
    3449c60bab69 BaseTools: Add GENFWHII_FLAGS to fix VS2026 GenFw build issue
    2f3883dd5912 NetworkPkg/HttpBootDxe: Add all events to HttpBootHttpCallback()
    0e6f016032ed MdePkg/IndustryStandard: add LoongArch IOVT structures
    53783077e291 RedfishPkg/RedfishDiscoverDxe: Do not require TCP6 if IPv6 HTTP off
    ef745f258c03 .github/workflows: Enable CodeQL on ManageabilityPkg
    19d4bdefde67 ManageabilityPkg: Add ManageabilityPkg CI yaml
    b270eb225634 .pytool: Add ManageabilityPkg to CI
    b60d8dedca3a .azurepipelines: Add ManageabilityPkg the gate keeper
    4906829f64b3 .github: Add ManageabilityPkg to git issue and bug report
    24b8d2a61c28 Maintainers.txt: Add maintainer and reviewers for ManageabilityPkg
    c9c309146e49 ManageabilityPkg: Initial version of ManageabilityPkg
    962c1f2a060e StandaloneMmPkg: Fix possible infinite loop due invalid hob
    b6c1c1afdc51 BaseTools/PatchCheck.py: Skip length check for Co-authored-by line
    793eee379562 MdePkg/Acpi66.h: Fix comments for SRAT structure types
    92e662f1aa8f MdePkg/Acpi65|66.h: Add Generic Port Affinity structure and flags for SRAT
    7e9eb04d71ad CryptoPkg/Library/MbedTlsLib: Update mbedtls submodule to v3.6.6
    fcac2f3a6dfc MdePkg: Add macros for ARM Processor Error Section in Cper.h
    2eefbc5d34e4 MdePkg: Update YAML to ignore specific ECC files/errors
    1fd1e30a525e ArmVirtPkg: ArmCcaRsiLib: Add RSI Features support
    8b2e33476d29 ArmVirtPkg: ArmCcaRsiLib: Add an interface to get an attestation token
    896c0b58035a ArmVirtPkg: ArmCcaRsiLib: Add an interface to make a RSI Host Call
    74a04882d6cf ArmVirtPkg: ArmCcaRsiLib: Add interfaces to get/extend REMs
    2029a69a0b00 ArmVirtPkg: ArmCcaRsiLib: Add interfaces to manage the Realm IPA state
    66d18535730b ArmVirtPkg: Add Arm CCA Realm Service Interface Library
    4d9bf36047e4 MdePkg/IndustryStandard: Add Arm CCA RSI FID definitions
    12e26dc213cb ShellPkg/TimeDate: Extract GetTimeZoneFromString() helper
    c062ff8487d2 ShellPkg/TimeDate: Extract PrintDaylight() helper
    a366d6f8fe6c ShellPkg/TimeDate: Extract PrintTime() helper
    0f69afa29536 ShellPkg/TimeDate: Extract GetCurrentTime() helper
    be6ce32cd011 ShellPkg/Ls: Extract PrintLsOutputCurr() function
    636761d3cab4 ShellPkg/Ls: Lower PrintLsOutputRec() indentation level
    da54ab306a62 ShellPkg/Ls: Extract PrintLsOutputRec() function
    08bc059570d8 ShellPkg/Ls: Remove unused TimeZone parameter
    78b550f43d2f ShellPkg/Ls: Hard-code number of files if none found
    273edd9e0147 ShellPkg/Ls: Extract GetCorrectedPath() function
    9171edd4d446 ShellPkg/Ls: Move FileMetaArg closing logic
    c45e930ad581 ShellPkg/Ls: Extract UpdateFileLocalTime() function
    6829285f88a6 ShellPkg/Rm: Extract DeleteDirectory() function
    420dab0b24c4 ShellPkg/UefiShellLib: Add IsDotOrDotDot() function
    4afe895a7707 ShellPkg/SerMode: Add ValidDataBits() function
    65288416dfbe ShellPkg/SerMode: Add GetStopBits() function
    5e8b0d6de5be ShellPkg/SerMode: Lower indentation level in DisplaySettings()
    a5e74cdedb2b ShellPkg/SerMode: Add GetParityType() function
    06372c8df1c1 ShellPkg/SerMode: Add name conversion arrays for parity/stop bits
    e146b012f542 MdePkg/ArmFfaMemMgmtLib: Set NS bit support in FFA_FEATURES query
    ddc7ed1deeb0 MdeModulePkg/Library: introduce ArmFfaConsoleDebugLib
    2fb6e81c06b6 RedfishPkg/ConfigHandler: Remove [Depex] section from INF file
    96484a32b1e5 OvmfPkg/VirtioBlkDxe: protect SynchronousRequest against interrupts
    87cfc60f2066 MdeModulePkg/Library: ArmFfaLib: add mapping ARM_FFA_RET_RETRY
    5e2bea1a7453 BaseTools: Add missing machine types while dumping Option Rom
    0f2dc7558713 MdeModulePkg: Don't Allow Guard Pages to Cross Bin Boundaries
    9b34b680500b .mergify/config.yml: Use rebase for update_method
    b5f11993237d EmbeddedPkg: Add missing FreeAlignedPages() implementation
    691b92fe05cd UefiCpuPkg/ArmMmuLib: Introduce ArmCcaSetMemoryProtectionAttribute()
    90f40e654c1c UefiCpuPkg/ArmMmuLib: Handle Realm unprotected bit
    5bdf8acc1384 MdePkg: Add helper function to detect RME
    c31b880bd21c MdeModulePkg/NetworkCommon: Add PCD for USB network periodic timer
    23eaf2d5292d UefiCpuPkg/SmmCpuFeaturesLib: Add Standalone MM file for AMD family
    be4fc071eb01 BaseTools: Reject Inline Comments in tools_def
    8e873a83b27e .pytool/SpellCheck: Provide ignored paths to cspell
    30b1cb6cabb9 DynamicTablesPkg/FdtHwInfoParserLib: Update SmmuV3 DeviceId Valid flag
    db38e5031a15 ShellPkg/AcpiView: Update MPAM table "MMIO size" field check
    b249f5d50282 MdePkg: ArmLib: Drop DebugLib Dependency
    87148bcc25bb Global: Move ArmLib to MdePkg
    63295871676d ReadMe.rst: Update CI pipeline badges
    0dddd6549d8d MdePkg/IndustryStandard:: Add ACPI 6.6 extension for NUMA ACPI Tables
    3971a4dba93f MdeModulePkg/NvmExpressDxe: Clear NSID to 0 for sanitize command
    0d44f421a58f BaseTools: tools_def: Align X64 CLANGDWARF and CLANGPDB Defs
    192b5a92b36b BaseTools: tools_def: Canonicalize CLANGDWARF Defs
    3b0deb5e7941 EmbeddedPkg/PrePiLib: Prevent overread with FFS size macros
    9989454219e7 EmulatorPkg/SecPeiServicesLib: Prevent overread with available size macros
    7e0b85e03bcc StandaloneMmPkg/Core: Return when processing malformed DEPEX
    4d15c942fb11 ReadMe.rst: Fix header formatting, path separators, and grammar
    d4a6e02659bf BaseTools/Conf: Add missing CLANGDWARF OBJCOPY_FLAGS
    d45ce5aceabf EmulatorPkg: Clear DLINK_XIPFLAGS
    e5997b818060 EmulatorPkg: Add Windows CLANGPDB CI
    2a5f6b22b900 TcgTpmPkg: Update Readme.md to use markdown code block syntax
    f5c6c98d89e4 OvmfPkg/IgvmSecureBootDxe: Remove CustomMode code
    b2a149cf97e4 UefiCpuPkg: ArmMmuLib: Check if Block Split Following Page Alloc
    5107351f77b5 TcgTpmPkg: fix build failure of TpmLib with CLANGDWARF
    ec1f28670a52 BaseTools: add --apply-dynamic-relocs option for AARCH64 CLAGNDWARF
    11a89ec0305f IntelFsp2Pkg/FspSecCore/Vtf0: NASM and Python 3 fixes
    76406ef11962 ShellPkg/UefiShellDriver1: Remove unused Status
    c14647a48331 ShellPkg/UefiShellDriver1: Flatten some functions
    1ab251c77017 ShellPkg/UefiShellDriver1/Drivers: Fix memory leaks
    becbdb4e2766 ShellPkg/UefiShellDriver1: Lower indentation level in MainCmdXXX()
    4de99ebb926a ShellPkg/UefiShellDriver1: Extract MainCmdXXX() function
    51cdb08cdb72 ShellPkg/UefiShellDriver1: Return if ShellCommandLineParse() failed
    cfcb4eee914e ShellPkg/UefiShellDriver1: Fix memory leaks
    4fae655881e3 OvmfPkg/AmdSevX64: Expose DEBUG_TO_MEM as a build option
    050b26bb5418 OvmfPkg/MicrovmX64: Expose DEBUG_TO_MEM as a build option
    07fa02d26710 OvmfPkg/OvmfPkgIa32X64: Expose DEBUG_TO_MEM as a build option
    bd8ec2128077 ShellPkg/AcpiView: Avoid mutating HEST hardware bank count during parse
    35c03c1c9f53 BaseTools: Ecc: Update to ANTLR 4.13.2
    9b676f7cc2d1 BaseTools: Ecc: Use SPDX in AutoGen Template
    229600664e26 BaseTools: Ecc: Drop ANTLR 3 Support
    e3e5c415988d OvmfPkg/IgvmSecureBootDxe: enable CustomMode only if needed
    75ea215310cd OvmfPkg/EnrollDefaultKeys: do not check VendorKeys
    0a7ed7ed3457 OvmfPkg/EnrollDefaultKeys: do not require CustomMode
    3c01a11daae2 OvmfPkg: set PcdRequireSelfSignedPk to FALSE
    3ed3b7a4aeaf OvmfPkg/BaseMemEncryptSevLib: IGVM data HOB ranges are prevalidated
    4c8717de1696 OvmfPkg: Page align sections of DXE and UEFI images
    ac2316df3ed4 OvmfPkg/LoongArchVirt: Move FirmwarePerformancePei to PEI driver region
    0fc588ddd278 OvmfPkg/LoongArchVirt: Enable FPDT for LoongArch OVMF platform
    00a8e3b20f71 OvmfPkg/LoongArchVirt: Fix the misuse issue of ExtractGuidedSectionLib
    b3fdc0994db6 CryptoPkg: Add digest-based RSA-PSS sign and verify APIs
    f1fc41cff2a2 SecurityPkg: Tcg2AcpiFfa: Polish revision checks for TPM2 table
    a270773cce47 SecurityPkg: Tcg2AcpiFfa: Fix endianness of partition ID
    c60df38f1071 SecurityPkg: Tcg2AcpiFfa: Remove Tcg2PhysicalPresenceLib from dependencies
    268266d8dcbe RedfishPkg/PlatformConfig: Delete a few debug messages
    56b1ab8ca30f NetworkPkg/HttpBootDxe: Print TLS errors on screen during HTTP boot
    b7cf7e465c40 BaseTools: Only check for GCC prefixes when targeting
    18d0c3596e93 DynamicTablesPkg: handle missing 'iommu-map' in root complex parser
    ebe7fab41ec8 ArmVirtPkg: Kvmtool: Only install IORT if ITS is present
    87e486f622c5 BaseTools: Enable 4k alignment for tool chains
    4eb86f009d93 MdePkg: Added several mock libraries for google test
    d68752de91db MdeModulePkg: Added several mock libraries for google test
    e9f03fca2859 CryptoPkg: Added MockBaseCryptLib for google test
    0a0919607ceb OvmfPkg/PlatformInitLib: redefine low memory
    d2e5c5781e27 UefiCpuPkg/MpInitLib: Skip ucode rev dump if not loaded in the library
    83060dd335dc NetworkPkg/UefiPxeBcDxe: Add missing Token.Context initialization
    233eddb8e30d BaseTools/Plugin: Add lcov error tolerance for vendored source trees
    56b98b3525c7 Maintainers.txt: Remove Chasel Chiu
    f69f043d0574 .azurepipelines: Add CLANGPDB Windows CI
    c4d29cb62187 ShellPkg/UefiHandleParsingLib: support handle list growth
    b989871c8792 NetworkPkg: Reset DHCP Service Binding IO Status on Stop
    b9c072aad65a UnitTestFrameworkPkg: Allow platform DSC to override sanitizer and coverage
    ce0bdc3118f2 ArmVirtPkg/ArmVirtQemu: Expose DEBUG_TO_MEM as a build option
    ef23e3c9e726 BaseTools: Enable control flow guard for Windows builds
    4e0376c48b17 BaseTools: Suppress C4028 warning to support older VS toolchain builds
    0049ac1793c4 MdeModulePkg: VariableSmmRuntimeDxe: Fix MM communicate v3 buffer sizing
    04b20705cef9 Maintainers.txt: Add Mike Beaton as reviewer to MdeModulePkg
    0d0cac40e09b Maintainers.txt: Add Mike Beaton as reviewer of NetworkPkg
    af1ae393d0b6 UefiCpuPkg/MpLib: Change print level for "5-Level Paging ="
    183b578ec6b4 MdePkg: Ignore FdtLib.h for ECC
    1574cd37a2ab MdePkg/BaseFdtLib: Header style update to FdtOverlayApply and FdtStrerror
    4afb3886396a MdePkg/BaseFdtLib: FdtGetName, FdtGetPath
    74a65f6b914d MdePkg/BaseFdtLib: Implement new libfdt wrappers
    defbd14d6373 Revert "MdeModulePkg/PciBusDxe: Degrade MEM64 to PMEM64..."
    260b91a352b8 MdeModulePkg/Core: Validate DXE event signature before usage
    1bd61a940994 MdeModulePkg/SpiNorFlashJedecSfdp: Limit debug output
    e7ffbde9ad82 UefiCpuPkg/ArmMmuLib: DEBUG_VERBOSE -> DEBUG_PAGING
    5dc31efc427b UefiCpuPkg/CpuDxe: DEBUG_VERBOSE -> DEBUG_PAGING
    3d6453f515cd OvmfPkg/BaseMemEncryptSevLib: DEBUG_VERBOSE -> DEBUG_PAGING
    939de47d12ee MdePkg/DebugLib: add DEBUG_PAGING
    a7908f214dd4 UefiCpuPkg, OvmfPkg: Rename .asm files to .nasm.inc in ResetVector
    97aa85de722d UnitTestFrameworkPkg: Align C++ sign compare
    7b6b0784a793 UnitTestFrameworkPkg/Test/GoogleTest/Sample: Add 0 tests
    4018823b6399 OvmfPkg/LoongArchVirt: enable qemu uefi variable store support
    644e5790cdc5 OvmfPkg/VirtMmCommunicationDxe: enable loongarch64
    e98e311062f2 OvmfPkg/LoongArchVirt: Add Secure Boot key layout scaffolding
    8d7ecf127721 OvmfPkg/LoongArchVirt: Add Secure Boot support
    ff2543960090 IntelFsp2Pkg/FspSecCore: Do not hang when bootloader IDT is larger
    819af4cd11f4 IntelFsp2Pkg/FspSecCore: Allocate correct number of IDT entries on stack
    8c50e656c088 MdeModulePkg: : revert EndofDxeEvent TPLs to TPL_NOTIFY for FPDT
    a4a7346cf450 StandaloneMmPkg Core: Check PE section finding status
    fc13220238df MdeModulePkg/PeiCore: Accept MemoryDiscoveredPpi from SecCore
    0fe6b755f246 ArmPkg,MdePkg: Add an ASM function to read register AIDR_EL1
    6ae3cc5d5e88 UefiCpuPkg: Consume Public Page Table Definitions
    530efa6742b9 MdePkg: Make X64 Page Table Definitions Public
    e1103f7dcad6 NetworkPkg: Ip4Dxe/Ip6Dxe: Set SB notify to NULL after event close
    6e39689c659d EmulatorPkg: Remove EmulatorPkg from CLANGPDB CI
    469eb8dc53bb .azurepipelines,OvmfPkg: Remove RISCV64, LOONGARCH64 from CLANGPDB CI
    2263bdf47f4d Global: Clone GCC to CLANGPDB CI
    eca4173be905 .azurepipelines,OvmfPkg: Remove LOONGARCH64 builds from CLANGDWARF CI
    81bab969df1b Global: Remove CLANGDWARF from PR gates
    1184ca8ca382 Global: Clone GCC to CLANGDWARF CI
    fae23133db5b .azurepipelines: Run non-package-build CI only in GCC and VS2022
    f7548958e12d .azurepipelines: Switch to CI image which includes clang
    11af818b3ea8 SecurityPkg: Refactor performance to use new PERF_FUNCTION_* measurements
    aa02571f362c MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK
    03e7c8c44f70 MdeModulePkg: Update performance measurements to use new perf macros
    b074eb78b4fc MdeModulePkg/PciBusDxe: Add optional CRS retry for enumeration
    ddcd0fd16705 DynamicTablesPkg/AmlLib: Fix refactor AmlCodeGenInvokeMethod API
    23c1cb8c5e9e OvmfPkg/IntelTdx: Update README.md with missing build command
    52bbcffe5481 OvmfPkg/OvmfPkgX64: Expose DEBUG_TO_MEM as a build option
    8c298e11045e BaseTools: GenFfs/GenFv/GenSec: Fixing Warning 4319 from MSVC
    0a3cb1cba064 Global: Rename default_linux_image to default_linux_container
    0583e536b1c0 Global: Move Azure Pipelines vmImage defaults to defaults.yml
    a6319874208e StandaloneMmPkg: Ensure section length alignment
    f3f585bd42a0 ArmPkg/ArmStandaloneMmCoreEntryPoint: Ensure section length alignment
    17cb2be38356 MdeModulePkg: IpmiCommandLib: Add IPMI mailbox declarations
    beff015bc78e ArmPkg: Fix incorrect bit width mask for SP_EL0
    2237cb9c51ad .azurepipelines/templates: Remove `echo new PATH` from 'Set PATH' task
    6fb6ef54e759 SecurityPkg/Tcg2Smm: harden NVS/SMI state initialization
    d372c29fabcf .azurepipelines: Fix the commented filename in two template files
    a74be599355a .azurepipelines: Make 'Set PATH' step check Agent.OS rather than toolchain
    e2b0e207f7b1 MdePkg/BaseLib: Add AsmReadFsBase and AsmWriteFsBase for X86-64
    4e90b65e7b7b OvmfPkg/PlatformInitLib: Add SoftReserved memory type support
    cb4cbc521640 DynamicTablesPkg/AmlLib: Adds API method returning method invocations
    1774a34cc518 DynamicTablesPkg/AmlLib: Refactor AmlCodeGenInvokeMethod API
    24ab1d8c51a5 MdePkg: Add AML method argument count limit definition
    f4f781831ff3 Maintainers.txt: Add RiscV folder as well
    0d13f96bd85b Maintainers.txt: Update Sunil's email ID
    3517a8363976 MdePkg/BaseRngLib: Rename Riscv folder to RiscV
    b5d168944729 OvmfPkg/RiscVVirt/PlatformPei: Do not set PcdTpmBaseAddress to garbage
    4d38389e0f7c UefiCpuPkg/CpuMpPei: Support AMD GetProcessorCoreType
    ff3693d345d9 UefiCpuPkg: Include AMD Cpuid.h
    2c8ab5c4cfd1 MdePkg: Add AMD CPUID Extended Topology definition
    309464ec9a8b OvmfPkg/Microvm: use MemDebugLogPeiCoreLib for PEIMs
    8746e729f0f6 OvmfPkg/AmdSev: use MemDebugLogPeiCoreLib for PEIMs
    cdee51da8e4c OvmfPkg: remove MemDebugLogPei from APRIORI
    f09d5e6f51a4 ArmPkg/ArmLib: Remove unused ArmLibPrivate.h
    b980aa07196a SecurityPkg: AuthVariableLib: Handle empty signature lists
    d6f41c4ff25b CryptoPkg: BaseCryptLib: Reject empty X.509 cert when retrieving public key
    e60688f7643d MdePkg/ArmLib: Remove unused AArch32-only declarations
    2a7edc37c3cc MdePkg: Remove branch prediction control APIs
    33f7389070de ArmPkg: Remove branch prediction control APIs
    42f579af316f Maintainers.txt: Update the email address
    11868992cc29 IntelFsp2Pkg: Save/restore FSBASE/GSBASE in entry and exit
    6a81b1781ef3 Maintainers.txt: Add Ray Ni as one of IntelFsp2Pkg maintainers
    2691afa26994 UnitTestFrameworkPkg: Increment handle key outside if block
    8f28978843f1 MdeModulePkg/Core: Increment handle key outside if block
    1f5c9f2a5cb1 MdeModulePkg: Add library class SafeIntLib where ArmFfaCommon.c is used
    5607d934b18c OvmfPkg/XenPvBlkDxe: Advertise the correct IO alignment
    4057d2959c3e BaseTools/WindowsVsToolChain.py: Minor code style updates
    6479778e6b38 MdePkg,MdeModulePkg: Add FFA_YIELD command
    582ab2ec6592 UefiCpuPkg: Converge SEC/PEI and SMM/DXE Exception Handler ASM
    3bfe4fadffbf OvmfPkg: SEC/SMM: Use 256 IDT Descriptors
    4512733ac8b3 MdeModulePkg: DxeIpl IA32: Use 256 IDT Entries
    3454d7ab417b UefiCpuPkg: Set up 256 IDT Descs in SEC/PEI/SMM
    3ed9aceeb8e6 MdeModulePkg: CpuExceptionHandlerLib: Define X86_CPU_INTERRUPT_NUM
    3657a4fc9f80 ShellPkg/SmbiosView: Fix clang compatibility issue
    e22f4a61c9e6 BaseTools/Source/Python/Trim: Add -f/--source-code-format option
    2bfde627ff85 ShellPkg/SmbiosView: Support print Protocol Records of SMBIOS type42
    1fe2504afb6e StandaloneMmPkg: StandaloneMmIplPei: Guard S3 hob with PcdAcpiS3Enable
    90cb1661bdc2 .markdownlint: Add ignore and settings
    f1e6f26e923b EmbeddedPkg: fix mdlint issues
    fda4926b08da UnitTestFrameworkPkg: fix mdlint issues
    77d25a6b84d8 MdePkg: fix mdlint issues
    7e5cc68f1e5b MdeModulePkg: fix mdlint issues
    75cce8c66ff3 BaseTools: fix mdlint issues
    a39c3835aaea MdeModulePkg: Add FFA_NS_RES_INFO_GET to ArmFfaCommon
    a55b79426912 MdePkg: Add FFA_NS_RES_INFO_GET to Arm header
    035d8c7d182c EmulatorPkg: Add /NODEFAULTLIB:LIBCMT to remove warning
    27528b48dbc0 ShellPkg: fix UNI string formatting and line endings to match UNI Spec
    b56710fe9cd4 EmbeddedPkg: align Inf file headers with INF Spec standard
    47204fbe6ae2 PrmPkg: align UNI file headers with UNI Spec standard
    6bbf3cbfe6aa OvmfPkg: align UNI file headers with UNI Spec standard
    ad44b8d5524e ShellPkg: align UNI file headers with UNI Spec standard
    201a4fe3ec50 SecurityPkg: align UNI file headers with UNI Spec standard
    7347c32f6513 NetworkPkg: align UNI file headers with UNI Spec standard
    70bddc908fc2 EmbeddedPkg: align UNI file headers with UNI Spec standard
    83296834f0c5 ArmPkg: align UNI file headers with UNI Spec standard
    0316ce68bac6 Maintainers.txt: Add myself as reviewer to MdeModulePkg
    37db80097dbe StandaloneMmPkg Core: Treat no DEPEX as TRUE
    d85a9c6e23c6 SecurityPkg: Make TPM2_Startup() return an error
    673842aefc75 SecurityPkg: Check for Tpm2GetCapabilitySupportedAndActivePcrs()
    e412a892b3c6 SecurityPkg: Add Debug Message to show the TPM2 PCR bank info
    c422b3b97b69 UefiCpuPkg/MpInitLibUp: Fix #UD exception due to NULL pointer deref
    58c9ba24d4b7 MdeModulePkg/TerminalDxe: Fix Backspace key for VT-UTF8 terminal type
    5b9430b72b8e MdeModulePkg: DxeMain: Check memory type overlap inside CoreGetMemoryMap
    02d536367913 MdeModulePkg HobPrintLib: Also print EFI_HOB_TYPE_UNUSED type HOB
    41b32312c47e MdeModulePkg: Fix PreferMode selection for same-width text modes
    801abc03cd9e BaseTools/Eot: Apply CParser4 ANTLR 4.9 regeneration whitespace changes
    0cdbc9254490 BaseTools/Eot: Regenerate CParser4 files with ANTLR 4.9
    ba8010bc6c04 BaseTools/Ecc: Apply CParser4 ANTLR 4.9 regeneration whitespace changes
    ae240285120b BaseTools/Ecc: Regenerate CParser4 files with ANTLR 4.9
    a1abc3032cd2 OvmfPkg/RiscVVirt: Make SecureBootDefaultKeysInit driver configurable
    89829638a9b1 OvmfPkg: Disable lockbox functionality for StandaloneMm
    935518abbb8e MdeModulePkg/Include/Guid: Add back include guard
    21e021ffbaa7 MdePkg/Include/Uefi: Add back include guard
    3eb2ff24b9fe BaseTools/Source/C/Include/Common: Add back include guard
    3f542ff5726c ArmPkg: ArmStandaloneMmCoreEntryPoint add missing guid
    05cec0b14bef StandaloneMmPkg/Core: Move MMI depth tracker below MMI check
    bd8667a7fd9f MdeModulePkg/Core: Move SMI depth tracker below SMI presence check
    e9119475e1fd UefiCpuPkg CpuPageTableLib.h: Correct PageTableParse() Map para to OUT
    218deb33ebf7 UefiCpuPkg: Rename the LoongArch floating point CSR register 0 name
    14bdb0e3d4c7 MdePkg: Rename the LoongArch floating point CSR register 0 name
    9fc0aca51e83 BaseTools/Source/C/VfrCompile: Fix parallel make failures
    4d0946c082df MdeModulePkg/PeiDxeDebugLibReportStatusCode: Fix comma parsing
    a7c119589fe2 MdeModulePkg/PeiDebugLibDebugPpi: Fix comma parsing in VaListToBaseList
    67bc9959ae0a BaseTools: Remove no longer needed warning suppression
    9d583d770b1a StandaloneMmPkg/Core: Print discovered drivers that weren't dispatched
    6ac200557612 StandaloneMmPkg/Core: Improve the readability of debug statement
    6900f80295e4 IntelFsp2Pkg: Remove GCC48/49/5 build options from QemuFspPkg.dsc
    5c8403f767ee UnitTestFrameworkPkg: Remove references to GCC5 in ReadMe and dsc comments
    4b4653e2754a PrmPkg: Remove GCC5 from Readme.md
    dd69f7302a6f EmulatorPkg: Remove references to GCC5 in scripts and tools
    f11bcd33908d DynamicTablesPkg: Remove GCC5 from Readme.md
    645344ec90aa CryptoPkg/Library/OpensslLib: Remove GCC5 build options
    be0af96b5b1a ArmVirtPkg: Remove GCC5 from ReadMe.md
    10e6fb31a335 OvmfPkg: Remove redundant assignment not required after GCC48/49 removal
    cfb7c293dc2b OvmfPkg: Remove references to GCC5 in scripts and tools
    2afee514d74e BaseTools: Remove GCC5 support from LinuxGccToolChain.py
    bdadb269e379 BaseTools: Remove previously deprecated GCC48, GCC49 and GCC5
    575683811d9d BaseTools: Remove period in v3.00 comment to standardize punctuation
    7746ec4ddeaa ShellPkg/SmbiosView: Add Type45 entry to query table
    b65f97625aaa MdePkg: Add PCIe capability structures for DPC and DLF
    2e92a908e759 MdeModulePkg: Mark PcdMrIovSupport obsolete - deprecated in PCIe 6.0
    f078b8445a11 UefiPayloadPkg: Remove PcdMrIovSupport - deprecated in PCIe 6.0
    bb943da707e1 UefiPayloadPkg: Add platform limit for size in Resizable BAR
    24eddc65b345 MdeModulePkg: Add platform limit for size in Resizable BAR
    88b361427271 .gitattributes: Prevent line ending conversion
    08cecc924605 MdePkg/IndustryStandard: Fix incorrect macro definition
    f17ce026f67c MdePkg/IndustryStandard: Fix typos in macro and struct
    15e883335594 ArmPkg/ArmPkg.dec: introduce gEdkiiTpmEventLogDescHobGuid
    9dcdc297213c TcgTpmPkg: add TcgTpmPkg maintainer
    e2e8dbe01860 TcgTpmPkg: add Readme.md file
    2ebc3ba33e90 TcgTpmPkg/Library/TpmLib: add license notification for TPM reference lib
    db1e6caa860a TcgTpmPkg,.pytool,.azurepipelines: introduce TpmLib
    507c956316e6 TcgTpmPkg: add TCG TPM 2.0 Reference Implementation Library
    abf4467708ab TcgTpmPkg: openssl layer for TCG TPM v2.0 implementation
    641a32bd4ae0 TcgTpmPkg/Private: copy standard headers from CryptoPkg
    e9935da03b69 TcgTpmPkg/TpmLib: add build option files for TPM reference library
    bfa8e9b8cb77 TcgTpmPkg/Library: introduce PlatformTpmLib
    31d7cb91c161 CryptoPkg: add EC algorithm for SmmCryptLib
    d0bc8c541b45 CryptoPkg: add/modify EC interfaces for TPM TCG library
    4cc6026cb45a CryptoPkg: add some Bn interfaces to build TCG TPM library
    ab021465cbd6 CryptoPkg: add CAMELLIA APIs for TCG TPM reference library
    11d93e980c8b CryptoPkg: add AES_encrypt/AES_decrpyt for TPM reference library
    b3e693dbeb90 CryptoPkg: preparation to build TPM reference library
    409aef9c7a4c CryptoPkg/OpensslLib: add NULL EC interfaces for TPM TCG library
    37f59e190c29 CryptoPkg/OpensslLib: add NULL CAMELLIA interfaces for TPM TCG library
    c8ee38acbaae CryptoPkg/OpensslLib: add cmellia and cmac algorithm in OpensslFullLib
    8b83386cb2a4 DynamicTablesPkg/AmlLib: Fix Notify to use NamePath instead of String
    c8062ec623d9 IntelFsp2Pkg/PatchFv: Fix _IMAGE_BASE_<module>_ not exist with CLANG
    3c61d7e081e2 UefiCpuPkg/BaseRiscV64CpuTimerLib: Fix incorrect performance counter range
    c27b555439a8 UefiCpuPkg/BaseRiscV64CpuTimerLib: Add constructor to initialize mTimeBase
    e2951626adcb Revert "UefiCpuPkg/BaseRiscV64CpuTimerLib: Add constructor to initialize.."
    cfe4be367f2a StandaloneMmPkg/MmCommunicationDxe: Enforce CommSize validation
    59f58197ddec UnitTestFrameworkPkg: Replace include guards with #pragma once
    f3c45d2f0cb6 UefiPayloadPkg: Replace include guards with #pragma once
    2ff7f990d162 UefiCpuPkg: Replace include guards with #pragma once
    ebcc6affe5ec StandaloneMmPkg: Replace include guards with #pragma once
    5f2142819ff3 SourceLevelDebugPkg: Replace include guards with #pragma once
    8b7617151eae SignedCapsulePkg: Replace include guards with #pragma once
    8472271daeed ShellPkg: Replace include guards with #pragma once
    9326c0eb0a9b SecurityPkg: Replace include guards with #pragma once
    6181c85fa98f RedfishPkg: Replace include guards with #pragma once
    963162cab093 PrmPkg: Replace include guards with #pragma once
    73be8b8b4964 PcAtChipsetPkg: Replace include guards with #pragma once
    a536e5d6991e OvmfPkg: Replace include guards with #pragma once
    58de02af29a7 NetworkPkg: Replace include guards with #pragma once
    7835e5802a2a MdePkg: Replace include guards with #pragma once
    7a934d0befca MdeModulePkg: Replace include guards with #pragma once
    648ea00a192c IntelFsp2WrapperPkg: Replace include guards with #pragma once
    86047d474231 IntelFsp2Pkg: Replace include guards with #pragma once
    58ace50a4309 FmpDevicePkg: Replace include guards with #pragma once
    f2b15ce3f5e2 FatPkg: Replace include guards with #pragma once
    e67974130582 EmulatorPkg: Replace include guards with #pragma once
    de527ff60653 EmbeddedPkg: Replace include guards with #pragma once
    01f75b3927b8 DynamicTablesPkg: Replace include guards with #pragma once
    0f42cae11c06 CryptoPkg: Replace include guards with #pragma once
    0e6d10de1c9a BaseTools: Replace include guards with #pragma once
    4ab0b67f92ac ArmVirtPkg: Replace include guards with #pragma once
    c61d1c275368 ArmPlatformPkg: Replace include guards with #pragma once
    a0f4ffffff94 ArmPkg: Replace include guards with #pragma once
    5ce48c03cbb4 BaseTools/Ecc: Remove #ifndef include guard checks
    3f81a4902a98 BaseTools/VfrCompile: Add #pragma once support
    b963cb624467 EmulatorPkg: Remove IA32 PR Gate CI Runs
    11dafad5eda2 EmulatorPkg: Add NO_PLATFORM_BOOT_DELAYS for faster boot
    81b1ec18a592 OvmfPkg/CcExitLib: Initialize XCr0 in else-path to fix build error
  - Remove the following patches because they has been merged upstream.
  - ovmf-OvmfPkg-RiscVVirt-PlatformPei-Do-not-set-PcdTpmBaseA.patch
    b5d168944729 OvmfPkg/RiscVVirt/PlatformPei: Do not set PcdTpmBaseAddress to garbage
  - ovmf-ArmPkg-CpuDxe-Drop-GCD-system-memory-check-from-Memo.patch
    99d8c3710a0f ArmPkg/CpuDxe: Drop GCD system memory check from MemoryAttribute protocol
  - ovmf-ArmPkg-CpuDxe-Refuse-to-clear-XN-from-device-memory-.patch
    c00c1216ce7f ArmPkg/CpuDxe: Refuse to clear XN from device memory mappings
  - ovmf-OvmfPkg-RiscVVirt-Make-SecureBootDefaultKeysInit-dri.patch
    a1abc3032cd2 OvmfPkg/RiscVVirt: Make SecureBootDefaultKeysInit driver configurable
  - ovmf-Revert-UefiCpuPkg-BaseRiscV64CpuTimerLib-Add-constru.patch
    e2951626adcb Revert "UefiCpuPkg/BaseRiscV64CpuTimerLib: Add constructor to initialize.."
  - Added a new ovmf-Revert-UefiCpuPkg-BaseRiscV64CpuTimerLib-Add-constru.patch (bsc#1267604)
    because it causes riscv64 VM boot failure.
  - This reverts c27b555439a8 UefiCpuPkg/BaseRiscV64CpuTimerLib: Add constructor to initialize mTimeBase
  - Remove the following patches because the issue has been fixed in
    b8df7d9c8e1e ArmVirtPkg/ArmPlatformLibQemu: Support early ID map on LPA2 capable CPUs. (bsc#1258870)
  - ovmf-Revert-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LP.patch
  - ovmf-Revert-ArmPkg-UefiCpuPkg-fix-boot-failure-with-LPA2.patch
  - ovmf-Revert-UefiCpuPkg-ArmMmuLib-Add-support-for-LPA2.patch
  - Remove ovmf-disable-ia32-firmware-piepic.patch because upstream dropped GCC48.
    bdadb269e379 BaseTools: Remove previously deprecated GCC48, GCC49 and GCC5
  - Update ovmf-OvmfPkg-ArmVirtPkg-Keep-JSON-stack-cookie-files.patch
    because GCC5 prefix has been deprecated.
    bdadb269e379 BaseTools: Remove previously deprecated GCC48, GCC49 and GCC5
  - Update ovmf-Revert-Add-Stack-Cookie-Support-to-MSVC-and-GCC.patch
    because GCC_ALL_CC_FLAGS was redefined to GCC_ALL_CC_COMMON and GCC_AARCH64_CC_FLAGS
    was redefined to GCC_AARCH64_CC_COMMON
    GCC48_IA32_CC_FLAGS and GCC48_X64_CC_FLAGS have been dropped.
    bdadb269e379 BaseTools: Remove previously deprecated GCC48, GCC49 and GCC5
  - Update ovmf-BaseTools-Using-gcc12-for-building-image.patch
    because GCC5 prefix has been dropped.
    bdadb269e379 BaseTools: Remove previously deprecated GCC48, GCC49 and GCC5
  - Replace GCC5 with GCC in spec file because GCC5 prefix has been deprecated.
    bdadb269e379 BaseTools: Remove previously deprecated GCC48, GCC49 and GCC5

++++ pacemaker:

  - Update to version 3.0.2+20260601.c75e25851c (Pacemaker-3.0.2):
  - Low: libcrmcommon, tools: Fix NULL dereference in crm_resource.c

++++ par:

  - Spec cleanup:
    * Add explicit gcc and make BuildRequires
    * Use %make_build
    * Drop obsolete Group tag and use the https project URL

++++ perl-CPAN-Perl-Releases:

  - updated to 5.202.606.10 (5.20260601)
    see /usr/share/doc/packages/perl-CPAN-Perl-Releases/Changes

++++ perl-Locale-Codes:

  - updated to 3.900.0 (3.90)
    see /usr/share/doc/packages/perl-Locale-Codes/Changes
    3.90  2026-06-01  sbeck
  - Version 3.89 was created with a flaw and has been deleted.
  - NEW CODE(s)

++++ php-composer2:

  - version update to 2.10.0
    * BC Break / Security: Disabled automatic fallback to source checkout if dist/zip
    install fails, we have introduced a new source-fallback config option as a temporary
    way to restore the old behavior, but if you need this talk to us as we plan to remove
    it entirely in 2.11 (#12885)
    * BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or
    1 if anything failed the audit (#12881)
    * Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
    * Security: Fixed handling of uppercase schemes in URL validation that might have allowed
    https requirement bypass (#12884)
    * Fixed audit command returning a success code when the vendor dir was not present (#12880)
  - modified sources
    * composer.phar

++++ polkit-default-privs:

  - Update to version 1550+20260602.64ede59:
    * profiles: fwupd new actions in 2.1.4 (bsc#1267014)

++++ postgresql15-timescaledb:

  - Update to 2.27.2
  - #9895 Remove refresh policy check when adding columnstore
    policy
  - #9902 Fix wrong results and crashes when grouping by columns
    that are not in the SELECT list with vectorized aggregation or
    columnar index scan
  - #9908 Skip ColumnarIndexScan when the qual contains a SubPlan

++++ postgresql16-timescaledb:

  - Update to 2.27.2
  - #9895 Remove refresh policy check when adding columnstore
    policy
  - #9902 Fix wrong results and crashes when grouping by columns
    that are not in the SELECT list with vectorized aggregation or
    columnar index scan
  - #9908 Skip ColumnarIndexScan when the qual contains a SubPlan

++++ postgresql17-timescaledb:

  - Update to 2.27.2
  - #9895 Remove refresh policy check when adding columnstore
    policy
  - #9902 Fix wrong results and crashes when grouping by columns
    that are not in the SELECT list with vectorized aggregation or
    columnar index scan
  - #9908 Skip ColumnarIndexScan when the qual contains a SubPlan

++++ postgresql18-timescaledb:

  - Update to 2.27.2
  - #9895 Remove refresh policy check when adding columnstore
    policy
  - #9902 Fix wrong results and crashes when grouping by columns
    that are not in the SELECT list with vectorized aggregation or
    columnar index scan
  - #9908 Skip ColumnarIndexScan when the qual contains a SubPlan

++++ prometheus-blackbox_exporter:

  - CVE-2026-39821: Bump golang.org/x/net to version 0.55.0
    (bsc#1266556)
  - Drop 0001-Bump-x-net.patch
  - Drop support for SLE 12 (jsc#PED-15474)
  - Remove remaining RHEL conditionals

++++ python-freezerclient:

  - update to 6.3.0:
    * Re-enable tempest jobs
    * Stop logging create/update requests to stdout
    * Implement jobs retrieval for all projects
    * Temporary disable tempest jobs
    * Update master for stable/2026.1
    * tox: Remove ineffective ignore_basepython_conflict and bump
    minimum version

++++ python-castellan:

  - update to 5.7.0:
    * Deprecate __version__ attribute
    * objects: Sync method signatures
    * typing: Enable strict typing
    * typing: Add hints to castellan.*
    * typing: Add hints to castellan.key_manager
    * typing: Add hints to castellan.common.*
    * typing: Add hints to castellan.common.objects
    * typing: Add hints to castellan.common.credentials
    * Add ruff
    * tox: Use new constraints option
    * tests: Fix keyword passed to RequestContext
    * tests: Minor typing-related fixes
    * objects: Move common __init__ to base class
    * trivial: Remove reference to removed module
    * trivial: Synchronize function signatures
    * tests: Remove errant trailing commas
    * Update master for stable/2026.1

++++ python-hatchling:

  - update to version 1.30.1:
    * Fixed: Default core metadata version kept at 2.4 until more
    tools support 2.5
  - additional changes from version 1.30.0:
    * Added: Support PEP 794 (core metadata Import-Name and
    Import-Namespace fields and version 2.5)
    * Fixed: Exclude Git worktree metadata files from sdists

++++ python-PyQt6:

  - Force -std=gnu++17 to fix the broken build with GCC 16

++++ python-PyQt6-qt6pdf:

  - Force -std=gnu++17 to fix the broken build with GCC 16

++++ python-dataclasses-json:

  - Add support-marshmallow-4.patch (boo#1266046)
    * Fix tests with marshmallow 4 changes.

++++ python-django-q2:

  - Initial release of 1.10.0.
  - Add patch str-more-things.patch:
    * Use str() on more things in qmonitor.

++++ python-fakeredis:

  - Update to 2.36.0
    * Implement keyspace notifications @alexbthundiyil-spec
    * feat(lua): add server global alias for Valkey @przemub
    * feat(streams): implement XACKDEL, XDELEX, XIDMPRECORD, XNACK commands
    * feat: add VISMEMBER command to check element existence in vector set
    * feat: implement array commands (ARSET, ARGET, ARLEN, ARGETRANGE,
    ARINSERT, ARDEL, etc.) for Redis 8.8
    * fix: XREADGROUP with non-'>' ID returns consumer PEL @tomtom103
    * fix: similarity calculation in vector set VSIM command
    * fix: CF.RESERVE and CF.SCANDUMP should not create keys if they do not exist
    * fix: various issues in vector set commands VSET
    * fix(tcp_server): clean up handler threads on shutdown
    * Improved CLIENT INFO and CLIENT GETNAME commands
    * Better TDigest implementation
    * Update Redis 8 image used in CI to 8.8
    * Update to redis-py 8.0.0
    * perf(hash): make HSET O(1) by using len(h) instead of len(h.keys())
    @invoker-bot
    * refactor: introduce CommandsMixinBase to centralise shared mixin attributes
    * refactor: VectorSet improvements
    * refactor: async Redis tests to use AsyncClientType for improved type safety

++++ python-semver:

  - node-semver 0.9.0 doesn’t clobber `semver` namespace any more.

++++ python-uvicorn:

  - Update to 0.41.0:
  - Added
    * Add --limit-max-requests-jitter to stagger worker restarts (#2707)
    * Add socket path to scope["server"] (#2561)
  - Changed
    * Rename LifespanOn.error_occured to error_occurred (#2776)
  - Fixed
    * Ignore permission denied errors in watchfiles reloader (#2817)
    * Ensure lifespan shutdown runs when should_exit is set during startup (#2812)
    * Reduce the log level of 'request limit exceeded' messages (#2788)

++++ wafw00f:

  - Update to version 2.4.2:
    * Removes setup.py to fix tool installations when building locally.
    * Updated the latest supported versions of Python (≥3.10)
    * New WAF signature updates:
  - Vercel WAF
  - Reflected Networks WAF
    * Improvements to existing signatures:
  - Tencent WAF
  - Update to version 2.4.1:
    * Fix timeout enforcement during response body reading to properly
    handle slow streaming servers.
    * Timeout enforcement: The --timeout parameter is now properly
    enforced during response body reading, not just during connection
    establishment. This fixes the issue where slow-streaming servers
    could cause scans to take over 2 minutes instead of respecting
    the user-specified timeout.
    * Track elapsed time during chunk reading loop
    * Break out of reading loop if timeout is exceeded during reading
    * Add test documenting timeout enforcement behavior
  - Update to version 2.4.0:
    * New WAF detections
  - Anubis (Techaro)
  - Scutum (Secure Sky Technology)
  - 360PanYun (360 Technologies)
  - ThreatX (A10 Networks)
  - Link11 WAAP
    * Improvements
  - Fastly detection improvements (tighter regex for X-Served-By)
  - Added pytest test framework with 45 tests
  - Added pyproject.toml for modern Python packaging
  - Removed pluginbase dependency (use stdlib importlib)
    * Fixes
  - Fixed infinite hang on streaming responses (#246)
  - Improved -t option help text (#243)
    * Other
  - Updated copyright years to 2026
  - Updated Python requirement to 3.8+
  - Add fix-request-path.patch based on commit af3eca1:
    Noticed that path attacks like LFI were being ignored. Changed
    the way requests were done to ensure that the path is not normalized
    by creating a prepared request and overwrite the url.
  - Use source from github to get complete tests
  - Switch to wheel/pip build
  - Add %check/%pytest
  - Clean up spec file

++++ qsynth:

  - Update to version 1.0.6
    * Bumping into next development cycle (Qt >= 6.11).

++++ reimage:

  - Update to version 0.14.0 (no releases between 0.12.1 and this):
    * Features
  - 338b525 feat(vulcheck): report unused CVE ignores
  - 39fd986 feat(vulncheck): allow generating a report
  - 8aaa808 feat(vulncheck): log the cves in alphabetical order
  - ffe3818 feat(vulncheck): refactor output, allow setting Max
    Risk
    * Bug fixes
  - a915224 fix(lint): clear up lint warnings
  - 7d395bb fix(logging): fix extra log line for non-write of
    mappings
    * Chores
  - f385541 chore(deps): bump
    github.com/aws/aws-sdk-go-v2/service/s3
  - 57d7f96 chore(deps): bump github.com/go-git/go-git/v5 from
    5.16.5 to 5.18.0
  - 7b857bb chore(deps): bump github.com/go-git/go-git/v5 from
    5.18.0 to 5.19.1
  - 0f726d6 chore(deps): bump github.com/go-jose/go-jose/v4 from
    4.1.3 to 4.1.4
  - 6e34d40 chore(deps): bump
    github.com/sigstore/timestamp-authority/v2
  - 867ddbb chore(deps): update actionlint
  - c0be030 chore(deps): update current deps
  - 0f8055f chore(deps): update deps
  - ed7840f chore(deps): update goreleaser
  - 7f2a992 chore(deps): update to AsaiYusuke/jsonpath v2
  - 6b793f9 chore(doc): update some of hte docs for the new vuln
    check options
    * Others
  - 4a787c1 Update zizmorcore/zizmor-action action to v0.5.3
  - 6357855 Update zizmorcore/zizmor-action action to v0.5.6
  - cac09fd revert the dependabot/renovate breakages

++++ rke2-1.33:

  - Update to version 1.33.12+rke2r2:
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.33.12+rke2r2

++++ rke2-1.34:

  - Update to version 1.34.8+rke2r2:
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.34.8+rke2r2

++++ rke2-1.35:

  - Update to version 1.35.5+rke2r2:
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.35.5+rke2r2

++++ rke2:

  - Update to version 1.36.1+rke2r2:
    * Details see
    https://github.com/rancher/rke2/releases/tag/v1.36.1+rke2r2

++++ scap-security-guide:

  - Add Hummingbird product support
  - updated to 0.1.81 (jsc#ECO-3319)
  - Create SLE16 ANSSI profiles
  - Update SLE15 STIG version to V2R7
  - Update SLE12 STIG version to V3R5
  - Update SLEM5 STIG version to V1R3
  - Add Claude Code skills for content development workflows
  - Create Claude Skill for creating new products
  - Various updates for SLE 12/15

++++ sshfs:

  - Update to 3.7.6:
  - Added new maintainer: abhinavagarwal07 Abhinav Agarwal
  - CVE-2026-47187: Fixed critical vulnerability - Symlink
    Escape: Rogue SFTP Server to Local File Read/Write), credit
    to abhinavagarwal07 (bsc#1267017)
  - New -o contain_symlinks and -o no_contain_symlinks to control
    symlink containment behavior
  - CVE-2026-48711: Fixed high severity vulnerability - Improper
    Neutralization of Argument Delimiters in a Command ('Argument
    Injection'), credit to abhinavagarwal07 (bsc#1267016)
  - Fixed null-deref warning in tokenize_on_space, promote
    strict-warnings to required
  - Added a number of tests in CI, including rename, chmod,
    fsync, statvfs values, error paths, option coverage
  - Fixed malformed SFTP reply handling

++++ stress-ng:

  - Update to 0.21.02:
    * New stressors
    * eth-sniff - simple ethernet packet sniffer stressor
    * Notable Bug fixes
    * stress-rofs: fix Cygwin SIGSEGV issue
    * stress-str: fix index underflow on strncmp
    * stress-ng: fix ionice-level upper limit to 7
    * New options
    * --hdd-sleep - specify number of seconds between read/write cycles
    * --numacopy-affinity - set CPU affinity relative to NUMA nodes
    * --pipe-readers - specify number of pipe reader processes for pipe stressor
    * --pipe-writers - specify number of pipe writer processes for pipe stressor

++++ syncthing:

  - Update to 2.1.1
    * Fixes
    fix(syncthing): properly upgrade via REST when Syncthing is running (fixes #10697) by @calmh in https://github.com/syncthing/syncthing/pull/10699
    fix(versioner): ensure user read/write/execute on archived dirs (fixes #10532) by @calmh in https://github.com/syncthing/syncthing/pull/10696
    fix(discover): only announce wildcard for TCP punching when listening on wildcard address (fixes #10503) by @calmh in https://github.com/syncthing/syncthing/pull/10691
    fix(stcrashreceiver): close source loader responses on errors by @mattn in https://github.com/syncthing/syncthing/pull/10704
    fix(protocol): handle zero-size requests (fixes #10709) by @calmh in https://github.com/syncthing/syncthing/pull/10710
    * Other
    build: be explicit about workflow permissions by @calmh in https://github.com/syncthing/syncthing/pull/10690
    chore(syncthing): include runtime context in GC crashes by @calmh in https://github.com/syncthing/syncthing/pull/10702
    build(deps): x/net for govulncheck by @calmh in https://github.com/syncthing/syncthing/pull/10703
    chore: use path/filepath for local file system paths by @mattn in https://github.com/syncthing/syncthing/pull/10705

++++ transmission:

  - Update to 4.1.2:
    + Highlights: Fixed `4.1.0` bug that could cause duplicate HTTP
    announces to be sent to trackers.
    + All Platforms:
  - Reject benc data that has invalid characters.
  - Fixed a bug during the startup sequence where if one torrent
    failed to parse, subsequent torrents would also fail.
  - Fixed a bug that stalled some downloads at 99%.
  - Fixed a `4.1.0` upgrade bug that could overwrite
    `utp_enabled` and `tcp_enabled` settings.
  - Fixed a `4.1.0` crash that could happen when a peer supplied
    `reqq` value smaller than 32 in LTEP handshake.
  - Fixed a `4.1.0` regression that periodically wrote upload &
    download stats to disk even when Transmission had been idle
    since the last write, preventing the stats file's disk from
    hibernating while idle.
  - Fixed a `4.1.0` bug that prevented TCP peer connections on
    some systems.
  - Added safeguards to HTTP responses to prevent clickjacking.
  - Fixed edge case that didn't preserve the order of a batch of
    torrents when moving their queue position up or down.
  - Added sanitization for UTF-8 client names provided by peers
    during handshake.
  - Stopped appending redundant zeros to blocklist files when
    downloaded from a remote URL.
  - Fixed a build failure that occurred when building with
    link-time optimization.
    + Qt Client:
  - Fixed a `4.1.0` crash when parsing some RPC responses from
    older Transmission servers.
  - Fixed a `4.1.0` bug that saved both deprecated and current
    settings names to `settings.json`.
    + GTK Client:
  - Fixed a `4.1.0` bug that did not show translated logging
    level strings.
  - Fixed a `4.1.0` crash when toggling alternative speed limits.
    + Web Client:
  - Fixed a `4.1.0` bug that displayed timestamps in some
    dropdowns as `6.75:45` instead of `6:45`.
  - Fixed a bug that could show incorrect torrent status when
    reconnecting to the server after a lost connection.
    + transmission-remote: Improved `transmission-remote` console
    output for JSON-RPC 2.
  - Add ExcludeArch: ix86, stop building for 32bit.

++++ tail-tray:

  - Update to version 0.2.33:
    * Bump version to 0.2.33 for new release
    * Replace QSharedMemory which is attachable after termination
    with QLockFile (#117)
    * Fix DATAROOTDIR #116
    * [CI] - Adjust QT version
    * [CI] - Bump windows and VS to latest + latest QT LTS patch
    release
    * [Docs] - Fix missing dep for Ubuntu build from source

++++ teleport:

  - update to 17.7.24:
    * Fixed an issue where generated installer scripts could
    incorrectly escape special characters in some values. #67192
    * Fixed a bug in Teleport Connect where the last terminal input
    could be logged to renderer.log if the terminal closed on its
    own — for example, when a tsh ssh session is dropped by the
    remote side (idle timeout, network disconnection) after the
    user pasted content but before they pressed Enter. #67173
    * Fixes an issue preventing joins using the azure join method in
    regions where the trust chain has been updated with an
    additional intermediate. #67140
    * Fix device trust for remote users connecting to a trusted
    cluster. #67032
    * Fixed a TLS certificate error that prevented users from
    connecting to Amazon Keyspaces databases through Teleport.
    [#66975]
    * Fixed an issue where Windows desktop LDAP discovery could
    conflict with dynamic registration causing desktops to be
    removed from the cluster. #66802
    * Improved the error message on login in tsh and Teleport Connect
    when /webapi/ping returns a non-200 response. #66713
    * Raise the app access upstream response-header cap from 5
    minutes to 1 hour so long-running HTTP requests complete.
    [#66686]
    * Updated Go to 1.25.10. #66570
    * Improved the performance of VNet on macOS by eliminating
    unnecessary reconnects. #66561
    * Reduced unnecessary S3 uploads for Athena audit log deployments
    that publish directly to SQS by applying the correct SQS
    message size limit when the client has sqs:GetQueueAttributes
    permission, instead of always using the 256 KB SNS limit.
    [#66533]
    * Improved Teleport Connect startup reliability on Windows.
    [#66510]
    * Hardened event handler so it recovers in case of malformed
    session ID or corrupted data directory. #66472
    * Fixed app access dropping URL fragments through the auth
    redirect flow. #66461
    * Fixed an issue preventing host sudoers entries from being
    written on newer Linux distributions (i.e. Ubuntu 25.10) using
    sudo-rs. #66434
    * Fixed an issue that could cause LDAP discovery to fail when a
    single desktop service discovers large numbers of hosts. #66400
    * Fixed a rare input swallowing bug when resuming a moderated
    Node session. #66369
    * Fixed possible unavailability of Proxy service instances as a
    result of some API errors. #66313

++++ terragrunt:

  - Update to version 1.0.7:
    * New Features
  - tfr:// source URLs accept an optional version
    The version query parameter on tfr:// source URLs is now
    optional. When omitted, Terragrunt queries the registry's
    list-versions endpoint and downloads the latest stable
    version, matching how OpenTofu and Terraform resolve a module
    reference that has no version constraint.
    terraform {
    source = "tfr:///terraform-aws-modules/vpc/aws"
    }
    Prereleases are excluded from resolution, so a registry that
    only publishes 4.0.0-rc1 alongside 3.3.0 will pin to 3.3.0.
    Pin a version explicitly with ?version= when you need
    reproducible builds or want to opt into a prerelease.
    * Bug Fixes
  - update_source_with_cas: preserve //subdir on a unit's
    terraform.source
    When a unit's terraform.source used the // subdir convention
    (for example, source = "../..//modules/foo") and opted into
    update_source_with_cas, the rewritten source dropped the
    //subdir tail and the synthetic tree contained only the leaf
    module's files. A module that referenced a sibling via a
    relative path (source = "../bar") could not resolve that
    reference after materialization.
    Rewrites now preserve the original //subdir (for example,
    cas::sha1:<hash>//modules/foo), and the synthetic tree is
    rooted at the path before //, so sibling files reachable via
    relative paths land in the materialized working directory.
    Sources without // are unchanged: the tree stays scoped to
    the leaf module, and the rewritten reference has no //subdir
    tail.
  - --filter now detects affected units on Windows
    On Windows, terragrunt find --filter '[origin/main...HEAD]'
    (and its variants) returned no affected units even when git
    diff reported changed files. The source= and reading= filters
    were affected by the same problem.
    Filter glob patterns are always written with forward slashes,
    but the affected-unit comparison was being made with Windows
    backslash separators, so nothing matched. Terragrunt now
    compares paths consistently with forward slashes on every
    platform, and the filter detects changed units on Windows as
    it already did on Linux and macOS.
    Reported in #6214.
  - startswith, endswith, strcontains, and run_cmd no longer
    panic on malformed calls
    Calling startswith, endswith, or strcontains with the wrong
    number of arguments (for example a single argument instead of
    two) crashed Terragrunt instead of reporting a configuration
    error. Calling run_cmd with only option flags and no command
    (for example run_cmd("--terragrunt-quiet")) crashed the same
    way.
    These calls now return a clear error: a
    wrong-number-of-parameters error for the string functions,
    and an empty-command error for run_cmd.
  - The --parallelism flag no longer accepts non-positive numbers
    Previously, terragrunt commands that accept the --parallelism
    flag (or equivalently the $TG_PARALLELISM environment
    variable) used to hang indefinitely when invoked with
  - -parallelism=0.
    Terragrunt now validates that the value is positive and exits
    with an error otherwise.
    Reported in #6211
    * Experiments Updated
  - cas — content-addressing for non-git sources
    CAS now covers module sources beyond git: http(s), Amazon S3,
    Google Cloud Storage, and Mercurial. Repeat runs against an
    unchanged remote reuse the cached tree instead of downloading
    the bytes again.
    Before fetching, CAS issues a cheap remote probe (an HTTP
    HEAD, an S3 object-attributes lookup, a GCS metadata read, or
    hg identify) to derive a cache key without pulling the
    source. On a hit, the cached tree is linked directly; on a
    miss, or when the remote exposes no usable signal, CAS
    downloads the source, ingests it, and keys the resulting tree
    by its content hash. A remote that publishes a new version
    under the same address pins to a new entry, so a stale cache
    cannot serve outdated bytes.
  - cas — OpenTofu/Terraform registry sources
    Module sources of the form tfr://... are now
    content-addressed in CAS. Repeat runs against the same pinned
    registry version reuse the cached module instead of
    re-downloading the archive from the registry.
    CAS resolves a tfr:// source by asking the registry where the
    underlying archive lives and uses that resolved URL as the
    cache key. Two runs that pin the same version share one
    entry; a republish under the same version pins to a new
    entry, so a stale cache cannot serve outdated bytes.
  - stack-dependencies: unit.<name>.path and stack.<name>.path
    resolve in values
    The stack-dependencies experiment now exposes
    unit.<name>.path and stack.<name>.path when evaluating the
    values attribute of a unit or stack block, not only inside
    autoinclude blocks. A parent stack can pass the generated
    path of a sibling component down into a child stack, so a
    unit nested in that child stack can depend on a unit that
    lives at a different level of the hierarchy.
    unit "vpc" {
    source = "../catalog/units/vpc"
    path   = "vpc"
    }
    stack "app" {
    source = "../catalog/stacks/app"
    path   = "app"
    values = {
    vpc_path = unit.vpc.path
    }
    }
    A unit inside the app stack reads values.vpc_path and uses it
    as the config_path of an autoinclude dependency, wiring the
    cross-level relationship at generation time. Paths follow the
    same layout the generator produces, including
    no_dot_terragrunt_stack on the referenced block.
  - stack-dependencies: simplified unit.* / stack.* ref shape
    The stack-dependencies experiment no longer resolves
    stack.<name>.<unit_name>.path or
    stack.<name>.<nested_stack>.path. Only the top-level
    stack.<name>.path and unit.<name>.path forms remain.
    stack.<name>.name and unit.<name>.name are gone too; both
    only ever echoed the label that the reference already had to
    spell out.
    Nested references required parsing every nested catalog up
    front and conflicted with the reserved name and path
    attributes on each ref: a nested unit named name or path
    could not be addressed.
    To depend on a generated unit inside a stack, compute the
    path as ${stack.<name>.path}/<unit-relative-path> directly.
    The layout under a stack's generated directory follows
    no_dot_terragrunt_stack on the parent stack and on each unit,
    so hand-computed paths must mirror that resolution.
  - stack-dependencies: .terragrunt-stack-origin no longer
    written
    Terragrunt no longer writes the .terragrunt-stack-origin file
    when generating nested stacks. Set update_source_with_cas =
    true on your unit and stack blocks if you would like relative
    paths in your catalog to resolve correctly instead.
    * What's changed
  - docs: Cleaning up changelogs for v1.0.7 (#6246)
  - chore: Modernizing using gopls (#6232)
  - chore: Adding no `//` path test for source with CAS (#6239)
  - chore: Ensuring full support for tfr in CAS (#6123)
  - fix: Fixing git filters on Windows (#6242)
  - chore: Go and GHA dependencies (#6240)
  - docs: Fixing unreleased changelog page (#6237)
  - fix: Fixing stack autoinclude (#6236)
  - fix: Fixing stack path variables in values (#6235)
  - validate that `--parallelism` value is positive (#6212)
  - fix: Fixing nested generation for paths with `//` (#6234)
  - chore: Increasing test coverage for stack dependencies
    (#6231)
  - chore: Fixing gopls workflow (#6229)
  - docs: Cleaning up experiment docs (#6228)
  - chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#6201)
  - fix: Fixing synthetic trees for `terraform.source` URLs with
    `//` (#6218)
  - chore: stacks dependencies simplificaitons (#6171)
  - chore: Make clone tests a bit faster (#6081)
  - chore: added unknown-unknowns heuristics for coderabbit
    (#6220)
  - chore: Addressing UI/UX feedback for interactive scaffold in
    catalog (#6175)
  - chore: Adding separate archive field (#6196)
  - chore: tests simplification (#6208)
  - chore: Removing `go-errors` as a dependency (#6182)
  - fix: Allowing all TG HCL fns in `terragrunt.stack.hcl`,
    including `autoinclude` (#6166)
  - fix: panics in startswith / endswith / strcontains / run_cmd
    (#5984)
  - fix: Removing use of `cas.WithFS` (#6195)
  - feat: Supporting all getters in CAS (#6076)
  - feat: Make version optional in `tfr://` module registry URLs
    (#6112)
  - chore: Consolidating on lipgloss for color (#6188)
  - chore: improved coderabbit rules (#6193)
  - chore: Getting rid of `go-homedir` direct dependency (#6184)
  - chore: Getting rid of `fatih/structs` dependency (#6186)

++++ tlrc:

  - Update to 1.13.1:
    * updated rustls-webpki to fix vulnerabilities (#172)
    * fix: too many spaces in --info output

++++ tor:

  - Update to 0.4.9.9
    * Major bugfixes (compression, security):
  - Fix a compression bomb bypass where an attacker could concatenate
    many gzip or zlib sub-streams, each just under the per-stream
    detection threshold, to avoid the compression bomb check entirely.
    TROVE-2026-022. Fixes bug 41275; bugfix on 0.3.1.1-alpha.
  - Fix an infinite loop when decompressing a truncated zlib/gzip
    stream with done=1. A truncated stream never reaches Z_STREAM_END,
    causing zlib to return Z_BUF_ERROR with no input remaining, which
    buf_add_compress() mistook for a full output buffer and retried
    forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the
    caller can abort cleanly. TROVE-2026-021. Fixes bug 41274; bugfix
    on 0.2.6.1-alpha.
    * Major bugfixes (conflux, security):
  - Fix a NULL write after free when sending a CONFLUX_SWITCH cell
    fails. The return value of relay_send_command_from_edge() was
    ignored, so a send failure (which calls circuit_mark_for_close()
    and removes the leg via cfx_del_leg()) would go undetected,
    causing the caller to write to the now-freed current leg and
    resulting in a crash. TROVE-2026-017. Fixes bug 41263; bugfix
    on 0.4.8.1-alpha.
    * Major bugfixes (security, TROVE-2026-019):
  - Avoid out-of-bounds read/write when parsing a consensus or
    detached signature with unexpected signature digest type. Impact
    is minor for most Tor roles, but potentially major for directory
    authorities. Fixes bug 41267; bugfix on 0.2.8.2-alpha.
    * Major bugfixes (client stability, TROVE-2026-013, TROVE-2026-015):
  - Protect against a client-side assert that can happen if a
    malicious onion service gets the client to load its carefully
    crafted onion descriptor. Fixes bugs 41259 and 41261; bugfix
    on 0.3.1.1-alpha.
    * Major bugfixes (code safety):
  - Avoid a dangerous situation in router_find_exact_exit_enclave()
    where we could have reached an assert if bridges or relays claim
    an IP address of 0.0.0.0. Fixes bug 41276; bugfix on 0.4.5.1-alpha.
    * Major bugfixes (conflux, shutdown):
  - Fix a use-after-free in the shutdown path when freeing conflux
    circuits. cfx_add_leg() shares stream list pointers across legs
    without NULLing the old leg, so circuit_free_all() would free the
    lists via one leg and then access freed memory via another. TROVE-
    2026-016. Fixes bug 41262; bugfix on 0.4.8.1-alpha.
    * Major bugfixes (DNSPort, TROVE-2026-018):
  - Fix a client-side crash that would happen if we decide to stop
    reading on a RESOLVE request that came from the DNSPort or
    controller. This crash could happen naturally under heavy load and
    with poor luck, but since 0.4.7.2-alpha it could be induced by the
    exit relay via a flow control request. Fixes bug 41265; bugfix
    on 0.2.0.1-alpha.
    * Major bugfixes (memory safety, TROVE-2026-014):
  - Avoid a heap-use-after-free mistake that can happen in the conflux
    subsystem, and which can be induced at either the client or the
    exit relay. Fixes bug 41260; bugfix on 0.4.8.1-alpha.
    * Major bugfixes (onion services, TROVE-2026-020):
  - Avoid a possible divide by zero crash on onion services that have
    the proof-of-work (PoW) defense enabled. This bug could be hit by
    extreme bad luck or maybe by the help of an attacker crafting just
    the right circumstances. Fixes bug 41270; bugfix on 0.4.8.1-alpha.

++++ trufflehog:

  - Update to version 3.95.4:
    * feat(apk): adds some debugging info for APKs and fixes issues parsing obfuscated APKs or APKs with resource types the 3rd party library isn't parsing (#4991)
    * [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support (#4981)
    * Added source config flags to sharepoint proto (#4972)
    * Update CODEOWNERS: replace 5 slugs with scanning + integrations (#4983)
    * Pin GitHub Actions to SHA digests (#4985)
    * Update Go security dependencies (#4986)
    * Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors (#4961)
    * Fix line numbers for duplicate secrets within a chunk (#4910)
    * Remove over speculation from Corpora CI workflow (#4974)
    * feat: add host, db and username to ExtraData for database detectors (#4849)
    * Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues (#4924)
    * Automate corpora testing in CI (#4927)
    * fix(twilio): deduplicate matches to prevent O(N×M) result explosion (#4954)
    * [INS-335] Added AWS Appsync Detector (#4803)
    * [INS-346] SpectralOps Personal API Key Detector (#4770)
    * Box Detector: Extract Subject ID for Analyzer Integration (#4761)
    * Added GitLab OAuth Detector (#4729)
    * fix(github): cache repo info under original URL on redirect (#4958)
    * [INS-455] Unify common logic in Atlassian Data Center detectors (#4907)
    * [INS-461] Add test to ensure new detectors are registered in defaults.go (#4915)

++++ uefi-shell:

  - Update to edk2-stable202605

++++ versitygw:

  - Update to version 1.5.0:
    * fix: connection early termination resulting in internal error
    * fix: enforce required SignedHeaders validation for SigV4
    requests
    * fix: replace misleading webui CORS error toast with generic
    network error message
    * fix: expose x-amz-storage-class in CORS response headers
    * test: ListMultipartUpload query tests, related cleanup
    * fix: normalize object keys during bucket policy evaluation
    * feat: extract gateway runtime into embeddable package
    * fix: fix empty ownership control rules panic
    * chore: update go package dependencies
    * fix: reject invalid PostObject keys
    * fix: honor explicit public bucket policy deny
    * feat: global error refactoring
    * test: ListObjects util code reorg, return value/multipart fixes
    * chore(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/storage/azblob
    * test: HeadObject query tests, more util code changes
    * fix: decode URL hash in webui before parsing bucket/prefix
    * fix: ignore implicit directories for  Get/HeadObject
    * chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2
    * chore(deps): bump the dev-dependencies group with 9 updates
    * test: util code cleanup
    * fix: forward slash url encoded used as bucket/key separator
    * fix: store object multipart upload metadata compressed
    * test: DeleteObjects payload testing
    * feat: add bucket metrics tag when request specifies a bucket
    * fix: reject SigV2 requests
    * feat: replace webui client-side name filter with server-side
    prefix filter
    * test: dockerfile, run script updates, README updates
    * chore: fix sidecar flag in runtests to correctly pass test
    option
    * test: add test tags
    * chore(deps): bump the dev-dependencies group with 19 updates
    * fix: skip integration tests not compatible in sidecar
    * feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data
    integrity checksums
    * feat: add custom route and middleware options
    * fix: remove unsigned chunk reader caching
    * fix: apply CORS middleware to admin CreateBucket route
    * fix: scoutfs multipart alignment check for last part
    * test: GetObject - add query tests, go/bats improved
    header/object reply handling
    * feat: add new ErrNoSpaceLeftOnDevice API error for ENOSPC
    errors
    * chore(deps): bump the dev-dependencies group with 7 updates
    * fix: check PutObjectTagging/LegalHold/Retention permissions on
    PutObject,CopyObject and CreateMultipartUpload
    * chore(deps): bump github.com/Azure/go-ntlmssp from 0.1.0 to
    0.1.1
    * test: initial bats test tagging system, shellcheck fix

++++ wezterm:

  - Update vendored tarball and sources

++++ xdg-user-dirs:

  - Add drop-x-gnome-autostart.patch: Allow systemd to manage the
    start of xdg-user-dirs user service. When X-GNOME-Autostart-Phase
    is set in a .desktop file, systemd ignores it, and since
    gnome-session stopped handling services, we ended up with it
    never beeing started.
    https://gitlab.freedesktop.org/xdg/xdg-user-dirs/-/work_items/52

++++ xer:

  - Update to version 0.0.6:
    * Fix raw read from stdin.

++++ xwayland-run:

  - Update to 0.0.6:
    + xwfb-run: Send the command errors to standrd stderr
    + wlheadless: Use the first configuration file found
    + wlheadless: Consider and prefer XDG_CONFIG_HOME
    + Support the phoc compositor
    + mutter: Check for different virtual monitor syntax
    + wlheadless: Set sensible defaults for XDG dirs
    + wlheadless: Wait for the compositor up to 150 secs
    + weston: Add support for the "--fake-seat" option in weston 15
  - Add phoc to available possible compositors
  - Fix python3 shebang
  - Delete 0001-wlheadless-Ignore-os.waitpid-1-0-error.patch:
    merged upstream

++++ zoo:

  - Spec cleanup:
    * Add explicit gcc and make BuildRequires
    * Drop obsolete Group tag

------------------------------------------------------------------
------------------  2026-6-1  -  Jun 1 2026  -------------------
------------------------------------------------------------------

++++ 7zip:

  - Update to 26.01:
    * linux version of 7-Zip can use huge pages (2 MB pages). It can
    increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
    * new -spo[d|c|r] switch specifies the path generation mode for
    the output directory for archive extraction. The output directory
    path is generated from the path specified in the -o{dir_path}
    switch and the name of the archive being unpacked.
  - spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct
    path to the output directory. The asterisk (*) character
    in {dir_path} will not be replaced by the archive name.
  - spoc : 7-Zip will concatenate the path specified in -o{dir_path}
    with the archive name to form the final path to the output
    directory.
  - spor : 7-Zip will replace asterisk (*) character in the path
    specified in the -o{dir_path} with the archive name.
    This is the default option.
    * some bugs were fixed.
    * CVE-2026-48095 / GHSL-2026-140 : Heap Buffer Write Overflow

++++ FreeFileSync:

  - Add glib2-2.78-free_size-Fix-build-when-g_free-macro-is-defined.patch
    * Based on https://freefilesync.org/forum/viewtopic.php?t=13050#p50762
    * Fixes build on Factory/TW
  - Use gcc15 for Leap 16

++++ Jamulus:

  - Update to 3.12.1
  - Client: Fix occasional spurious version updated message display (#3691).
  - Add Jamulus-fix_version.patch to fix wrong verion.

++++ OpenBoard:

  - add patch 1474-support-poppler-26-04.patch
    * compatibility with poppler 26.04

++++ OpenImageIO:

  - Update to 3.1.14.0
  - oiiotool: New --nchannels flag for parity with maketx. #5198
    (by Danny Greenstein)
  - oiiotool: Commands taking offsets or geometry arguments now
    accept a more flexible offset notation with commas as
    alternative separators (e.g., X,Y or WxH,X,Y in addition to the
    X11-style +X+Y form). This affects --create, --crop, --cut,
  - -fit, --fullsize, --origin, --originoffset, --paste,
  - -pattern, --printstats, --resize. #5209
  - oiiotool: Be more cautious about implicit promotion to float
    when --autocc is used alongside explicit color space names.
    [#5192]
  - color mgmt: For OCIO built-in configs, replace the default file
    rules with more sensible ones that avoid spurious matches
    (e.g., no longer assumes all .exr files use ACES2065-1
    primaries). #5194
  - iconvert: Allow -o outfile for output file designation, for
    parity with oiiotool syntax. #5173
  - ColorConfig: New isData() API method to query if a color space
    is a data space; fix Python isColorSpaceLinear(). #5191
  - ustring.h: Allow freeing the ustring table via
    OIIO::attribute("ustring:cleanup", 1) or env var
    OIIO_USTRING_CLEANUP=1, useful for suppressing false positives
    in memory leak detection tools. #5213
  - dicom: Enforce reasonable resolution limits to guard against
    corrupt files. #5167 (3.0.19.0)
  - gif: Preserve RGB values of transparent-indexed pixels
    (previously only alpha was set, zeroing the RGB channels).
    [#5188] (by Lumina Wang)
  - jpeg: More correctly handle bounds checks for malformed APP1
    Exif and APP2 ICC metadata markers. #5174 (by Vlad Erium)
  - jpeg-xl: Enforce format resolution limits for better detection
    of corrupt or invalid files. #5202 (by Hannah Gulka)
  - jpeg-xl,pnm: Prevent readers from loading or allocating memory
    for arbitrarily large non-image files. #5203 (by Maxwell
    Iverson) (3.0.19.0)
  - psd: Fix indexed transparency. #5177 (by Vlad Erium)
  - softimage: Fix possible small allocation leak in RLE decoder.
    [#5182]
  - webp: Fix bounds handling for WebP EXIF metadata chunks. #5175
    (by Vlad Erium)
  - webp: Enforce format resolution limits for better detection of
    corrupt or invalid files. #5202 (by Hannah Gulka)
  - filesystem.h: Speedup various file system operations on Windows
    using native APIs. #5199 (by Lumina Wang)
  - build: Remove -Wno-unused-result from gcc compile options,
    surfacing more potential warnings. #5214 (by Luna Kim)
  - ci: Fix broken CI by locking down aswf container for 2023
    [#5200]; remove deprecated windows-2025 runner #5189 (3.0.19.0)
  - admin: Add CVE-2024-55194 (long since fixed) to security
    alerts. #5216
  - Contributors: First-time contributors to this release: Hannah
    Gulka, Luna Kim, Marta Feriani, Maxwell Iverson.

++++ SDL3:

  - Update to release 3.4.10
    * Allow depth texture arrays in the GPU API
    * Fixed a crash when copying to the Vulkan swapchain with the GPU
    API
    * Added controller sensor support for GameInput v3
    * Fixed Ipega controllers being ignored in keyboard mode
    * Added support for GameCube rumble when the adapter is in PC
    mode and has the latest firmware
    * Fixed rumble on the new Steam Controller
    * Added support for the GameSir Super Nova in Xbox 360 mode
    * Added support for the PDP Afterglow Wave Wireless Controller
    for Switch
    * Fixed several second hang when changing focus on X11 in some
    situations
    * Disable the X Synchronization Extension by default, can be
    enabled with SDL_HINT_VIDEO_X11_ENABLE_XSYNC_EXT
    * Fixed SDL_HINT_MOUSE_FOCUS_CLICKTHROUGH on X11
    * Fixed a rare crash on Raspberry Pi when creating a window

++++ SDL3_net:

  - Update to release 3.2.0
    * api: Add NET_GetAddressBytes()

++++ adwaita-icon-theme:

  - Update to version 50.0+2:
    + folder-projects: XDG Projects folder.

++++ agama:

  - Extend storage schemas to allow configuring the space policy for
    creating new LVM physical volumes (jsc#PED-14153).

++++ agama-web-ui:

  - Create new LVM volume groups using all the availabe space on the
    selected disks (jsc#PED-14153).

++++ agama-yast:

  - Allow configuring the space policy for creating LVM physical
    volumes (jsc#PED-14153).

++++ apache-sshd:

  - Update to upstream version 2.18.0
    * Bug Fixes
    + GH-743 Ensure the Java ServiceLoader use a singleton
    SftpFileSystemProvider
    + GH-879 Close SSH channel gracefully on exception in port
    forwarding
    + Security: Improve handling of repository paths in sshd-git.
    Resolves CVE-2026-48827, bsc#1267018
    * New Features
    + GH-892 Align handling certificates without principals with
    OpenSSH 10.3
  - Update to upstream version 2.17.1
    * Changes
    + GH-875 Use Apache Parent POM 36
  - Update to upstream version 2.17.0
    * Bug Fixes
    + GH-469, SSHD-897 Fix duplicate character echo with interactive
    shells
    + GH-721 SSH client: schedule session timeout checks on demand
    only
    + GH-807 Handle "verified" flag for sk-* keys
    + GH-809 Fix server-side authentication for FIDO/U2F sk-* keys
    with flags in authorized_keys
    + GH-827 Don't fail on invalid known_hosts lines; log and skip
    them
    + GH-830 EC public keys: let Bouncy Castle generate X.509
    encodings with the curve OID as algorithm parameter
    + GH-855 SFTP: use a single SftpClient per SftpFileSystem
    + GH-856 Fix using ed25519 with BC-FIPS
    + GH-861 SFTP client: prevent sending zero-length writes in
    SftpOutputStreamAsync
    + SSHD-1348 Fix zero-length SFTP reads
    + SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when
    compiling on Java 26-ea
    * New Features
    + GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in
    optional dependency net.i2p.crypto:eddsa:0.3.0: perform the
    missing range check in Apache MINA SSHD before delegating to
    the signature verification in net.i2p.crypto:eddsa:0.3.0.
    This means that using net.i2p.crypto:eddsa:0.3.0 in Apache
    MINA SSHD is safe despite that CVE in the dependency.
    + GH-865 replace %h in HostName SSH config

++++ apache-sshd-extras:

  - Update to upstream version 2.18.0
    * Bug Fixes
    + GH-743 Ensure the Java ServiceLoader use a singleton
    SftpFileSystemProvider
    + GH-879 Close SSH channel gracefully on exception in port
    forwarding
    + Security: Improve handling of repository paths in sshd-git.
    Resolves CVE-2026-48827, bsc#1267018
    * New Features
    + GH-892 Align handling certificates without principals with
    OpenSSH 10.3
  - Update to upstream version 2.17.1
    * Changes
    + GH-875 Use Apache Parent POM 36
  - Update to upstream version 2.17.0
    * Bug Fixes
    + GH-469, SSHD-897 Fix duplicate character echo with interactive
    shells
    + GH-721 SSH client: schedule session timeout checks on demand
    only
    + GH-807 Handle "verified" flag for sk-* keys
    + GH-809 Fix server-side authentication for FIDO/U2F sk-* keys
    with flags in authorized_keys
    + GH-827 Don't fail on invalid known_hosts lines; log and skip
    them
    + GH-830 EC public keys: let Bouncy Castle generate X.509
    encodings with the curve OID as algorithm parameter
    + GH-855 SFTP: use a single SftpClient per SftpFileSystem
    + GH-856 Fix using ed25519 with BC-FIPS
    + GH-861 SFTP client: prevent sending zero-length writes in
    SftpOutputStreamAsync
    + SSHD-1348 Fix zero-length SFTP reads
    + SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when
    compiling on Java 26-ea
    * New Features
    + GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in
    optional dependency net.i2p.crypto:eddsa:0.3.0: perform the
    missing range check in Apache MINA SSHD before delegating to
    the signature verification in net.i2p.crypto:eddsa:0.3.0.
    This means that using net.i2p.crypto:eddsa:0.3.0 in Apache
    MINA SSHD is safe despite that CVE in the dependency.
    + GH-865 replace %h in HostName SSH config

++++ apko:

  - Update to version 1.2.15:
    * build(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6
    (#2240)
    * build(deps): bump goreleaser/goreleaser-action from 7.2.1 to
    7.2.2 (#2241)
    * build(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0
    (#2244)
    * build(deps): bump google.golang.org/api from 0.279.0 to 0.280.0
    (#2245)
    * build(deps): bump golangci/golangci-lint-action from 9.2.0 to
    9.2.1 (#2247)
    * build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 in the go_modules group across 1 directory (#2239)
    * build(deps): bump step-security/harden-runner from 2.19.3 to
    2.19.4 (#2248)
    * chore(harden-runner): add production.cloudfront.docker.com
    endpoint (#2250)

++++ aspell:

  - version update to 0.60.8.2:
    • Improved compiler compatibility: Fixed Clang -Wstrict-prototypes
    warnings for C interface, fixed new Clang warnings, fixed GCC 15
    build issues, and added MSYS2 + MINGW64 compile fixes.
    • Enhanced testing infrastructure with newer compiler versions,
    including snapshots from both GCC and Clang, to catch future
    problems before they make their way into distros.
    • Fixed bug that caused aspell_speller_store_replacement to return
    random values.
    • Fixed typo in Texinfo filter option file.
    • Various documentation updates and fixes.
  - modified patches
    * aspell-strict-aliasing.patch (refreshed)
  - deleted patches
    * aspell-gcc15.patch (upstreamed)

++++ aspell-en:

  - version update to 2026.02.25
    * see https://wordlist.aspell.net/news/

++++ ast-grep:

  - Update to version 0.43.0:
    * 0.43.0 bump version
    * feat: add markdown support
    * chore(deps): update dependency @types/node to v24.12.4 (#2636)
    * chore(deps): update rust crate assert_cmd to v2.2.2 (#2632)
    * chore(deps): update rust crate similar to v3.1.1 (#2662)
    * fix: update esquery state
    * fix: strip trailing comment artifact in comment suppression
    * chore: bump tree-sitter-json version
    * test: add test for run --kind
    * feat: support ESQuery style selector in run command
    * fix: use Rule instead of pattern in run
    * refactor: improve config read_yaml_string interface
    * fix: update test rule
    * fix: remove unused logging
    * fix(lsp): initialize tracing subscriber to surface tower-lsp errors (#2639)
    * fix(deps): update rust-wasm-bindgen monorepo (#2660)
    * chore(deps): update rust crate tree-sitter to v0.26.9 (#2656)
    * feat: add --follow arg for sg test
    * chore(deps): update rust crate serde_json to v1.0.150 (#2659)
    * chore(deps): update rust crate clap_complete to v4.6.5 (#2634)
    * chore(deps): update dependency @ast-grep/napi to v0.42.3 (#2653)
    * chore(deps): update dependency oxlint to v1.66.0 (#2651)
    * chore(deps): update dependency web-tree-sitter to v0.26.9 (#2654)
    * 0.42.3 bump version
    * fix: fix windows installation
    * feat: support nth-last-child esquery (#2631)
    * chore(deps): update rust crate dashmap to v6.2.1 (#2645)
    * chore(deps): update dependency oxlint to v1.65.0 (#2635)
    * chore(deps): update rust crate napi-derive to v3.5.6 (#2642)
    * chore(deps): update rust crate napi-build to v2.3.2 (#2641)
    * chore(deps): update rust crate napi to v3.9.0 (#2643)
    * chore(deps): update dependency @ast-grep/napi to v0.42.2 (#2630)

++++ audacious:

  - Update to version 4.6:
    * New plugins and features:
  - Add file browser plugin
  - Add macOS Now Playing plugin
  - Port Playback History plugin to GTK (#1596)
  - Enable Xwayland only for Winamp interface (#1754, #1656)
  - Add a configuration setting for Xwayland (#1664)
  - Allow sorting playlist entries by bitrate (#1356)
  - Support exporting playlists on CLI with audtool (#1659)
  - Allow playing Musepack SV8 files (#1674)
  - Support all AIFF extensions and MIME types (#1690)
  - Add support for file creation/modification dates (#1701)
  - Allow to bring back playlist deletion confirmation (#1724)
  - Allow wrapping to last track in playlist with Previous button
    (#1726)
  - Support more shortcuts in GTK/Qt interface to switch playlist
    tabs (#1730)
  - Add support for reading lyrics tag from Opus, Ogg Vorbis and
    FLAC files
  - Allow to configure previous/next album global hotkeys (#1737)
  - Read ReplayGain tags with FFmpeg plugin for more file types
    (#1793)
  - Load companion .m3u/.m3u8 with Game Console Music Decoder for
    subsong metadata
  - Handle Delete and F2 key press events in Playlist Manager
  - Use localized music directory for Search Tool
  - Accept dropped files on main window of Qt Winamp interface
    * Bugs fixed since 4.5.1:
  - Fix corner case of Qt-only build with use_qt=FALSE in config
  - Escape brackets in file path URLs (#1649)
  - Work around broken drop indicator in Qt interface with Qt
    6.8+ (#1667)
  - Fix help output for --pause command (#1678)
  - Prevent buffer overflow in PSF metadata parser (#1713)
  - Fix encoding issue with lyrics on Windows (#1731)
  - Prevent undefined behavior for integer conversions (#1796)
  - Plug memory leaks in LIRC plugin
  - Prevent infinite loop with "Next album" and enabled shuffle
    mode
    * Changes since 4.6-beta1:
  - Avoid crash when opening malformed PSF2 file (#1716)
  - Prevent crash when migrating config settings (#1797)
  - Fix slider knob click behavior with GTK 3 (#1813)
  - Update translations
    * Other changes:
  - Remove deprecated Audacious code and APIs
  - Remove Mac Media Keys plugin (#1653)
  - Remove ChartLyrics support (#1728)
  - Drop autotools support in favor of Meson
  - Allow disabling any plugin with Meson
  - Enable -fvisibility-inlines-hidden (#1683)
  - Support version 3.0 of libsidplayfp (#1706)
  - Require newer versions for dependencies like GTK, Qt, FFmpeg,
    etc.
  - Install AppStream metainfo file by default
  - Various code cleanups
  - Bump soname following upstream changes.

++++ audacious-plugins:

  - Update to version 4.6:
    * New plugins and features:
  - Add file browser plugin
  - Add macOS Now Playing plugin
  - Port Playback History plugin to GTK (#1596)
  - Enable Xwayland only for Winamp interface (#1754, #1656)
  - Add a configuration setting for Xwayland (#1664)
  - Allow sorting playlist entries by bitrate (#1356)
  - Support exporting playlists on CLI with audtool (#1659)
  - Allow playing Musepack SV8 files (#1674)
  - Support all AIFF extensions and MIME types (#1690)
  - Add support for file creation/modification dates (#1701)
  - Allow to bring back playlist deletion confirmation (#1724)
  - Allow wrapping to last track in playlist with Previous button
    (#1726)
  - Support more shortcuts in GTK/Qt interface to switch playlist
    tabs (#1730)
  - Add support for reading lyrics tag from Opus, Ogg Vorbis and
    FLAC files
  - Allow to configure previous/next album global hotkeys (#1737)
  - Read ReplayGain tags with FFmpeg plugin for more file types
    (#1793)
  - Load companion .m3u/.m3u8 with Game Console Music Decoder for
    subsong metadata
  - Handle Delete and F2 key press events in Playlist Manager
  - Use localized music directory for Search Tool
  - Accept dropped files on main window of Qt Winamp interface
    * Bugs fixed since 4.5.1:
  - Fix corner case of Qt-only build with use_qt=FALSE in config
  - Escape brackets in file path URLs (#1649)
  - Work around broken drop indicator in Qt interface with Qt
    6.8+ (#1667)
  - Fix help output for --pause command (#1678)
  - Prevent buffer overflow in PSF metadata parser (#1713)
  - Fix encoding issue with lyrics on Windows (#1731)
  - Prevent undefined behavior for integer conversions (#1796)
  - Plug memory leaks in LIRC plugin
  - Prevent infinite loop with "Next album" and enabled shuffle
    mode
    * Changes since 4.6-beta1:
  - Avoid crash when opening malformed PSF2 file (#1716)
  - Prevent crash when migrating config settings (#1797)
  - Fix slider knob click behavior with GTK 3 (#1813)
  - Update translations
    * Other changes:
  - Remove deprecated Audacious code and APIs
  - Remove Mac Media Keys plugin (#1653)
  - Remove ChartLyrics support (#1728)
  - Drop autotools support in favor of Meson
  - Allow disabling any plugin with Meson
  - Enable -fvisibility-inlines-hidden (#1683)
  - Support version 3.0 of libsidplayfp (#1706)
  - Require newer versions for dependencies like GTK, Qt, FFmpeg,
    etc.
  - Install AppStream metainfo file by default
  - Various code cleanups
  - Drop fix-linking-mpg123.patch: Only ever applied to
    autotoolsbuild, and that does not exist anymore.

++++ benchmark:

  - Add gcc16.patch to fix the broken build with GCC 16

++++ guitarix:

  - Move '--cxxflags' parameter to CXXFLAGS:
    * Fixes build on Factory/TW

++++ cacti:

  - Update to version 1.2.30+git457.e55c2aea:
    * docs(changelog): add security fix refs for 1.2.31 (#7170)
    * fix: Upgrade DOMPurify again for additional hardening (#7168)
    * security: Ensure that reports does not work as guest (#7167)
    * Update translation files
    * security: GHSA-m7v2-f3xw-3qh7 - User Enumeration via Error Messages (#7166)
    * chore: Move around developers, rest in peace my friend (#7165)
    * Import undefined variable (#7164)
    * fix: guard api_plugin_moveup/movedown against NULL prior/next id (1.2.x backport) (#7158)
    * fix(correctness): loop-state leaks, chunk-aware poller CRC, header-suppression and tree false-guards (1.2.x) (#7151)
    * fix: Remove composer.lock (#7156)
    * test: source-pattern coverage backfill for PR 7148, 7149, 7150 (#7153)
    * fix: CVE-2024-27355 in phpseclib (#7155)
    * chore: Update ChangeLogs (#7152)

++++ rust:

  - Update to version 1.96.0 - for details see the rust1.96 package

++++ libcec:

  - Update to version 7.1.1 (includes 7.1.0):
    * Add Teufel vendor ID
    * Add system audio mode request & status support
    * RPi: check that passive mode can be set during adapter
    detection
    * Make CMake obey INSTALL_BINDIR / INSTALL_LIBDIR
    * Various build fixes and NULL-handling corrections
  - Drop libcec-cmake_install_lib_dir.patch: the lib-install-dir
    fix is now included upstream
  - Do not ship the static library (libcec.a)
  - Spec cleanup: convert ncurses-devel to pkgconfig(ncurses),
    drop obsolete Group tags

++++ chromium:

  - Chromium 149 (149.0.7827.53) stable (boo#1267706):
    * CVE-2026-10881: Out of bounds read and write in ANGLE
    * CVE-2026-10882: Use after free in Network
    * CVE-2026-10883: Out of bounds write in ANGLE
    * CVE-2026-10884: Use after free in Chromecast
    * CVE-2026-10885: Use after free in Chrome for iOS
    * CVE-2026-10886: Use after free in FileSystem
    * CVE-2026-10887: Use after free in Chromoting
    * CVE-2026-10888: Use after free in Cast Streaming
    * CVE-2026-10889: Out of bounds read in ANGLE
    * CVE-2026-10890: Use after free in Cast
    * CVE-2026-10891: Use after free in GFX
    * CVE-2026-10892: Out of bounds write in GPU
    * CVE-2026-10893: Use after free in Chromoting
    * CVE-2026-10894: Use after free in Printing
    * CVE-2026-10895: Use after free in Ozone
    * CVE-2026-10896: Use after free in Chrome for iOS
    * CVE-2026-10897: Out of bounds write in GPU
    * CVE-2026-10898: Stack buffer overflow in GPU
    * CVE-2026-10899: Use after free in Ozone
    * CVE-2026-10900: Use after free in Passwords
    * CVE-2026-10901: Use after free in Passwords
    * CVE-2026-10902: Use after free in Ozone
    * CVE-2026-10903: Use after free in WebRTC
    * CVE-2026-10904: Inappropriate implementation in V8
    * CVE-2026-10905: Use after free in Network
    * CVE-2026-10906: Use after free in WebAuthentication
    * CVE-2026-10907: Out of bounds write in ANGLE
    * CVE-2026-10908: Use after free in FullScreen
    * CVE-2026-10909: Use after free in Dawn
    * CVE-2026-10910: Type Confusion in V8
    * CVE-2026-10911: Insufficient validation of untrusted input in Media
    * CVE-2026-10912: Insufficient validation of untrusted input in Extensions
    * CVE-2026-10913: Use after free in ANGLE
    * CVE-2026-10914: Use after free in ANGLE
    * CVE-2026-10915: Use after free in Core
    * CVE-2026-10916: Insufficient validation of untrusted input in DevTools
    * CVE-2026-10917: Insufficient validation of untrusted input in Media
    * CVE-2026-10918: Use after free in Viz
    * CVE-2026-10919: Use after free in ANGLE
    * CVE-2026-10920: Insufficient validation of untrusted input in WebShare
    * CVE-2026-10921: Integer overflow in Dawn
    * CVE-2026-10922: Insufficient validation of untrusted input in DevTools
    * CVE-2026-10923: Use after free in WebAppInstalls
    * CVE-2026-10924: Integer overflow in Chromecast
    * CVE-2026-10925: Out of bounds write in Skia
    * CVE-2026-10926: Use after free in Cast
    * CVE-2026-10927: Out of bounds read in Dawn
    * CVE-2026-10928: Script injection in Headless
    * CVE-2026-10929: Heap buffer overflow in ANGLE
    * CVE-2026-10930: Out of bounds read in ANGLE
    * CVE-2026-10931: Use after free in FileSystem
    * CVE-2026-10932: Use after free in UI
    * CVE-2026-10933: Use after free in Audio
    * CVE-2026-10934: Use after free in Autofill
    * CVE-2026-10935: Inappropriate implementation in V8
    * CVE-2026-10936: Type Confusion in V8
    * CVE-2026-10937: Inappropriate implementation in Passwords
    * CVE-2026-10938: Insufficient validation of untrusted input in Input
    * CVE-2026-10939: Use after free in WebRTC
    * CVE-2026-10940: Race in Codecs
    * CVE-2026-10941: Out of bounds memory access in Skia
    * CVE-2026-10942: Insufficient validation of untrusted input in UI
    * CVE-2026-10943: Use after free in WebRTC
    * CVE-2026-10944: Insufficient policy enforcement in Autofill
    * CVE-2026-10945: Use after free in PDF
    * CVE-2026-10946: Heap buffer overflow in Media
    * CVE-2026-10947: Use after free in WebRTC
    * CVE-2026-10948: Use after free in WebRTC
    * CVE-2026-10949: Heap buffer overflow in Video
    * CVE-2026-10950: Insufficient policy enforcement in Autofill
    * CVE-2026-10951: Use after free in Autofill
    * CVE-2026-10952: Use after free in Chrome for iOS
    * CVE-2026-10953: Use after free in Core
    * CVE-2026-10954: Use after free in Actor
    * CVE-2026-10955: Type Confusion in ANGLE
    * CVE-2026-10956: Use after free in MimeHandlerView
    * CVE-2026-10957: Use after free in Glic
    * CVE-2026-10958: Use after free in Chrome for iOS
    * CVE-2026-10959: Use after free in Input
    * CVE-2026-10960: Uninitialized Use in Codecs
    * CVE-2026-10961: Use after free in Chrome for iOS
    * CVE-2026-10962: Type Confusion in Media
    * CVE-2026-10963: Integer overflow in V8
    * CVE-2026-10964: Integer overflow in V8
    * CVE-2026-10965: Integer overflow in DevTools
    * CVE-2026-10966: Insufficient validation of untrusted input in Codecs
    * CVE-2026-10967: Use after free in SurfaceCapture
    * CVE-2026-10968: Insufficient validation of untrusted input in Dawn
    * CVE-2026-10969: Insufficient validation of untrusted input in Extensions
    * CVE-2026-10970: Insufficient validation of untrusted input in InterestGroups
    * CVE-2026-10971: Insufficient validation of untrusted input in Printing
    * CVE-2026-10972: Use after free in Ozone
    * CVE-2026-10973: Uninitialized Use in Dawn
    * CVE-2026-10974: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-10975: Use after free in WebRTC
    * CVE-2026-10976: Uninitialized Use in Dawn
    * CVE-2026-10977: Uninitialized Use in Skia
    * CVE-2026-10978: Use after free in Chromoting
    * CVE-2026-10979: Out of bounds read in ANGLE
    * CVE-2026-10980: Insufficient validation of untrusted input in DevTools
    * CVE-2026-10981: Insufficient validation of untrusted input in Codecs
    * CVE-2026-10982: Use after free in WebXR
    * CVE-2026-10983: Insufficient validation of untrusted input in Dawn
    * CVE-2026-10984: Inappropriate implementation in Accessibility
    * CVE-2026-10985: Out of bounds read in Skia
    * CVE-2026-10986: Integer overflow in Media
    * CVE-2026-10987: Integer overflow in V8
    * CVE-2026-10988: Use after free in Views
    * CVE-2026-10989: Inappropriate implementation in V8
    * CVE-2026-10990: Use after free in Glic
    * CVE-2026-10991: Use after free in V8
    * CVE-2026-10992: Insufficient data validation in Animation
    * CVE-2026-10993: Heap buffer overflow in Skia
    * CVE-2026-10994: Uninitialized Use in ANGLE
    * CVE-2026-10995: Heap buffer overflow in TabStrip
    * CVE-2026-10996: Inappropriate implementation in Workers
    * CVE-2026-10997: Insufficient policy enforcement in Extensions
    * CVE-2026-10998: Out of bounds read in Media
    * CVE-2026-10999: Out of bounds memory access in ANGLE
    * CVE-2026-11000: Use after free in Fonts
    * CVE-2026-11001: Incorrect security UI in Payments
    * CVE-2026-11002: Use after free in Autofill
    * CVE-2026-11003: Use after free in WebRTC
    * CVE-2026-11004: Out of bounds read in ANGLE
    * CVE-2026-11005: Out of bounds read in ANGLE
    * CVE-2026-11006: Out of bounds read in Dawn
    * CVE-2026-11007: Insufficient validation of untrusted input in WebView
    * CVE-2026-11008: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-11009: Use after free in USB
    * CVE-2026-11010: Use after free in WebShare
    * CVE-2026-11011: Insufficient policy enforcement in Password Manager
    * CVE-2026-11012: Use after free in Serial
    * CVE-2026-11013: Insufficient validation of untrusted input in Network
    * CVE-2026-11014: Insufficient policy enforcement in Extensions
    * CVE-2026-11015: Out of bounds read in WebGPU
    * CVE-2026-11016: Insufficient validation of untrusted input in Network
    * CVE-2026-11017: Inappropriate implementation in Link Preview
    * CVE-2026-11018: Insufficient policy enforcement in Actor
    * CVE-2026-11019: Inappropriate implementation in Payments
    * CVE-2026-11020: Inappropriate implementation in Extensions
    * CVE-2026-11021: Insufficient validation of untrusted input in GPU
    * CVE-2026-11022: Insufficient validation of untrusted input in DevTools
    * CVE-2026-11023: Insufficient validation of untrusted input in WebAppInstalls
    * CVE-2026-11024: Stack buffer overflow in Skia
    * CVE-2026-11025: Insufficient policy enforcement in Navigation
    * CVE-2026-11026: Insufficient policy enforcement in Extensions
    * CVE-2026-11027: Insufficient validation of untrusted input in Glic
    * CVE-2026-11028: Use after free in Media
    * CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop
    * CVE-2026-11030: Use after free in Network
    * CVE-2026-11031: Insufficient validation of untrusted input in Password Manager
    * CVE-2026-11032: Insufficient data validation in Password Manager
    * CVE-2026-11033: Uninitialized Use in WebML
    * CVE-2026-11034: Insufficient validation of untrusted input in Tab Group Sync
    * CVE-2026-11035: Insufficient validation of untrusted input in Custom Tabs
    * CVE-2026-11036: Inappropriate implementation in DOM
    * CVE-2026-11037: Out of bounds write in Codecs
    * CVE-2026-11038: Insufficient validation of untrusted input in Subresource Integrity
    * CVE-2026-11039: Uninitialized Use in Skia
    * CVE-2026-11040: Use after free in ANGLE
    * CVE-2026-11041: Insufficient validation of untrusted input in Media
    * CVE-2026-11042: Use after free in Views
    * CVE-2026-11043: Out of bounds write in ANGLE
    * CVE-2026-11044: Integer overflow in ANGLE
    * CVE-2026-11045: Insufficient validation of untrusted input in GPU
    * CVE-2026-11046: Insufficient validation of untrusted input in Media
    * CVE-2026-11047: Insufficient validation of untrusted input in Base
    * CVE-2026-11048: Inappropriate implementation in Extensions
    * CVE-2026-11049: Use after free in Password Manager
    * CVE-2026-11050: Use after free in V8
    * CVE-2026-11051: Out of bounds read in ANGLE
    * CVE-2026-11052: Type Confusion in GPU
    * CVE-2026-11053: VULNERABILITY in WebRTC
    * CVE-2026-11054: Use after free in WebRTC
    * CVE-2026-11055: Use after free in ANGLE
    * CVE-2026-11056: Insufficient validation of untrusted input in SiteIsolation
    * CVE-2026-11057: Uninitialized Use in Skia
    * CVE-2026-11058: Integer overflow in CredentialProvider
    * CVE-2026-11059: Use after free in Blink
    * CVE-2026-11060: Use after free in Media
    * CVE-2026-11061: Out of bounds read in ANGLE
    * CVE-2026-11062: Insufficient policy enforcement in Extensions
    * CVE-2026-11063: Insufficient validation of untrusted input in WebNN
    * CVE-2026-11064: Uninitialized Use in GPU
    * CVE-2026-11065: Use after free in ANGLE
    * CVE-2026-11066: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-11067: Uninitialized Use in Dawn
    * CVE-2026-11068: Use after free in WebSockets
    * CVE-2026-11069: Insufficient validation of untrusted input in Cast
    * CVE-2026-11070: Insufficient validation of untrusted input in Chromoting
    * CVE-2026-11071: Use after free in Base
    * CVE-2026-11072: Use after free in WebView
    * CVE-2026-11073: Use after free in WebGL
    * CVE-2026-11074: Use after free in WebRTC
    * CVE-2026-11075: Out of bounds read in V8
    * CVE-2026-11076: Type Confusion in CSS
    * CVE-2026-11077: Out of bounds read in Dawn
    * CVE-2026-11078: Insufficient validation of untrusted input in FileSystem
    * CVE-2026-11079: Insufficient validation of untrusted input in Codecs
    * CVE-2026-11080: Use after free in WebView
    * CVE-2026-11081: Policy bypass in Canvas
    * CVE-2026-11082: Use after free in GPU
    * CVE-2026-11083: Inappropriate implementation in Password Manager
    * CVE-2026-11084: Inappropriate implementation in Password Manager
    * CVE-2026-11085: Integer overflow in GPU
    * CVE-2026-11086: Insufficient validation of untrusted input in Dawn
    * CVE-2026-11087: Uninitialized Use in ANGLE
    * CVE-2026-11088: Integer overflow in ANGLE
    * CVE-2026-11089: Uninitialized Use in Media
    * CVE-2026-11090: Uninitialized Use in ANGLE
    * CVE-2026-11091: Inappropriate implementation in Dawn
    * CVE-2026-11092: Insufficient policy enforcement in DevTools
    * CVE-2026-11093: Insufficient validation of untrusted input in Printing
    * CVE-2026-11094: Use after free in Codecs
    * CVE-2026-11095: Insufficient validation of untrusted input in Codecs
    * CVE-2026-11096: Out of bounds read in WebRTC
    * CVE-2026-11097: Inappropriate implementation in WebView
    * CVE-2026-11098: Insufficient validation of untrusted input in GPU
    * CVE-2026-11099: Vulnerability in Skia
    * CVE-2026-11100: Use after free in File Input
    * CVE-2026-11101: Uninitialized Use in Dawn
    * CVE-2026-11102: Inappropriate implementation in Isolated Web Apps
    * CVE-2026-11103: Inappropriate implementation in Installer
    * CVE-2026-11104: Uninitialized Use in ANGLE
    * CVE-2026-11105: Insufficient validation of untrusted input in WebUI
    * CVE-2026-11106: Inappropriate implementation in Media
    * CVE-2026-11107: Inappropriate implementation in Downloads
    * CVE-2026-11108: Inappropriate implementation in NFC
    * CVE-2026-11109: Uninitialized Use in ANGLE
    * CVE-2026-11110: Uninitialized Use in ANGLE
    * CVE-2026-11111: Out of bounds read in ANGLE
    * CVE-2026-11112: Insufficient validation of untrusted input in Chromoting
    * CVE-2026-11113: Insufficient validation of untrusted input in ANGLE
    * CVE-2026-11114: Use after free in Device Trust
    * CVE-2026-11115: Use after free in Updater
    * CVE-2026-11116: Use after free in Chromoting
    * CVE-2026-11117: Use after free in Views
    * CVE-2026-11118: Use after free in WebRTC
    * CVE-2026-11119: Insufficient validation of untrusted input in GPU
    * CVE-2026-11120: Insufficient validation of untrusted input in Enterprise Reporting
    * CVE-2026-11121: Insufficient validation of untrusted input in Skia
    * CVE-2026-11122: Inappropriate implementation in Keyboard
    * CVE-2026-11123: Uninitialized Use in ANGLE
    * CVE-2026-11124: Heap buffer overflow in Skia
    * CVE-2026-11125: Use after free in Compositing
    * CVE-2026-11126: Insufficient validation of untrusted input in DevTools
    * CVE-2026-11127: Inappropriate implementation in WebAPKs
    * CVE-2026-11128: Insufficient validation of untrusted input in Web Share
    * CVE-2026-11129: Inappropriate implementation in Extensions
    * CVE-2026-11130: Use after free in Media
    * CVE-2026-11131: Use after free in Autofill
    * CVE-2026-11132: Policy bypass in Paint
    * CVE-2026-11133: Insufficient policy enforcement in Paint
    * CVE-2026-11134: Insufficient data validation in Media
    * CVE-2026-11135: Insufficient policy enforcement in Autofill
    * CVE-2026-11136: Use after free in Canvas
    * CVE-2026-11137: Uninitialized Use in ANGLE
    * CVE-2026-11138: Uninitialized Use in ANGLE
    * CVE-2026-11139: Policy bypass in Paint
    * CVE-2026-11140: Insufficient validation of untrusted input in Chromecast
    * CVE-2026-11141: Uninitialized Use in Audio
    * CVE-2026-11142: Policy bypass in Paint
    * CVE-2026-11143: Heap buffer overflow in Extensions
    * CVE-2026-11144: Use after free in Media
    * CVE-2026-11145: Race in Geolocation
    * CVE-2026-11146: Insufficient validation of untrusted input in Chromoting
    * CVE-2026-11147: Use after free in WebML
    * CVE-2026-11148: Inappropriate implementation in Payments
    * CVE-2026-11149: Insufficient validation of untrusted input in Extensions
    * CVE-2026-11150: Inappropriate implementation in XML
    * CVE-2026-11151: Insufficient validation of untrusted input in Password Manager
    * CVE-2026-11152: Object lifecycle issue in Dawn
    * CVE-2026-11153: Side-channel information leakage in Forms
    * CVE-2026-11154: Use after free in Dawn
    * CVE-2026-11155: Insufficient policy enforcement in CSS
    * CVE-2026-11156: Inappropriate implementation in CSS
    * CVE-2026-11157: Script injection in Accessibility
    * CVE-2026-11158: Insufficient validation of untrusted input in Downloads
    * CVE-2026-11159: Uninitialized Use in Skia
    * CVE-2026-11160: Out of bounds read in Input
    * CVE-2026-11161: Insufficient data validation in DataTransfer
    * CVE-2026-11162: Insufficient policy enforcement in CSS
    * CVE-2026-11163: Use after free in Messages
    * CVE-2026-11164: Use after free in Blink
    * CVE-2026-11165: Use after free in WebMIDI
    * CVE-2026-11166: Inappropriate implementation in SVG
    * CVE-2026-11167: Inappropriate implementation in WebView
    * CVE-2026-11168: Insufficient policy enforcement in Extensions
    * CVE-2026-11169: Inappropriate implementation in XML
    * CVE-2026-11170: Inappropriate implementation in Chromoting
    * CVE-2026-11171: Integer overflow in Blink
    * CVE-2026-11172: Incorrect security UI in Contact Picker
    * CVE-2026-11173: Out of bounds write in V8
    * CVE-2026-11174: Insufficient policy enforcement in Site Isolation
    * CVE-2026-11175: Incorrect security UI in Messages
    * CVE-2026-11176: Inappropriate implementation in Media
    * CVE-2026-11177: Use after free in Omnibox
    * CVE-2026-11178: Policy bypass in WebView
    * CVE-2026-11179: Inappropriate implementation in ORB
    * CVE-2026-11180: Policy bypass in SVG
    * CVE-2026-11181: Inappropriate implementation in Media Session
    * CVE-2026-11182: Inappropriate implementation in SVG
    * CVE-2026-11183: Out of bounds read in GWP-ASan
    * CVE-2026-11184: Insufficient policy enforcement in Actor
    * CVE-2026-11185: Use after free in V8
    * CVE-2026-11186: Inappropriate implementation in CSS
    * CVE-2026-11187: Insufficient policy enforcement in Glic
    * CVE-2026-11188: Use after free in USB
    * CVE-2026-11189: Insufficient validation of untrusted input in DevTools
    * CVE-2026-11190: Insufficient policy enforcement in Extensions
    * CVE-2026-11191: Out of bounds memory access in ANGLE
    * CVE-2026-11192: Insufficient validation of untrusted input in Password Manager
    * CVE-2026-11193: Insufficient policy enforcement in Password Manager
    * CVE-2026-11194: Inappropriate implementation in Network
    * CVE-2026-11195: Inappropriate implementation in MHTML
    * CVE-2026-11196: Type Confusion in XML
    * CVE-2026-11197: Insufficient policy enforcement in Workers
    * CVE-2026-11198: Insufficient validation of untrusted input in Codecs
    * CVE-2026-11199: Insufficient validation of untrusted input in WebRTC
    * CVE-2026-11200: Inappropriate implementation in WebRTC
    * CVE-2026-11201: Use after free in ServiceWorker
    * CVE-2026-11202: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-11203: Policy bypass in GPU
    * CVE-2026-11204: Inappropriate implementation in Signin
    * CVE-2026-11205: Insufficient validation of untrusted input in Chrome for iOS
    * CVE-2026-11206: Policy bypass in ServiceWorker
    * CVE-2026-11207: Insufficient validation of untrusted input in Autofill
    * CVE-2026-11208: Use after free in Codecs
    * CVE-2026-11209: Insufficient policy enforcement in Passwords
    * CVE-2026-11210: Insufficient policy enforcement in Safe Browsing
    * CVE-2026-11211: Integer overflow in V8
    * CVE-2026-11212: Insufficient policy enforcement in DevTools
    * CVE-2026-11213: Insufficient validation of untrusted input in Reading Mode
    * CVE-2026-11214: Inappropriate implementation in Chrome for iOS
    * CVE-2026-11215: Inappropriate implementation in Cronet
    * CVE-2026-11216: Incorrect security UI in File Input
    * CVE-2026-11217: Insufficient policy enforcement in Fenced Frames
    * CVE-2026-11218: Inappropriate implementation in PlatformIntegration
    * CVE-2026-11219: Insufficient data validation in Navigation
    * CVE-2026-11220: Insufficient validation of untrusted input in Navigation
    * CVE-2026-11221: Insufficient validation of untrusted input in PointerLock
    * CVE-2026-11222: Incorrect security UI in Tab Strip
    * CVE-2026-11223: Insufficient validation of untrusted input in Network
    * CVE-2026-11224: Use after free in Chromoting
    * CVE-2026-11225: Incorrect security UI in WebUI
    * CVE-2026-11226: Insufficient policy enforcement in PreviewTab
    * CVE-2026-11227: Incorrect security UI in Tab Hover Cards
    * CVE-2026-11228: Incorrect security UI in File Input
    * CVE-2026-11229: Insufficient policy enforcement in Enterprise
    * CVE-2026-11230: Use after free in Extensions
    * CVE-2026-11231: Inappropriate implementation in Safe Browsing
    * CVE-2026-11232: Inappropriate implementation in TabGroups
    * CVE-2026-11233: Insufficient validation of untrusted input in FoldableAPIs
    * CVE-2026-11234: Insufficient policy enforcement in FoldableAPIs
    * CVE-2026-11235: Insufficient validation of untrusted input in Compositing
    * CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth
    * CVE-2026-11237: Insufficient validation of untrusted input in Media
    * CVE-2026-11238: Inappropriate implementation in DevTools
    * CVE-2026-11239: Insufficient validation of untrusted input in Extensions
    * CVE-2026-11240: Insufficient validation of untrusted input in Loader
    * CVE-2026-11241: Insufficient validation of untrusted input in Cast
    * CVE-2026-11242: Insufficient validation of untrusted input in Plugins
    * CVE-2026-11243: Incorrect security UI in Downloads
    * CVE-2026-11244: Insufficient validation of untrusted input in WebAuthentication
    * CVE-2026-11245: Inappropriate implementation in Payments
    * CVE-2026-11246: Insufficient validation of untrusted input in IndexedDB
    * CVE-2026-11247: Insufficient policy enforcement in CustomTabs
    * CVE-2026-11248: Policy bypass in Google Lens
    * CVE-2026-11249: Use after free in Network
    * CVE-2026-11250: Inappropriate implementation in DevTools
    * CVE-2026-11251: Insufficient validation of untrusted input in Password Manager
    * CVE-2026-11252: Policy bypass in Content Settings
    * CVE-2026-11253: Race in Permissions
    * CVE-2026-11254: Inappropriate implementation in Permissions
    * CVE-2026-11255: Insufficient validation of untrusted input in Storage Access API
    * CVE-2026-11256: Out of bounds read in GPU
    * CVE-2026-11257: Inappropriate implementation in Browser
    * CVE-2026-11258: Inappropriate implementation in File System Access
    * CVE-2026-11259: Insufficient validation of untrusted input in Cast
    * CVE-2026-11260: Policy bypass in Permissions
    * CVE-2026-11261: Insufficient validation of untrusted input in PDF
    * CVE-2026-11262: Use after free in TabStrip
    * CVE-2026-11263: Insufficient policy enforcement in WebAuthentication
    * CVE-2026-11264: Policy bypass in Content Security Policy
    * CVE-2026-11265: Insufficient data validation in Autofill
    * CVE-2026-11266: Policy bypass in SafeBrowsing
    * CVE-2026-11267: Insufficient policy enforcement in Extensions
    * CVE-2026-11268: Uninitialized Use in ANGLE
    * CVE-2026-11269: Inappropriate implementation in Extensions
    * CVE-2026-11270: Inappropriate implementation in UI
    * CVE-2026-11271: Incorrect security UI in Passwords
    * CVE-2026-11272: Insufficient validation of untrusted input in Reading List
    * CVE-2026-11273: Insufficient validation of untrusted input in Omnibox
    * CVE-2026-11274: Inappropriate implementation in DOM Distiller
    * CVE-2026-11275: Insufficient policy enforcement in Page Info
    * CVE-2026-11276: Inappropriate implementation in Cast
    * CVE-2026-11277: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-11278: Inappropriate implementation in CustomTabs
    * CVE-2026-11279: Out of bounds read in DevTools
    * CVE-2026-11280: Insufficient validation of untrusted input in Signin
    * CVE-2026-11281: Integer overflow in Chromoting
    * CVE-2026-11282: Policy bypass in Sandbox
    * CVE-2026-11283: Policy bypass in Shortcuts
    * CVE-2026-11284: Side-channel information leakage in PerformanceAPIs
    * CVE-2026-11285: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-11286: Insufficient validation of untrusted input in Wallet
    * CVE-2026-11287: Insufficient validation of untrusted input in Navigation
    * CVE-2026-11288: Policy bypass in CSS
    * CVE-2026-11289: Side-channel information leakage in Paint
    * CVE-2026-11290: Integer overflow in WebView
    * CVE-2026-11291: Policy bypass in Android Autofill
    * CVE-2026-11292: Policy bypass in Blink
    * CVE-2026-11293: Use after free in Input
    * CVE-2026-11294: Inappropriate implementation in Passwords
    * CVE-2026-11295: Inappropriate implementation in WebView
    * CVE-2026-11296: Inappropriate implementation in ImageCapture
    * CVE-2026-11297: Insufficient validation of untrusted input in Reader Mode
    * CVE-2026-11298: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-11299: Out of bounds read in Fonts
    * CVE-2026-11300: Inappropriate implementation in Permissions
    * CVE-2026-11301: Out of bounds read in LiveCaption
    * CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS
    * CVE-2026-11303: Use after free in PDFium
    * CVE-2026-11304: Use after free in PDFium
    * CVE-2026-11305: Use after free in PDFium
    * CVE-2026-11306: Use after free in PDFium
    * CVE-2026-11307: Use after free in PDFium
    * CVE-2026-11308: Inappropriate implementation in Extensions
    * CVE-2026-11309: Insufficient policy enforcement in History

++++ clFFT:

  - Spec cleanup:
    * Apply all patches unconditionally via %autosetup instead of
    arch/version-guarded %patch (conditional patch application is
    discouraged); both the CMake -m64/-m32 flag removal and the
    gcc rvalue-address fix are safe on every arch and compiler
    * Drop obsolete Group tags
    * Use %{?ext_man}

++++ cool-retro-term:

  - Update to version 2.0.0b2:
    * use working directory instead of home directory by default (#929)
    * feat: tab management shortcuts (#915)
    * Tentative fix for resize crash (#937)
    * Fix fullscreen menu not added on linux
    * Add missing lineSpacing setting to composeProfileObject() (#947)
    * Load fontName after fontSource in loadProfileString() (#948)
    * Replace workflows with a single one which is triggered on tags
    * Update qmltermwidget submodule

++++ cosmic-app-library:

  - Update to version 1.0.14:
    * i18n: translation updates from weblate
    * fix(context-menu): Cannot move applications to Library Home via right-click menu
    * fix(libcosmic): fork-exec fix for desktop entry spawning
    * chore: update libcosmic
    * feat: reorder groups
    * i18n: translation updates from weblate
    * build: update changelog to 1.0.12
    * chore: add zed editor LSP config
    * chore: apply rustfmt config and fix clippy lints
    * build: update MSRV to Rust 1.93
    * fix: support xpm icons
    * chore: update libcosmic to fix .ico, .xpm missing icons
    * chore: update libcosmic
    * Revert "chore: disable wgpu"

++++ cosmic-applets:

  - Update to version 1.0.14:
    * chore: update libcosmic
    * fix: search the theme path provided by the app to find status-area icons
    * i18n: translation updates from weblate
    * chore(deps): bump nmrs to 3.1.3
    * chore(deps): bump nmrs version to include patch
    * chore: bump `nmrs` version
    * feat(network): integrate nmrs for VPN, airplane mode, and secret agent Replace cosmic-settings-network-manager-subscription channel-based NetworkManager calls with direct nmrs API calls: - VPN list: nm.list_saved_connections() instead of hand-walking   NetworkManagerSettings over D-Bus. - VPN connect/disconnect: nm.connect_vpn_by_uuid / disconnect_vpn_by_uuid. - Forget Wi-Fi: nm.forget(&ssid). - Wi-Fi radio toggle: nm.set_wireless_enabled. - Airplane mode: nm.set_airplane_mode, dropping   cosmic-settings-airplane-mode-subscription. - Secret agent: nmrs::agent::SecretAgent registered per-popup,   replacing nm-secret-agent-manager. VPN secrets are replied via   responder.vpn_secrets(...); the applets own Authenticate flow still   drives Wi-Fi password handoff and releases NM with NoSecrets.
    * fix(process): prevent zombie shell processes
    * clippy
    * chore: release profile
    * chore(battery): update deps with fix
    * i18n: translation updates from weblate
    * chore: update all dependencies
    * debian: update changelog
    * chore: add zed editor config
    * chore: update libcosmic
    * chore: update MSRV to Rust 1.93
    * feat: use rich_text for notifications-applet
    * chore: cargo fmt
    * update libcosmic after reexports are removed
    * wip: update libcosmic

++++ cosmic-bg:

  - Update to version 1.0.14:
    * chore: add rustfmt config
    * chore: update dependencies
    * chore: remove unneeded files

++++ cosmic-comp:

  - Update to version 1.0.14:
    * i18n: translation updates from weblate
    * cursor: Add idle-hide timeout
    * fix: ignore configure requests from fullscreen windows
    * fix: fullscreen x11 games opening as floating/tiled windows
    * change a11y zoom easing function from EaseInOutCubic to Linear to avoid lagging mouse wheel scroll
    * revert self.update_zoom to update with wheel
    * kms: Try to re-open the device on permission errors after resume
    * kms: Fix surface drop_and_join
    * xwm: Reflect sticky state
    * xwm: Support sticky requests for unmapped windows
    * shell/element: Drop minimize/mapping X11 workaround
    * shell/element: Throttle X11 resizes as well via sync-req
    * chore: update smithay
    * chore: Update `smithay` with `Dispatch2`
    * fix(magnifier): smooth mouse wheel zoom and respect natural scroll direction
    * fix: restore snapped windows as snapped after maximize/minimize
    * fix: restore the window to where it was before the drag
    * (fix) Reject resize_request on surfaces which are already being resized
    * Unconstrain the IME popup when it appeared, resized, requested to repositioned
    * refactor: change PopupSurface args to PopupKind of position_popup_within_rect() paths
    * refactor: unify popup positioning logic for tiled layout into position_popup_within_rect()
    * refactor: extract positioning popups within global rect logic
    * refactor: make get_popup_toplevel() PopupKind agnostic
    * kms: Recreate graphics contexts on resume
    * kms: Wipe dpms state on resume
    * i18n: translation updates from weblate
    * Fix `clippy` lints
    * chore: Update smithay
    * image-copy: Don't panic if `ImageCaptureSourceKind` udata is undefined
    * chore: Update smithay
    * i18n: translation updates from weblate
    * i18n: translation updates from weblate
    * fix: Prevent system hang on double Caps Lock press
    * fix: consider SSD/tab height when calculating last server size
    * session: Make sure to mark the socket as CLOEXEC early

++++ cosmic-edit:

  - Update to version 1.0.14:
    * fix: update cosmic-files
    * fix: libcosmic updates
    * Epoch 1.0.14 version update
    * i18n: translation updates from weblate
    * Epoch 1.0.13 version update
    * Epoch 1.0.12 version update
    * i18n: translation updates from weblate
    * feat(ime): minimal IME support for the text_box widget (#539)
    * Epoch 1.0.11 version update

++++ cosmic-ext-dirstat:

  - Update to version 0.3.0:
    * Release 0.3.0
    * feat: Show scan progress & optimise implementation (#5)
    * Silence dead code warning on unused widget

++++ cosmic-ext-tasks:

  - Update to version 0.2.4:
    * v0.2.4
    * feat: add manual task sorting with drag-and-drop
    * feat: add reminder support with desktop notifications
    * Update Swedish translations
    * chore: update screenshots
    * v0.2.3
    * fix: remove hardcoded font sizes
    * fix: show list name in delete confirmation
    * feat: add persistent sorting
    * feat: make favorites nav item optional

++++ cosmic-ext-tweaks:

  - Update to version 0.2.2:
    * v0.2.2
    * chore: bump dependencies
    * Update app.desktop
    * Update metainfo.xml
    * add Ukrainian translation
    * Update strings in cosmic_ext_tweaks.ftl to Swedish
    * Update NIX packaging
    * i18n(zh-CN): Add simplified Chinese translation
    * i18n(cs): Update Czech translation
    * i18n: Fix GenericName capitalization & add some keywords
    * i18n: Remove dots from descriptions for consistency

++++ cosmic-files:

  - Update to version 1.0.14:
    * fix: cosmic-protocols
    * chore: fixes after libcosmic update
    * Epoch 1.0.14 version update
    * i18n: translation updates from weblate
    * Fix 24h time format in file dialog (#1812)
    * feat: add text preview for thumbnails and gallery
    * Epoch 1.0.13 version update
    * don't overwrite military time
    * fix(i18n): use separate 'rename' keys for menu and dialog confirm button
    * i18n: translation updates from weblate
    * fix: small grid file icons
    * fix: prefer SVG file icons
    * Epoch 1.0.12 version update
    * perf: reduce size of DialogPage enum by 1000 bytes
    * perf: use `Box` with `tab::Item` to reduce message size by 800 bytes
    * chore: add rust-toolchain to enforce 1.93
    * fix: remove match if let guards for Rust 1.93
    * fix(mime-app): handle no-path command exec
    * fix: %F and %U field code handling
    * fix: improve desktop entry field code handling
    * chore: add rustfmt config
    * chore: clippy
    * chore: update dependencies
    * Use existing clear-recents-history string
    * Add button to clear recents
    * Use name for network location if available
    * Fix windows compilation issues
    * Only use uzers on unix, do not fork on mac
    * Put libcosmic/desktop behind desktop feature
    * Refactor trash handling to improve portability
    * Epoch 1.0.11 version update
    * example(dialog): switch logger to fix build
    * fix: gate gio file copy fallback with gvfs feature
    * chore: use compio::fs::rename for quick renames
    * fix: do not generate thumbnail if file is being written
    * refactor: use select macro for gio copy futures
    * perf: avoid holding async mutex guards across await points
    * perf: use atomics for controller progress and state
    * perf: get image dimensions from background thread
    * chore: update Cargo.lock
    * fix: use gio file copy fallback to fix MTP unsupported I/O errors
    * chore: add methods to `Controller` to pause and unpause futures
    * chore: use tracing for structured logs
    * feat: select file name until the extension in rename and save dialog

++++ cosmic-icons:

  - Update to version 1.0.14:
    * Revert "chore: add jump action icons"
    * chore: add jump action icons
    * chore: add plugged-into-power-symbolic
    * chore: add view-actual-size-symbolic

++++ cosmic-launcher:

  - Update to version 1.0.14:
    * i18n: translation updates from weblate
    * chore: update all dependencies
    * chore: update debian changelog
    * chore: update libcosmic
    * chore: update MSRV to Rust 1.93
    * chore: add rustfmt config
    * chore: add zed editor config

++++ cosmic-notifications:

  - Update to version 1.0.14:
    * chore: remove data and i18n folders
    * chore: clippy
    * chore: update dependencies
    * improv: move notification fds to config

++++ cosmic-osd:

  - Update to version 1.0.14:
    * i18n: translation updates from weblate
    * improv(osd_indicator): use progress markers for volume indicator
    * fix: surface cleanup
    * fix: ensure no input is blocked by the osd indicator
    * fix: polkit agent not working with sockets Fixes that we purely rely on the SUID binary. The binary is not supported anymore since version 127.
    * i18n: translation updates from weblate
    * feat: new progress bar animations & min button width fix
    * chore: update libcosmic after reexports were removed (#187)

++++ cosmic-panel:

  - Update to version 1.0.14:
    * fix: lock
    * fix(layout): don't halve border_radius
    * chore(toolchain): add clippy and rustfmt
    * Smithay update (#602)
    * chore: update dependencies
    * chore: remove extra space from input region

++++ cosmic-player:

  - Update to version 1.0.14:
    * Fixes for new libcosmic
    * Epoch 1.0.14 version update
    * i18n: translation updates from weblate
    * Epoch 1.0.13 version update
    * i18n: translation updates from weblate
    * Translate desktop and metainfo with xdgen
    * feat: add skip forward and backward playback controls
    * Epoch 1.0.12 version update
    * chore: update dependencies
    * Epoch 1.0.11 version update

++++ cosmic-session:

  - Update to version 1.0.14:
    * fix(debian): seatd conflict causes Ctrl+C to kill the session
    * chore(rustfmt): change `imports_granularity` to `"Module"`
    * chore: update dependencies
    * chore: clippy
    * improv(main): use tokio signals for SIGINT and SIGTERM

++++ cosmic-store:

  - Update to version 1.0.14:
    * Epoch 1.0.14 version update
    * i18n: translation updates from weblate
    * backend: Add a rudimentary `rpm-ostree` backend
    * Epoch 1.0.13 version update
    * i18n: translation updates from weblate
    * Epoch 1.0.12 version update
    * fix: force cache update when checking for updates
    * chore: update dependencies
    * chore: clippy
    * refactor(packagekit): update `packagekit-zbus`
    * Epoch 1.0.11 version update

++++ cosmic-term:

  - Update to version 1.0.14:
    * fix: libcosmic updates
    * Epoch 1.0.14 version update
    * i18n: translation updates from weblate
    * Revert "bound the event channel to prevent unbounded RSS growth"
    * docs: explain backpressure rationale for PTY event channel in
    * chore: cargo fmt
    * bound the event channel to prevent unbounded RSS growth
    * Epoch 1.0.13 version update
    * i18n: translation updates from weblate
    * fix: clippy lint
    * fix: context menu by disabling IME when the widget has context menu
    * fix: menu doesn't show by unfocusing when clicking outside of the terminal_box
    * Specify the line height to the IME cursor height
    * Handle wide character widths by using glyph width to detect wide chars
    * Estimate preedit position without calling layout_runs()
    * Add minimal support CJK input method to terminal box excepts IME cursor positioning which is a bit tricky
    * Epoch 1.0.12 version update
    * fix: change zoom reset scope to active tab
    * Restrict /proc cwd lookup to Linux
    * Epoch 1.0.11 version update
    * fix: don't capture all mouse events
    * Fix binding to the pageup/pagedown keys
    * Adding translations to Spanish and Italian
    * New tab opens on current directory

++++ cosmic-workspaces:

  - Update to version 1.0.14:
    * i18n: translation updates from weblate
    * chore: add rust-toolchain to enforce 1.93
    * fix(size_cross_nth): get `max_cross` after constraining main
    * i18n: translation updates from weblate
    * chore: update all dependencies
    * chore: add zed editor config
    * chore: apply rustfmt config with module import granulatiry
    * chore: update libcosmic and MSRV

++++ crmsh:

  - Update to version 5.1.0+20260601.363253ce:
    * Fix: sbd: Compare SBD device UUID when adding SBD via sbd stage

++++ crossplane-cli:

  - Update to version 2.3.1:
    The v2.3.1 release is a patch release that updates the CLI's
    Crossplane dependencies to the latest v2.3.1 version. There are
    no other bug fixes and no behavioral changes in this release
    compared to v2.3.0.
    * deps: Bump Crossplane deps to v2.3.1
    * Add the LICENSE file

++++ ddcutil-service:

  - 1.0.15
  - C code cleanup, moved the embedded introspection XML to a file included at compile time.
  - Makefile cleanup, including installing the man pages.
  - Prevent unnecessary calls to glib debug logging.

++++ diffstat:

  - version update to 1.69
    + fixes for cppcheck and gcc 16 warnings.

++++ diskscan:

  - Modernize spec file:
    * Use %cmake_build instead of the deprecated %make_jobs
    * Pass -DCMAKE_POLICY_VERSION_MINIMUM=3.5 so the build keeps
    working under CMake 4+ (upstream still requires cmake < 3.5)

++++ diun:

  - Update to version 4.33.0:
    * Update CHANGELOG
    * treat configured scheduler as healthy during startup
    * expose a container healthcheck command
    * add Teams workflow webhook card support
    * support multiple Nomad namespaces
    * add Nomad provider e2e coverage
    * containerd: handle containerd task IDs in the provider
    * containerd provider support
    * fix mail notifications with strict SMTP relays
    * Add proxy support for HTTP notifiers
    * document global proxy configuration
    * preserve logrus fields in zerolog output
    * chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    * skip non-image artifacts during registry checks
    * ci(e2e): test non-image artifact
    * skip generated artifact tags during registry checks

++++ djvulibre:

  - version update to 3.5.30
    * fix CVE-2021-46312 [bsc#1214672]
  - deleted patches
    * djvulibre-CVE-2021-46312.patch (upstreamed)

++++ exfatprogs:

  - Update to 1.4.1:
    * exfatprogs: include missing DOS attribute headers and upcase
    helper files in release tarballs.
  - Update to 1.4.0:
    Features:
    * mkfs.exfat: add partition table creation support so
    newly formatted devices are recognized by Windows.
    * fsck.exfat: add "--put-mbr" and "--clear-mbr"
    options to add or remove partition table entries for
    Windows compatibility on existing volumes.
    * mkfs.exfat: add the "--upcase" option to format with
    a user-supplied upcase table.
    * exfatprogs: add example upcase tables and a helper
    script to generate upcase table binaries for testing.
    * exfatprogs: add chdosattr and lsdosattr utilities to
    view and modify DOS file attributes.
    Changes:
    * mkfs.exfat: detect foreign filesystems and partition
    tables before formatting, requiring "-F" for
    interactive overwrite of non-exFAT volumes.
    * mkfs.exfat: always clear the first 0x10000 bytes and
    improve zero-out I/O, verification, and progress logs
    during formatting.
    * mkfs.exfat: reduce memory usage when formatting very
    large devices.
    * exfatprogs: include the release date in version output.
    * mkfs.exfat: print the volume UUID after formatting,
    warn when the "-s" option is used, and default to
    512-byte clusters on very small devices.
    * exfatprogs: recover from short read/write completions
    during I/O operations.
    * exfatprogs: refuse to run on pre-2.6 Linux kernels.
    Bug fixes:
    * fsck.exfat: fix bitmap bit counting sign extension and
    handle progress bar overflow on corrupted bitmaps.
    * mkfs.exfat: fix 32-bit overflow issues that could
    select a wrong cluster size or fail with "-f".
    * mkfs.exfat: reject invalid zero or overflowing size
    arguments and correct the total cluster limit for
    edge-case large volumes.
    * mkfs.exfat: fix incorrect volume UUID printing and
    use safer direct I/O for write verification.
    * exfatprogs: fix 64-bit LBA sector I/O, integer
    signedness issues, and memory errors reported by
    valgrind in several utilities.

++++ fanficfare:

  - Update to the version 4.58.0:
  - adapter_ficbooknet: Fixes for site changes.
  - Add retry_failedtoload_images option
  - PI: Don't throw notifications when doing show_message()
  - PI: INI Snippets
  - PI: Prefill Add Reject URLs dialog from clipboard and allow
    ctrl-enter
  - Add OTW story note labels config #1347
  - Improve continue_on_chapter_error_try_limit exceeded
    reporting
  - Chrome browsercache_sqldb added, but cannot read cache while
    browser is open. See #1341
    <https://github.com/JimmXinu/FanFicFare/issues/1341>
  - adapter_fanficauthorsnet: Domains changed from .nsns to -nsns
  - Include genre/category in defaults.ini when include_in_X for
    extragenres/extracategories

++++ file:

  - Add patch file-5.47-stanza.patch (boo#1261558 partly)
    * Avoid many false positive on windows file test

++++ flawfinder:

  - Update to 2.0.20:
    * Strip leading ./ from SARIF artifact URIs for uriBaseId portability

++++ fritzing:

  - Fix build with quazip >= 1.7.0 (adding Qt6 core5compat manually,
    because it is missing in the quazip .pc file)

++++ ghc-citeproc:

  - Update citeproc to version 0.13.0.1.
    [#]# 0.13.0.1
    * Detect terminal punctuation hidden by closing quotes (#179,
    Andrew Dunning).
    * Clarify building executable in the README (#177).
    [#]# 0.13
    * Add `citationResetPosition` field to `Citation`. [API change]
    When this field is set, it causes the processor to forget all
    information about past citations.  This affects processing of
    `position`.  The intended usage is to set this for the first
    citation of every chapter, so that "subsequent" behavior is
    reset at chapter boundaries. See #160 for discussion.

++++ ghc-pandoc-types:

  - Update pandoc-types to version 1.23.1.2.
    [1.23.1.2]
    * Bump upper bound for QuickCheck.
    * Remove obsolete semigroups clause for ghc < 8.
    * Allow aeson 2.3 (Francesco Gazzetta).
    * CI: remove ghc 8.10 from testing
    * Use lts-26 in stack.yaml.
    * Set minimum base version 4.15.

++++ texmath:

  - Update texmath to version 0.13.1.2.
    texmath (0.13.1.2)
    * Typst writer: Avoid using deprecated symbols (#287).
    This requires depending on typst-symbols 0.2.*.
    texmath (0.13.1.1)
    * Typst writer: don't add extra spaces around `|` or escaped
    symbols (#286).
    texmath (0.13.1)
    * MathML writer: Keep mathvariant attribute in addition to finding
    unicode substitutes (#280). Previously, renderers didn't support
    mathvariant consistently, so we omitted this attribute. Tested in
    Safari, Firefox, and Chrome.
    * OMML writer: properly handle bold/italics on identifiers (#280).
    Identifiers marked as bold need to be marked as bold-italic.
    Special exception for uppercase Greek.
    * MathML writer: fix handling of italic (#280).
    * OMML reader: handle w:ins elements in math (#278).
    Previously we skipped these, which meant that content
    would disappear.
    * TeX reader: handle space commands in `\text{..}` (#277).
    * TeX reader: Allow text operators to take an unbracketed argument (#276).

++++ ghc-typst:

  - Update typst to version 0.10.
    [#]# 0.10
    * Add --input option to cli for passing key-value pairs to the
    evaluator (as can be done with `typst`).
    * Use optparse-applicative for CLI option parsing.
    * Add `inputs` parameter to `evalTypst`.
    * Remove `sysModule` from `Module.Standard` [API change].
    We now generate `sys` in `initialEvalState`, since only then
    do we know the inputs.
    * Properly locate package root for imports (#98).
    We need to go up the directory hierarchy til we find typst.toml.
    * Use released version of typst-symbols-0.2 with new typst-symbols API.
    * app/Main: remove unused options.
    [#]# 0.9.0.1
    * Fix typo that caused close single quote to be parsed as double
    (jgm/pandoc#11463).
    * Change name of positional param for bibliography to 'sources'.
    (From 'source'). Per typst documentation.
    * Fix upper bound for base (< not <=).
    [#]# 0.9
    * Tweak parsing of list items and headings to match Typst more closely
    (#92, #58, #90, #92, Norbert Pozar).
  - Handles trivia (whitespace, comments) as Typst (see #92).
  - Replaces `stLineStartCol` by `stAtStart`: `stAtStart` is set to `True`
    after an end of line, at the beginning of content or at the beginning
    of a list item (since list items can be nested), and set to `False`
    after any non-trivia markup. This appears simpler and more robust,
    especially after comments.
  - Removes `stIndent` state.
    Indented block is handled completely in `pIndented` parser and does
    not rely on `stIndent` state.
    * Support `func()` for content elements in submodules (math etc.)
    (#57, #95, Norbert Pozar). `func()` method now element names with
    multiple fragements like `math.attach`.
    * Match raw block handling of Typst 0.14 (#94, Norbert Pozar).
    This commit should produce the same result.
  - Automatically dedent raw text based on the shortest indent of the raw
    code. In particular, do not use `stIndent` for this since Typst does not
    dedent the code based on the indentation of the containing list item.
  - Accept any identifier-like language tags.
  - Strip the last line if it is only whitespace.
  - If the last line's nonwhitespace chars ends with `, strip one
    space from the end.
    * Tweak comment parsing to match Typst (#93, Norbert Pozar).
  - Line comments inside block comments are not parsed as line comments
    anymore (partially addresses #90).
  - Block comments do not need to be closed by */ and can be active until
    the end of file (partially addresses #90).
  - Error is properly reported when unmatched */ appears instead of
    misparsing this as a beginning of strong elem.
  - Stop line comments from eating the end of line character
    This is important for correctly issuing parbreaks and spaces that
    follow line comments and a preparation for simpler handling of indented
    blocks.
    * Hide `#let test..` definition from test parse output (Norbert Pozar).
    After this change the test function `#let test(...` is only injected
    at evaluation and its parsed AST no longer appears in `.out` files.
    Other advantages:
  - Source locations match the input file.
  - Future changes to AST will not show up in every output.
  - Easier to read test output.
  - 5% faster test run (5s -> 4.75s)
    * Simpler tracking of bracket nesting in markup (Norbert Pozar, #86).
    Keep the count of unclosed brackets in `PState` instead of using a
    `between` parser to prevent exponential parsing time due to backtracing.
    * Improve handling of control flow statements at loop block boundaries
    (Norbert Pozar).
  - `break` and `continue` now only affect the innermost `for` and `while`
    loop by resetting `evalFlowDirective` at the loop end.
  - `return` now returns even when used inside a loop: it stops the loop the
    same way `break` does but its state is not reset at the end of the
    loop so propagates up to the function boundary.
    * `array.join()`: do not prepend separator for length 1 arrays (Norbert
    Pozar). Separator is now only inserted when the array has at least 2
    elements.
    * Support nested destructuring binds and expressions in LHS of assignments
    (Norbert Pozar).
    * Parse (..expr) as Array (Norbert Pozar, #47).
    Trailing comma is not required in an array expression with single spread
    operator. Also spreads `none`.
    * Support nested destructuring (Norbert Pozar).
    Typst supports nesting of destructuring binds both in array
    destructuring `(_, (_, _), _)` and dictionary destructuring
    `(x: (_, _), y)`. This commit adds support for such nested
    destructuring of arbitrary depth.
    Changes AST for `BindPart` to allow for recursion [API change].
  - `Simple (Maybe Identifier)` -> `Simple Bind`
  - `WithKey Identifier (Maybe Identifier)` -> `WithKey Identifier Bind`
    It also disallows "unnamed patterns" when destructuring from a
    dictionary (to match Typst behavior):
    ```typst
    [#]let (_, x) = (x: 1, y: 1)
    //    ^ unnamed
    [#]let ((a, b), x) = (x: 1, y: 1)
    //    ^^^^^^ unnamed
    ```

++++ ghc-typst-symbols:

  - Update typst-symbols to version 0.2.
    [#]# 0.2
    * Reorganize API (breaking API change). Now we only export one
    module, `Typst.Symbols`. This contains `typstSymbols`,
    `typstEmojis`, and `mathSymbolShorthands`, as well as types
    `Sym` and `MathClass`. `typstSymbols` and `typstEmojis` are no
    longer lists of tuples. Instead, they are lists of `Sym`
    records, which now include deprecation and math symbol class
    information. `scrape-symbols.hs` has been changed tot generate
    the new API. See jgm/texmath#288 for motivation.

++++ git-annex:

  - Update git-annex to version 10.20260601.
    git-annex (10.20260601) upstream; urgency=medium
    * Avoid an error message displaying a password embedded in a git remote url.
    (Reversion introduced in 10.20260421)
    * Fix use of annex.commitmessage
    (Reversion introduced in 10.20250115)
    * disableremote: Avoid (temporarily) clearing size tracking information
    for other repos than the one being disabled.
    * Fix bug that prevented remote.name.annex-web-options from always taking
    effect, and sometimes caused it to be used in situations where it
    should not be.
    * map: Don't try to use dot -Tx11 to display the map, that no longer
    works in commonly available builds of graphviz.
    * push: Avoid updating a view branch or adjusted branch.
    * pull: Avoid propagating adjusted branch changes to the original branch.
    * get, copy: Added --wanted option, which only transfers files
    that are preferred content.
    * fsck, drop, whereis: Support --failed option.
    * Display an introduction before other debug output.
  - - Joey Hess <id@joeyh.name>  Mon, 01 Jun 2026 11:53:04 -0400
    git-annex (10.20260525) upstream; urgency=medium
    * Fix reversion introduced in 10.20260421 that caused commands
    like git-annex copy to stop early due to SIGPIPE.
    * p2phttp: Avoid hanging after HEAD request.
  - - Joey Hess <id@joeyh.name>  Tue, 26 May 2026 07:49:42 -0400
    git-annex (10.20260520) upstream; urgency=medium
    * Behavior change: git-annex sync now defaults to syncing content,
    for consistency with push and pull. However, to avoid surprising
    behavior, this only affects repositories that have preferred content
    configured.
    (Use --no-content or configure annex.synccontent to avoid this.)
    * Behavior change to git-annex pull and push's handling of unwanted
    files. While previously both commands dropped unwanted files from
    both the remote and the local repository, now pull only drops unwanted
    files from the local repository, and push only drops unwanted files
    from the remote.
    * info: Report the total size of unused keys found by the last run
    of git-annex unused.
    * push: When pushing to a bare git repository, display git push
    progress before the display of pushed branches.
    * push, pull, assist: Fix behavior of --content to override the
    annex.synccontent configuration.
    * Send git-annex (or other configured) User-Agent when connecting to
    annex+http remotes.
    * Support GIT_SSL_CAINFO, GIT_SSL_CAPATH, http.sslCAPath, and http.sslCAPath
    when connecting to https servers.
    * Linux standalone builds now bundle CA certs. They are used only when
    the system does not have its own CA cert store.
    * Linux standalone build supports using Fedora's CA cert store location.
  - - Joey Hess <id@joeyh.name>  Wed, 20 May 2026 09:16:07 -0400
    git-annex (10.20260421) upstream; urgency=medium
    * disableremote: New command.
    * Fix annexUrl to inherit any password that is set in the remote url.
    * Add DELEGATE extension to the external special remote protocol.
    * Avoid dying of an exception when when stdout gets closed by eg head(1),
    and avoid a crash loop when stderr is closed and git-annex dies of an
    exception.
    Fixes reversion introduced in version 10.20230407.
    * Improve UUID sanitization.
    * Deal with breaking changes to test concurrency in tasty-1.5.4.
  - - Joey Hess <id@joeyh.name>  Tue, 21 Apr 2026 14:39:56 -0400
    git-annex (10.20260316) upstream; urgency=medium
    * Added CHECKPRESENT-URL extension to the external special remote protocol.
    * Fix reversion in previous version that caused auto-initializing of
    local git remotes that have annex-ignore set.
    * Fix bug that caused git credential to be rejected when a http request
    failed for some reason other than 401.
    * Importing from the directory special remote will no longer add sizes
    to keys, which overrode backends that generate unsized keys.
    * Fix retrival from http git remotes of keys with '%' in their names.
    * Fix behavior when initremote is used with --sameas=
    combined with --private.
    * web, S3, git: Fix bugs in checking if content is present on a remote
    when configuration does not allow accessing it.
    * httpalso: Fix bugs in handling content not being present on the remote.
    * adb: Avoid deleting contents of a non-empty directory when
    removing the last exported file from the directory.
    * Improve display of http exceptions.
  - - Joey Hess <id@joeyh.name>  Mon, 16 Mar 2026 06:53:22 -0400
    git-annex (10.20260213) upstream; urgency=medium
    * When used with git forges that allow Push to Create, the remote's
    annex-uuid is re-probed after the initial push.
    * addurl, importfeed: Enable --verifiable by default.
    * fromkey, registerurl: When passed an url, generate a VURL key.
    * unregisterurl: Unregister both VURL and URL keys.
    * Fix behavior of local git remotes that have annex-ignore
    set to be the same as ssh git remotes.
    * Added annex.security.allow-insecure-https config, which allows
    using old http servers that use TLS 1.2 without Extended Main
    Secret support.
    * p2phttp: Commit git-annex branch changes promptly.
    * p2phttp: Fix a server stall by disabling warp's slowloris attack
    prevention.
    * p2phttp: Added --cpus option.
    * Avoid ever starting more capabilities than the number of cpus.
    * fsck: Support repairing a corrupted file in a versioned S3 remote.
    * Fix incorrect transfer direction in remote transfer log when
    downloading from a local git remote.
    * Fix bug that prevented 2 clones of a local git remote
    from concurrently downloading the same file.
    * rsync: Avoid deleting contents of a non-empty directory when
    removing the last exported file from the directory.
    * unregisterurl: Fix display of action to not be "registerurl".
    * The OsPath build flag requires file-io 0.2.0, which fixes several
    issues.
    * Remove deprecated commands direct, indirect, proxy, and transferkeys.
    * Deprecate undo command.
    * Remove undo action from kde and nautilus integrations.
    * Fix build on BSDs. Thanks, Greg Steuck
  - - Joey Hess <id@joeyh.name>  Fri, 13 Feb 2026 12:53:48 -0400

++++ git-bug:

  - CVE-2026-39827: An authenticated SSH client that repeatedly
    opened channels which were rejected by the server caused
    unbounded memory growth, eventually crashing the server process
    and affecting all connected users. Rejected channels are now
    properly removed from the connection's internal state and
    released for garbage collection. (bsc#1266174, GO-2026-5016)
  - CVE-2026-39834: When writing data larger than 4GB in a single
    Write call on an SSH channel, an integer overflow in the
    internal payload size calculation caused the write loop to spin
    indefinitely, sending empty packets without making progress.
    The size comparison now uses int64 to prevent truncation.
    (bsc#1266174, GO-2026-5020)
  - CVE-2026-39828: When an SSH server authentication callback
    returned PartialSuccessError with non-nil Permissions, those
    permissions were silently discarded, potentially dropping
    certificate restrictions such as force-command after a second
    factor succeeded. Returning non-nil Permissions with
    PartialSuccessError now results in a connection error.
    (bsc#1266174, GO-2026-5014)
  - CVE-2026-39829: The RSA and DSA public key parsers did not
    enforce size limits on key parameters. A crafted public key
    with an excessively large modulus or DSA parameter could cause
    several minutes of CPU consumption during signature
    verification. This could be triggered by unauthenticated
    clients during public key authentication. RSA moduli are now
    limited to 8192 bits, and DSA parameters are validated per FIPS
    186-2. (bsc#1266174, GO-2026-5018)
  - CVE-2026-39831: The Verify() method for FIDO/U2F security key
    types (sk-ecdsa-sha2-nistp256@openssh.com,
    sk-ssh-ed25519@openssh.com) did not check the User Presence
    flag. Signatures generated without physical touch were
    accepted, allowing unattended use of a hardware security key.
    To restore the previous behavior, return a "no-touch-required"
    extension in Permissions.Extensions from PublicKeyCallback.
    (bsc#1266174, GO-2026-5019)
  - CVE-2026-42508: Previously, a revoked 'SignatureKey' belonging
    to a CA was not correctly checked for revocation. Now, both the
    'key' and 'key.SignatureKey' are checked for @revoked.
    (bsc#1266174, GO-2026-5021)
  - CVE-2026-39833: The in-memory keyring returned by NewKeyring()
    silently accepted keys with the ConfirmBeforeUse constraint but
    never enforced it. The key would sign without any confirmation
    prompt, with no indication to the caller that the constraint
    was not in effect. NewKeyring() now returns an error when
    unsupported constraints are requested. (bsc#1266174,
    GO-2026-5005)
  - CVE-2026-39830: A malicious SSH peer could send unsolicited
    global request responses to fill an internal buffer, blocking
    the connection's read loop. The blocked goroutine could not be
    released by calling Close(), resulting in a resource leak per
    connection. Unsolicited global responses are now discarded.
    (bsc#1266174, GO-2026-5017)
  - CVE-2026-39832: When adding a key to a remote agent constraint
    extensions such as restrict-destination-v00@openssh.com were
    not serialized in the request. Destination restrictions were
    silently stripped when forwarding keys, allowing unrestricted
    use of the key on the remote host. The client now serializes
    all constraint extensions. Additionally, the in-memory keyring
    returned by NewKeyring() now rejects keys with unsupported
    constraint extensions instead of silently ignoring them.
    (bsc#1266174, GO-2026-5006)
  - CVE-2026-46597: An incorrectly placed cast from bytes to int
    allowed for server-side panic in the AES-GCM packet decoder for
    well-crafted inputs. (bsc#1266174, GO-2026-5013)
  - CVE-2026-46598: For certain crafted inputs,
    a 'ed25519.PrivateKey' was created by casting malformed wire
    bytes, leading to a panic when used. (bsc#1266174,
    GO-2026-5033)
  - CVE-2026-46595: Previously, CVE-2024-45337 fixed an
    authorization bypass for misused ssh server configurations; if
    any other type of callback is passed other than public key,
    then the source-address validation would be skipped.
    (bsc#1266174, GO-2026-5023)
  - CVE-2026-39835: SSH servers which use CertChecker as a public
    key callback without setting IsUserAuthority or IsHostAuthority
    could be caused to panic by a client presenting a certificate.
    CertChecker now returns an error instead of panicking when
    these callbacks are nil. (bsc#1266174, GO-2026-5015)
  - CVE-2026-25680: Parsing arbitrary HTML can consume excessive
    CPU time, possibly leading to denial of service. (bsc#1267196,
    GO-2026-5028).
  - CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506:
    Parsing arbitrary HTML which is then rendered using Render can
    result in an unexpected HTML tree. This can be leveraged to
    execute XSS attacks in applications that attempt to sanitize
    input HTML before rendering. (bsc#1267157, GO-2026-5029,
    GO-2026-5030, GO-2026-5027, GO-2026-5025)
  - Revendoring to golang.org/x/crypto@v0.52.0,
    golang.org/x/crypto/ssh/agent@v0.52.0, and
    golang.org/x/net@v0.55.0

++++ git-credential-keepassxc:

  - Update to 0.14.3:
    * Dependency bumps

++++ glpk:

  - Spec cleanup:
    * Add the explicit gcc and make BuildRequires
    * Convert libiodbc-devel and libmariadb-devel to their
    pkgconfig() form
    * List the installed header explicitly instead of globbing
    %{_includedir}
    * Drop obsolete Group tags and redundant V=1 from %make_build

++++ gnome-commander:

  - Update to version 2.0.2:
    + This release fixes the following bugs:
  - The Copy button in the Copy File dialog wasn’t set as the
    default action
  - Glitches displaying free space of the current volume
  - Double-clicking tab area created a new tab but didn’t keep
    the selected file
  - Switching tabs didn’t reset Quick Filter
  - Incorrect logic determining when directory monitoring should
    be stopped

++++ go-passbolt-cli:

  - Update to version 0.4.2:
    * PB-50036 - Go: Create pre commit hooks
    * PB-50035 - Go: Add linting to ci
    * Update go SDK
    * PB-49956 - Go: add golangci lint
    * PB-49603 - Go-cli re-enable staticcheck rules
    * PB-47870 - Redesign go cli release workflow
    * PB-49163 - Go-CLI: Fix session key persistence
    * PB-49161 - Update go dependencies
    * PB-49162 - Go-cli : Fix context cancellation leak
    * PB-48435 - Go-cli - Fix delete error user
    * PB-48434 - Go-cli - Fix delete error group
    * PB-48433 - Go-cli - Fix delete error folder
    * Bump go sdk to 95e6a762aa5f183b5193c89da0bb6761ee0d6b63
    * Catch unknown resource type error
    * Bump go-passbolt to v0.7.3-0.20251223164903-d05eecccd555
    * Use correct value for folder update cobra command Use "folder" instead of "resource".
    * Add Worker Flag
    * Add get folder permisson subcommand
    * Pin go-passbolt to correct version
    * Remove ContainResourceType true, and improve CEL filtering
    * Add save session key util
    * Enable parallel resource decryption using thread-safe SDK
    * fix method names
    * fix error messages
    * update help for list comands
    * refactor folder list
    * refactor group list
    * refactor user list; add json column filter
    * simple refactor, split into several methods
    * add column filter into json output
    * fix assign error from delete resource
    * Fix Packaging Status README.md
    * Add HTTP proxy support via standard environment variables
    * Update go-passbolt, fixes updating shared v5 resources
    * cli: add --expiry (RFC3339/duration), support 'none' to clear (#89)
    * Improve spelling, formatting and readability of the main README
    * Correct KeePass spelling
    * Typo (#88)
    * Update go-passbolt (#85)
    * Make export work with v5 (#84)
    * Update go-passbolt
    * v5 Fix Resource Listing (#82)
    * Update go-passbolt for v5
    * Display Prompts on STDERR (#70)
    * Update go-passbolt and other deps (#71)
    * Feature: adding support for exposing secrets to subprocesses (#68)
    * Added flags for passing client cert and client private key as file contents instead of paths
    * Added File suffix on tlsClient command flags
    * Removed hardcoded paths and fixed typo
    * Added support for http client configuration via command arguments
    * Adds permission subcommand to get a list of permissions of a resource
    * Update deps, fix import changes, update go-passbolt for mfa fix
    * Update README.md Install Section
    * rename go-passbolt-cli -> passbolt in README

++++ google-guest-agent:

  - Update to version 20260529.00
    * Dependency updates (#616) (bsc#1266603, CVE-2026-39821)
    (bsc#1266171, CVE-2026-39827, CVE-2026-39834, CVE-2026-39828,
    CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833,
    CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598,
    CVE-2026-46595, CVE-2026-39835)
  - from version 20260522.00
    * Fix improper umask calculation on socket creation (#614)
  - from version 20260520.01
    * Update OWNERS (#609)

++++ grub2:

  - Fix build with GCC 16
    * gcc16.patch
    * 0001-add-support-for-UEFI-network-protocols.patch

++++ hyperfine:

  - 1.20.0 requires rust 1.88
  - build on all architectures

++++ ibus-typing-booster:

  - Update to 2.30.9
  - More fine grained control of whether digits can be used in the preedit
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/905)
  - Translation update from Weblate (new: ca 100%, el 29.6%, es 100%)

++++ ip2unix:

  - update to 2.2.2
  - Fixed
  - Out of range string_view access in globpath. Thanks to Adam Mizerski.
  - Typo in README and manpage.
  - Invalid use of PROVIDE in linker script.
  - reject rule not working with sendto/sendmsg.
  - Bug in accept if stdin was closed and accept would return FD 0.
  - Broken abstract socket support if used with from-abstract.
  - Race condition if the program uses library calls wrapped by ip2unix before
    initialisation was done.
  - removed patch ip2unix-2.2.1-fix_out_of_range_string_view_access.patch
    (applied upstream)
  - reenable all tests

++++ libirman:

  - Spec cleanup:
    * Add the explicit gcc and make BuildRequires
    * Build the config-only irman-common subpackage as noarch
    * Use %autosetup

++++ itpp:

  - Fix build with current googletest (which now requires C++17):
    * Build with the C++17 standard instead of C++14 (renamed
    itpp-limit-gcc-standard.patch to itpp-set-cxx17-standard.patch)
    * Add itpp-cxx17-any-ambiguity.patch to qualify itpp::any() in
    the test suite so it no longer clashes with std::any
  - Spec cleanup:
    * Apply all patches unconditionally via %autopatch instead of
    a suse_version-guarded %patch (conditional patch application
    is discouraged)
    * Drop obsolete Group tags and use the https project URL

++++ iucode-tool:

  - Spec cleanup:
    * Use %autosetup and %make_build
    * Add the explicit gcc and make BuildRequires
    * Drop obsolete Group tag

++++ iw:

  - Add the explicit gcc and make BuildRequires

++++ kakoune:

  - Update to 2026.05.21:
    * Support the \N escape sequence in regex (like in PCRE, matches [^\n]).
    * enter-user-mode support the -count and -register switches to forward
    those parameters to the underlying normal mode
    * arrange-buffers -back switch to arrange provided buffers to the back of
    the buffer list
    * Some bug and portability fixes reported since latest release

++++ kernel-default:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-source:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-source-longterm:

  - Refresh
    patches.kernel.org/6.18.34-252-net-ethernet-cortina-Carry-over-frag-counter.patch.
  - commit ea685f4
  - Linux 6.18.34 (bsc#1258210).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1258210).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1258210).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1258210).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1258210).
  - io_uring/nop: pass all errors to userspace (bsc#1258210).
  - net: gro: don't merge zcopy skbs (bsc#1258210).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1258210).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1258210).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1258210).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1258210).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1258210).
  - selftests: net: Fix checksums in xdp_native (bsc#1258210).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1258210).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1258210).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1258210).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1258210).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1258210).
  - gpio: aggregator: fix a potential use-after-free (bsc#1258210).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1258210).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1258210).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1258210).
  - net: ag71xx: check error for platform_get_irq (bsc#1258210).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1258210).
  - net: shaper: rework the VALID marking (again) (bsc#1258210).
  - net: shaper: annotate the data races (bsc#1258210).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1258210).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1258210).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1258210).
  - tracing: Avoid NULL return from hist_field_name() on truncation
    (bsc#1258210).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1258210).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1258210).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1258210).
  - wifi: mac80211: fix MLE defragmentation (bsc#1258210).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1258210).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1258210).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1258210).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1258210).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1258210).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1258210).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1258210).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1258210).
  - net: bridge: Flush multicast groups when snooping is disabled
    (bsc#1258210).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1258210).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1258210).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1258210).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1258210).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1258210).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1258210).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1258210).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1258210).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1258210).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1258210).
  - igc: set tx buffer type for SMD frames (bsc#1258210).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1258210).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1258210).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1258210).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1258210).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1258210).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1258210).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1258210).
  - drm/xe/vf: Fix signature of print functions (bsc#1258210).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1258210).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1258210).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1258210).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1258210).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1258210).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1258210).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1258210).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1258210).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1258210).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1258210).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1258210).
  - btrfs: fix squota accounting during enable generation
    (bsc#1258210).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1258210).
  - btrfs: relax squota parent qgroup deletion rule (bsc#1258210).
  - btrfs: check squota parent usage on membership change
    (bsc#1258210).
  - btrfs: remaining BTRFS_PATH_AUTO_FREE conversions (bsc#1258210).
  - btrfs: don't search back for dir inode item in INO_LOOKUP_USER
    (bsc#1258210).
  - btrfs: use the key format macros when printing keys
    (bsc#1258210).
  - btrfs: add macros to facilitate printing of keys (bsc#1258210).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1258210).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1258210).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1258210).
  - ASoC: codecs: fs210x: fix possible buffer overflow (bsc#1258210).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1258210).
  - net/mlx5: Do not restore destination-less TC rules (bsc#1258210).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1258210).
  - ovpn: disable BHs when updating device stats (bsc#1258210).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1258210).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1258210).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1258210).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1258210).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1258210).
  - net: phy: DP83TC811: add reading of abilities (bsc#1258210).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1258210).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1258210).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1258210).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1258210).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1258210).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1258210).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1258210).
  - x86/mce: Restore MCA polling interval halving (bsc#1258210).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1258210).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1258210).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1258210).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1258210).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1258210).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1258210).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1258210).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1258210).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1258210).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1258210).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1258210).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1258210).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1258210).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1258210).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1258210).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1258210).
  - net: shaper: flip the polarity of the valid flag (bsc#1258210).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1258210).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1258210).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1258210).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    (bsc#1258210).
  - net: ethernet: cortina: Carry over frag counter (bsc#1258210).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1258210).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1258210).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1258210).
  - netfs: Fix netfs_read_folio() to wait on writeback (bsc#1258210).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1258210).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1258210).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1258210).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1258210).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1258210).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1258210).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1258210).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1258210).
  - netfs: Fix streaming write being overwritten (bsc#1258210).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1258210).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1258210).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1258210).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1258210).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1258210).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1258210).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1258210).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1258210).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1258210).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1258210).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1258210).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1258210).
  - nvme: fix bio leak on mapping failure (bsc#1258210).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1258210).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1258210).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1258210).
  - irqchip/ath79-cpu: Remove unused function (bsc#1258210).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1258210).
  - fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
    (bsc#1258210).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1258210).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1258210).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1258210).
  - NFSD: Fix infinite loop in layout state revocation (bsc#1258210).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1258210).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1258210).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1258210).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1258210).
  - ice: fix setting RSS VSI hash for E830 (bsc#1258210).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1258210).
  - net: shaper: Reject reparenting of existing nodes (bsc#1258210).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1258210).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1258210).
  - test_kprobes: clear kprobes between test runs (bsc#1258210).
  - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
    (bsc#1258210).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1258210).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1258210).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1258210).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1258210).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1258210).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1258210).
  - netfilter: x_tables: unregister the templates first
    (bsc#1258210).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1258210).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1258210).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1258210).
  - ARM: integrator: Fix early initialization (bsc#1258210).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1258210).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1258210).
  - firmware: arm_ffa: Align RxTx buffer size before mapping
    (bsc#1258210).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1258210).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1258210).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1258210).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1258210).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1258210).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1258210).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1258210).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
    (bsc#1258210).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1258210).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1258210).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1258210).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1258210).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1258210).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1258210).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1258210).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1258210).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1258210).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1258210).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells (bsc#1258210).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1258210).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1258210).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1258210).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1258210).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1258210).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1258210).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1258210).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1258210).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1258210).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1258210).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1258210).
  - batman-adv: tt: prevent TVLV entry number overflow (bsc#1258210).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1258210).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1258210).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1258210).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1258210).
  - batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1258210).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1258210).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1258210).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1258210).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1258210).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1258210).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1258210).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1258210).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1258210).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1258210).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1258210).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1258210).
  - batman-adv: dat: handle forward allocation error (bsc#1258210).
  - batman-adv: clear current gateway during teardown (bsc#1258210).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1258210).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1258210).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1258210).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1258210).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1258210).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1258210).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1258210).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1258210).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1258210).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1258210).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1258210).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1258210).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1258210).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1258210).
  - drm/msm: Fix shrinker deadlock (bsc#1258210).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1258210).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1258210).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1258210).
  - fwctl: pds: Validate RPC input size before parsing (bsc#1258210).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1258210).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1258210).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1258210).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1258210).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1258210).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1258210).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1258210).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1258210).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1258210).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1258210).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1258210).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1258210).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1258210).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1258210).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1258210).
  - cifs: Fix busy dentry used after unmounting (bsc#1258210).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1258210).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1258210).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1258210).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1258210).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1258210).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1258210).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1258210).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1258210).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1258210).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1258210).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1258210).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1258210).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1258210).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1258210).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1258210).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1258210).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1258210).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1258210).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1258210).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1258210).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1258210).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1258210).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1258210).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1258210).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1258210).
  - fs/ntfs3: handle attr_set_size() errors when truncating files
    (bsc#1258210).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1258210).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1258210).
  - cgroup/cpuset: Reset DL migration state on can_attach() failure
    (bsc#1258210).
  - tracing/fprobe: Check the same type fprobe on table as the
    unregistered one (bsc#1258210).
  - tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
    (bsc#1258210).
  - tracing: fprobe: use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_ARGS
    (bsc#1258210).
  - tracing: fprobe: Remove unused local variable (bsc#1258210).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1258210).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1258210).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1258210).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1258210).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1258210).
  - netfilter: ip6t_hbh: reject oversized option lists (bsc#1258210).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1258210).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1258210).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1258210).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1258210).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1258210).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1258210).
  - Bluetooth: serialize accept_q access (bsc#1258210).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1258210).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1258210).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1258210).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1258210).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1258210).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1258210).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1258210).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1258210).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1258210).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1258210).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1258210).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1258210).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1258210).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1258210).
  - io_uring/waitid: clear waitid info before copying it to userspace
    (bsc#1258210).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1258210).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1258210).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1258210).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1258210).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1258210).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1258210).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1258210).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1258210).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1258210).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1258210).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1258210).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1258210).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1258210).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1258210).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1258210).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1258210).
  - sysfs: don't remove existing directory on update failure
    (bsc#1258210).
  - drm/vblank: Fix kernel docs for vblank timer (bsc#1258210).
  - drm/atomic: Increase timeout in
    drm_atomic_helper_wait_for_vblanks() (bsc#1258210).
  - drm/vkms: Convert to DRM's vblank timer (bsc#1258210).
  - drm/vblank: Add CRTC helpers for simple use cases (bsc#1258210).
  - drm/vblank: Add vblank timer (bsc#1258210).
  - Revert "ice: Remove jumbo_remove step from TX path"
    (bsc#1258210).
  - Revert "ice: fix double-free of tx_buf skb" (bsc#1258210).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1258210).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1258210).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1258210).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1258210).
  - mfd: bcm2835-pm: Add support for BCM2712 (bsc#1258210).
  - arm64: dts: broadcom: bcm2712: Add watchdog DT node
    (bsc#1258210).
  - dt-bindings: soc: bcm: Add bcm2712 compatible (bsc#1258210).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1258210).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1258210).
  - spi: spi-dw-dma: fix print error log when wait finish transaction
    (bsc#1258210).
  - bridge: mrp: reject zero test interval to avoid OOM panic
    (bsc#1258210).
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI
    de-boosting (bsc#1258210).
  - sched: Employ sched_change guards (bsc#1258210).
  - cxl/mbox: validate payload size before accessing contents in
    cxl_payload_from_user_allowed() (bsc#1258210).
  - fuse: fix uninit-value in fuse_dentry_revalidate() (bsc#1258210).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1258210).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1258210).
  - drm/xe/hdcp: Add NULL check for media_gt in
    intel_hdcp_gsc_check_status() (bsc#1258210).
  - commit f65e572
  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0

++++ kernel-docs:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-kvmsmall:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-longterm:

  - Refresh
    patches.kernel.org/6.18.34-252-net-ethernet-cortina-Carry-over-frag-counter.patch.
  - commit ea685f4
  - Linux 6.18.34 (bsc#1258210).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1258210).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1258210).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1258210).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1258210).
  - io_uring/nop: pass all errors to userspace (bsc#1258210).
  - net: gro: don't merge zcopy skbs (bsc#1258210).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1258210).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1258210).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1258210).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1258210).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1258210).
  - selftests: net: Fix checksums in xdp_native (bsc#1258210).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1258210).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1258210).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1258210).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1258210).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1258210).
  - gpio: aggregator: fix a potential use-after-free (bsc#1258210).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1258210).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1258210).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1258210).
  - net: ag71xx: check error for platform_get_irq (bsc#1258210).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1258210).
  - net: shaper: rework the VALID marking (again) (bsc#1258210).
  - net: shaper: annotate the data races (bsc#1258210).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1258210).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1258210).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1258210).
  - tracing: Avoid NULL return from hist_field_name() on truncation
    (bsc#1258210).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1258210).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1258210).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1258210).
  - wifi: mac80211: fix MLE defragmentation (bsc#1258210).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1258210).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1258210).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1258210).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1258210).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1258210).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1258210).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1258210).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1258210).
  - net: bridge: Flush multicast groups when snooping is disabled
    (bsc#1258210).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1258210).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1258210).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1258210).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1258210).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1258210).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1258210).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1258210).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1258210).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1258210).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1258210).
  - igc: set tx buffer type for SMD frames (bsc#1258210).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1258210).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1258210).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1258210).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1258210).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1258210).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1258210).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1258210).
  - drm/xe/vf: Fix signature of print functions (bsc#1258210).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1258210).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1258210).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1258210).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1258210).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1258210).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1258210).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1258210).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1258210).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1258210).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1258210).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1258210).
  - btrfs: fix squota accounting during enable generation
    (bsc#1258210).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1258210).
  - btrfs: relax squota parent qgroup deletion rule (bsc#1258210).
  - btrfs: check squota parent usage on membership change
    (bsc#1258210).
  - btrfs: remaining BTRFS_PATH_AUTO_FREE conversions (bsc#1258210).
  - btrfs: don't search back for dir inode item in INO_LOOKUP_USER
    (bsc#1258210).
  - btrfs: use the key format macros when printing keys
    (bsc#1258210).
  - btrfs: add macros to facilitate printing of keys (bsc#1258210).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1258210).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1258210).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1258210).
  - ASoC: codecs: fs210x: fix possible buffer overflow (bsc#1258210).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1258210).
  - net/mlx5: Do not restore destination-less TC rules (bsc#1258210).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1258210).
  - ovpn: disable BHs when updating device stats (bsc#1258210).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1258210).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1258210).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1258210).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1258210).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1258210).
  - net: phy: DP83TC811: add reading of abilities (bsc#1258210).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1258210).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1258210).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1258210).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1258210).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1258210).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1258210).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1258210).
  - x86/mce: Restore MCA polling interval halving (bsc#1258210).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1258210).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1258210).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1258210).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1258210).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1258210).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1258210).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1258210).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1258210).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1258210).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1258210).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1258210).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1258210).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1258210).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1258210).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1258210).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1258210).
  - net: shaper: flip the polarity of the valid flag (bsc#1258210).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1258210).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1258210).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1258210).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    (bsc#1258210).
  - net: ethernet: cortina: Carry over frag counter (bsc#1258210).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1258210).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1258210).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1258210).
  - netfs: Fix netfs_read_folio() to wait on writeback (bsc#1258210).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1258210).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1258210).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1258210).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1258210).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1258210).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1258210).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1258210).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1258210).
  - netfs: Fix streaming write being overwritten (bsc#1258210).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1258210).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1258210).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1258210).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1258210).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1258210).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1258210).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1258210).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1258210).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1258210).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1258210).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1258210).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1258210).
  - nvme: fix bio leak on mapping failure (bsc#1258210).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1258210).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1258210).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1258210).
  - irqchip/ath79-cpu: Remove unused function (bsc#1258210).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1258210).
  - fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
    (bsc#1258210).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1258210).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1258210).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1258210).
  - NFSD: Fix infinite loop in layout state revocation (bsc#1258210).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1258210).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1258210).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1258210).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1258210).
  - ice: fix setting RSS VSI hash for E830 (bsc#1258210).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1258210).
  - net: shaper: Reject reparenting of existing nodes (bsc#1258210).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1258210).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1258210).
  - test_kprobes: clear kprobes between test runs (bsc#1258210).
  - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
    (bsc#1258210).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1258210).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1258210).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1258210).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1258210).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1258210).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1258210).
  - netfilter: x_tables: unregister the templates first
    (bsc#1258210).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1258210).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1258210).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1258210).
  - ARM: integrator: Fix early initialization (bsc#1258210).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1258210).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1258210).
  - firmware: arm_ffa: Align RxTx buffer size before mapping
    (bsc#1258210).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1258210).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1258210).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1258210).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1258210).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1258210).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1258210).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1258210).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
    (bsc#1258210).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1258210).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1258210).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1258210).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1258210).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1258210).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1258210).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1258210).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1258210).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1258210).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1258210).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells (bsc#1258210).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1258210).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1258210).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1258210).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1258210).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1258210).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1258210).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1258210).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1258210).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1258210).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1258210).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1258210).
  - batman-adv: tt: prevent TVLV entry number overflow (bsc#1258210).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1258210).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1258210).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1258210).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1258210).
  - batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1258210).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1258210).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1258210).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1258210).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1258210).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1258210).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1258210).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1258210).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1258210).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1258210).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1258210).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1258210).
  - batman-adv: dat: handle forward allocation error (bsc#1258210).
  - batman-adv: clear current gateway during teardown (bsc#1258210).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1258210).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1258210).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1258210).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1258210).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1258210).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1258210).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1258210).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1258210).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1258210).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1258210).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1258210).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1258210).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1258210).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1258210).
  - drm/msm: Fix shrinker deadlock (bsc#1258210).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1258210).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1258210).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1258210).
  - fwctl: pds: Validate RPC input size before parsing (bsc#1258210).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1258210).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1258210).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1258210).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1258210).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1258210).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1258210).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1258210).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1258210).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1258210).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1258210).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1258210).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1258210).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1258210).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1258210).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1258210).
  - cifs: Fix busy dentry used after unmounting (bsc#1258210).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1258210).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1258210).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1258210).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1258210).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1258210).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1258210).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1258210).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1258210).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1258210).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1258210).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1258210).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1258210).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1258210).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1258210).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1258210).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1258210).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1258210).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1258210).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1258210).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1258210).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1258210).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1258210).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1258210).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1258210).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1258210).
  - fs/ntfs3: handle attr_set_size() errors when truncating files
    (bsc#1258210).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1258210).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1258210).
  - cgroup/cpuset: Reset DL migration state on can_attach() failure
    (bsc#1258210).
  - tracing/fprobe: Check the same type fprobe on table as the
    unregistered one (bsc#1258210).
  - tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
    (bsc#1258210).
  - tracing: fprobe: use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_ARGS
    (bsc#1258210).
  - tracing: fprobe: Remove unused local variable (bsc#1258210).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1258210).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1258210).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1258210).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1258210).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1258210).
  - netfilter: ip6t_hbh: reject oversized option lists (bsc#1258210).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1258210).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1258210).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1258210).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1258210).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1258210).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1258210).
  - Bluetooth: serialize accept_q access (bsc#1258210).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1258210).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1258210).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1258210).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1258210).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1258210).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1258210).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1258210).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1258210).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1258210).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1258210).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1258210).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1258210).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1258210).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1258210).
  - io_uring/waitid: clear waitid info before copying it to userspace
    (bsc#1258210).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1258210).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1258210).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1258210).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1258210).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1258210).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1258210).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1258210).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1258210).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1258210).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1258210).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1258210).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1258210).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1258210).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1258210).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1258210).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1258210).
  - sysfs: don't remove existing directory on update failure
    (bsc#1258210).
  - drm/vblank: Fix kernel docs for vblank timer (bsc#1258210).
  - drm/atomic: Increase timeout in
    drm_atomic_helper_wait_for_vblanks() (bsc#1258210).
  - drm/vkms: Convert to DRM's vblank timer (bsc#1258210).
  - drm/vblank: Add CRTC helpers for simple use cases (bsc#1258210).
  - drm/vblank: Add vblank timer (bsc#1258210).
  - Revert "ice: Remove jumbo_remove step from TX path"
    (bsc#1258210).
  - Revert "ice: fix double-free of tx_buf skb" (bsc#1258210).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1258210).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1258210).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1258210).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1258210).
  - mfd: bcm2835-pm: Add support for BCM2712 (bsc#1258210).
  - arm64: dts: broadcom: bcm2712: Add watchdog DT node
    (bsc#1258210).
  - dt-bindings: soc: bcm: Add bcm2712 compatible (bsc#1258210).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1258210).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1258210).
  - spi: spi-dw-dma: fix print error log when wait finish transaction
    (bsc#1258210).
  - bridge: mrp: reject zero test interval to avoid OOM panic
    (bsc#1258210).
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI
    de-boosting (bsc#1258210).
  - sched: Employ sched_change guards (bsc#1258210).
  - cxl/mbox: validate payload size before accessing contents in
    cxl_payload_from_user_allowed() (bsc#1258210).
  - fuse: fix uninit-value in fuse_dentry_revalidate() (bsc#1258210).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1258210).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1258210).
  - drm/xe/hdcp: Add NULL check for media_gt in
    intel_hdcp_gsc_check_status() (bsc#1258210).
  - commit f65e572
  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0

++++ kernel-obs-build:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-obs-qa:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-syms:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ kernel-syms-longterm:

  - Refresh
    patches.kernel.org/6.18.34-252-net-ethernet-cortina-Carry-over-frag-counter.patch.
  - commit ea685f4
  - Linux 6.18.34 (bsc#1258210).
  - security/keys: fix missed RCU read section on lookup
    (bsc#1258210).
  - drm/msm: Restore second parameter name in purge() and evict()
    (bsc#1258210).
  - LoongArch: kprobes: Fix handling of fatal unrecoverable
    recursions (bsc#1258210).
  - ksmbd: fix durable reconnect error path file lifetime
    (bsc#1258210).
  - io_uring/nop: pass all errors to userspace (bsc#1258210).
  - net: gro: don't merge zcopy skbs (bsc#1258210).
  - pds_core: ensure null-termination for firmware version strings
    (bsc#1258210).
  - net: airoha: Disable GDM2 forwarding before configuring GDM2
    loopback (bsc#1258210).
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    (bsc#1258210).
  - net: mana: validate rx_req_idx to prevent out-of-bounds array
    access (bsc#1258210).
  - octeontx2-af: npc: Fix allmulticast skip logic for LBK and
    SDP VFs (bsc#1258210).
  - selftests: net: Fix checksums in xdp_native (bsc#1258210).
  - drm/xe/oa: Fix exec_queue leak on width check in stream open
    (bsc#1258210).
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    (bsc#1258210).
  - gpio: aggregator: lock device when calling device_is_bound()
    (bsc#1258210).
  - gpio: aggregator: remove the software node when deactivating
    the aggregator (bsc#1258210).
  - gpio: aggregator: stop using dev-sync-probe (bsc#1258210).
  - gpio: aggregator: fix a potential use-after-free (bsc#1258210).
  - gpio: cdev: check if uAPI v2 config attributes are correctly
    zeroed (bsc#1258210).
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    (bsc#1258210).
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    (bsc#1258210).
  - net: ag71xx: check error for platform_get_irq (bsc#1258210).
  - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length
    checks (bsc#1258210).
  - net: shaper: rework the VALID marking (again) (bsc#1258210).
  - net: shaper: annotate the data races (bsc#1258210).
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    (bsc#1258210).
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    (bsc#1258210).
  - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    (bsc#1258210).
  - tracing: Avoid NULL return from hist_field_name() on truncation
    (bsc#1258210).
  - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    (bsc#1258210).
  - ALSA: seq: Serialize UMP output teardown with event_input
    (bsc#1258210).
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    (bsc#1258210).
  - wifi: mac80211: fix MLE defragmentation (bsc#1258210).
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    (bsc#1258210).
  - erofs: fix managed cache race for unaligned extents
    (bsc#1258210).
  - pds_core: fix debugfs_lookup dentry leak and error handling
    (bsc#1258210).
  - pds_core: fix error handling in pdsc_devcmd_wait (bsc#1258210).
  - net: airoha: Fix NPU RX DMA descriptor bits (bsc#1258210).
  - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    (bsc#1258210).
  - net: phy: honor eee_disabled_modes in phy_support_eee()
    (bsc#1258210).
  - bridge: mcast: Fix a possible use-after-free when removing a
    bridge port (bsc#1258210).
  - net: bridge: Flush multicast groups when snooping is disabled
    (bsc#1258210).
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    (bsc#1258210).
  - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    (bsc#1258210).
  - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    (bsc#1258210).
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    (bsc#1258210).
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    (bsc#1258210).
  - platform/surface: aggregator_registry: omit battery & AC nodes
    on Surface Laptop 7 (bsc#1258210).
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    (bsc#1258210).
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local
    frames (bsc#1258210).
  - net: dsa: mt7530: fix FDB entries not aging out with short
    timeout (bsc#1258210).
  - kbuild: pacman-pkg: make "rc" releases adhere to pacman
    versioning scheme (bsc#1258210).
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    (bsc#1258210).
  - igc: set tx buffer type for SMD frames (bsc#1258210).
  - ice: ptp: use primary NAC semaphore on E825 (bsc#1258210).
  - ice: ptp: serialize E825 PHY timer start with PTP lock
    (bsc#1258210).
  - cgroup/rstat: validate cpu before css_rstat_cpu() access
    (bsc#1258210).
  - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    (bsc#1258210).
  - drm/mediatek: mtk_cec: Fix non-static global variable
    (bsc#1258210).
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    (bsc#1258210).
  - drm/xe/pf: Fix CFI failure in debugfs access (bsc#1258210).
  - drm/xe/vf: Fix signature of print functions (bsc#1258210).
  - drm/xe/gsc: Fix double-free of managed BO in error path
    (bsc#1258210).
  - dma-mapping: move dma_map_resource() sanity check into debug
    code (bsc#1258210).
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL
    checking it (bsc#1258210).
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU
    is disabled (bsc#1258210).
  - hwmon: (lm90) Add lock protection to lm90_alert (bsc#1258210).
  - hwmon: (lm90) Stop work before releasing hwmon device
    (bsc#1258210).
  - drm/msm/snapshot: fix dumping of the unaligned regions
    (bsc#1258210).
  - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS
    Strix Gxx5 (bsc#1258210).
  - netfilter: nft_inner: release local_lock before re-enabling
    softirqs (bsc#1258210).
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    (bsc#1258210).
  - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    (bsc#1258210).
  - btrfs: fix squota accounting during enable generation
    (bsc#1258210).
  - btrfs: check for subvolume before deleting squota qgroup
    (bsc#1258210).
  - btrfs: relax squota parent qgroup deletion rule (bsc#1258210).
  - btrfs: check squota parent usage on membership change
    (bsc#1258210).
  - btrfs: remaining BTRFS_PATH_AUTO_FREE conversions (bsc#1258210).
  - btrfs: don't search back for dir inode item in INO_LOOKUP_USER
    (bsc#1258210).
  - btrfs: use the key format macros when printing keys
    (bsc#1258210).
  - btrfs: add macros to facilitate printing of keys (bsc#1258210).
  - vsock/virtio: fix zerocopy completion for multi-skb sends
    (bsc#1258210).
  - io_uring/net: punt IORING_OP_BIND async if it needs file create
    (bsc#1258210).
  - ALSA: scarlett2: Add missing error check when initialise
    Autogain Status (bsc#1258210).
  - ASoC: codecs: fs210x: fix possible buffer overflow (bsc#1258210).
  - scsi: sd: Fix return code handling in sd_spinup_disk()
    (bsc#1258210).
  - net/mlx5: Do not restore destination-less TC rules (bsc#1258210).
  - tls: Preserve sk_err across recvmsg() when data has been copied
    (bsc#1258210).
  - ovpn: disable BHs when updating device stats (bsc#1258210).
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (bsc#1258210).
  - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    (bsc#1258210).
  - ovpn: fix race between deleting interface and adding new peer
    (bsc#1258210).
  - ovpn: respect peer refcount in CMD_NEW_PEER error path
    (bsc#1258210).
  - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    (bsc#1258210).
  - net: phy: DP83TC811: add reading of abilities (bsc#1258210).
  - net: tls: prevent chain-after-chain in plain text SG
    (bsc#1258210).
  - net: tls: fix off-by-one in sg_chain entry count for wrapped
    sk_msg ring (bsc#1258210).
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    (bsc#1258210).
  - powerpc/time: Remove redundant preempt_disable|enable() calls
    from arch_irq_work_raise() (bsc#1258210).
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid
    WARN (bsc#1258210).
  - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    (bsc#1258210).
  - Documentation: intel_pstate: Fix description of asymmetric
    packing with SMT (bsc#1258210).
  - x86/mce: Restore MCA polling interval halving (bsc#1258210).
  - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    (bsc#1258210).
  - drm/msm/dpu: don't mix devm and drmm functions (bsc#1258210).
  - drm/msm/dsi: don't dump registers past the mapped region
    (bsc#1258210).
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    (bsc#1258210).
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event
    tracepoint (bsc#1258210).
  - accel/qaic: Add overflow check to remap_pfn_range during mmap
    (bsc#1258210).
  - block: bio-integrity: Fix null-ptr-deref in
    bio_integrity_map_user() (bsc#1258210).
  - HID: quirks: really enable the intended work around for
    appledisplay (bsc#1258210).
  - block: recompute nr_integrity_segments in
    blk_insert_cloned_request (bsc#1258210).
  - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    (bsc#1258210).
  - net: shaper: reject QUEUE scope handle with missing id
    (bsc#1258210).
  - net: shaper: enforce singleton NETDEV scope with id 0
    (bsc#1258210).
  - net: shaper: fix undersized reply skb allocation in GROUP
    command (bsc#1258210).
  - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in
    group_doit (bsc#1258210).
  - net: shaper: reject duplicate leaves in GROUP request
    (bsc#1258210).
  - net: shaper: fix trivial ordering issue in net_shaper_commit()
    (bsc#1258210).
  - net: shaper: flip the polarity of the valid flag (bsc#1258210).
  - wifi: ath10k: skip WMI and beacon transmission when device is
    wedged (bsc#1258210).
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    (bsc#1258210).
  - wifi: ath11k: fix error path leaks in some WMI WOW calls
    (bsc#1258210).
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    (bsc#1258210).
  - net: ethernet: cortina: Carry over frag counter (bsc#1258210).
  - net: ethernet: cortina: Drop half-assembled SKB (bsc#1258210).
  - net: ethernet: cortina: Make RX SKB per-port (bsc#1258210).
  - netfs, afs: Fix write skipping in dir/link writepages
    (bsc#1258210).
  - netfs: Fix netfs_read_folio() to wait on writeback (bsc#1258210).
  - netfs: Fix folio->private handling in netfs_perform_write()
    (bsc#1258210).
  - netfs: Fix partial invalidation of streaming-write folio
    (bsc#1258210).
  - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    (bsc#1258210).
  - netfs: Fix leak of request in netfs_write_begin() error handling
    (bsc#1258210).
  - netfs: Fix early put of sink folio in netfs_read_gaps()
    (bsc#1258210).
  - netfs: Fix write streaming disablement if fd open O_RDWR
    (bsc#1258210).
  - netfs: Fix read-gaps to remove netfs_folio from filled folio
    (bsc#1258210).
  - netfs: Fix potential deadlock in write-through mode
    (bsc#1258210).
  - netfs: Fix streaming write being overwritten (bsc#1258210).
  - netfs: Defer the emission of trace_netfs_folio() (bsc#1258210).
  - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all
    changes gone (bsc#1258210).
  - netfs: Fix overrun check in netfs_extract_user_iter()
    (bsc#1258210).
  - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    (bsc#1258210).
  - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    (bsc#1258210).
  - netfs: Fix cancellation of a DIO and single read subrequests
    (bsc#1258210).
  - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    (bsc#1258210).
  - powerpc: 82xx: fix uninitialized pointers with free attribute
    (bsc#1258210).
  - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    (bsc#1258210).
  - tcp: Fix out-of-bounds access for twsk in
    tcp_ao_established_key() (bsc#1258210).
  - zonefs: handle integer overflow in zonefs_fname_to_fno
    (bsc#1258210).
  - nvme-pci: fix use-after-free in nvme_free_host_mem()
    (bsc#1258210).
  - nvme: fix bio leak on mapping failure (bsc#1258210).
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    (bsc#1258210).
  - nsfs: fix wrong error code returned for pidns ioctls
    (bsc#1258210).
  - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
    validation (bsc#1258210).
  - irqchip/ath79-cpu: Remove unused function (bsc#1258210).
  - fs: Fix return in jfs_mkdir and orangefs_mkdir (bsc#1258210).
  - fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
    (bsc#1258210).
  - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    (bsc#1258210).
  - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    (bsc#1258210).
  - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    (bsc#1258210).
  - NFSD: Fix infinite loop in layout state revocation (bsc#1258210).
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
    register access (bsc#1258210).
  - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    (bsc#1258210).
  - net: lan966x: avoid unregistering netdev on register failure
    (bsc#1258210).
  - ice: fix locking in ice_dcb_rebuild() (bsc#1258210).
  - ice: fix setting RSS VSI hash for E830 (bsc#1258210).
  - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    (bsc#1258210).
  - net: shaper: Reject reparenting of existing nodes (bsc#1258210).
  - net: napi: Avoid gro timer misfiring at end of busypoll
    (bsc#1258210).
  - tcp: Fix imbalanced icsk_accept_queue count (bsc#1258210).
  - test_kprobes: clear kprobes between test runs (bsc#1258210).
  - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
    (bsc#1258210).
  - netfilter: bridge: eb_tables: close module init race
    (bsc#1258210).
  - netfilter: x_tables: close dangling table module init race
    (bsc#1258210).
  - netfilter: ebtables: close dangling table module init race
    (bsc#1258210).
  - netfilter: ebtables: move to two-stage removal scheme
    (bsc#1258210).
  - netfilter: x_tables: add and use xtables_unregister_table_exit
    (bsc#1258210).
  - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    (bsc#1258210).
  - netfilter: x_tables: unregister the templates first
    (bsc#1258210).
  - btrfs: tracepoints: fix sleep while in atomic context in
    btrfs_sync_file() (bsc#1258210).
  - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    (bsc#1258210).
  - ALSA: hda: cs35l56: Put ACPI device after setting companion
    (bsc#1258210).
  - ARM: integrator: Fix early initialization (bsc#1258210).
  - firmware: arm_ffa: Fix sched-recv callback partition lookup
    (bsc#1258210).
  - firmware: arm_ffa: Snapshot notifier callbacks under lock
    (bsc#1258210).
  - firmware: arm_ffa: Align RxTx buffer size before mapping
    (bsc#1258210).
  - firmware: arm_ffa: Validate framework notification message
    layout (bsc#1258210).
  - firmware: arm_ffa: Keep framework RX release under lock
    (bsc#1258210).
  - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    (bsc#1258210).
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs
    for sm8150 (bsc#1258210).
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    (bsc#1258210).
  - kunit: config: Enable KUNIT_DEBUGFS by default (bsc#1258210).
  - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    (bsc#1258210).
  - riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
    (bsc#1258210).
  - firmware: arm_ffa: Unregister bus notifier on teardown for
    FF-A v1.0 (bsc#1258210).
  - firmware: arm_ffa: Fix per-vcpu self notifications handling
    in workqueue (bsc#1258210).
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    (bsc#1258210).
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver
    registration (bsc#1258210).
  - HID: uclogic: Fix regression of input name assignment
    (bsc#1258210).
  - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    (bsc#1258210).
  - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    (bsc#1258210).
  - pinctrl: meson: amlogic-a4: fix deadlock issue (bsc#1258210).
  - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    (bsc#1258210).
  - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset
    for high pins during suspend/resume (bsc#1258210).
  - ARM: dts: renesas: rskrza1: Drop superfluous cells (bsc#1258210).
  - ARM: dts: renesas: genmai: Drop superfluous cells (bsc#1258210).
  - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    (bsc#1258210).
  - hwmon: (pmbus/adm1266) reject short block-read responses in
    the GPIO accessors (bsc#1258210).
  - hwmon: (pmbus/adm1266) register the nvmem device after
    pmbus_do_probe() (bsc#1258210).
  - hwmon: (pmbus/adm1266) register the gpio_chip after
    pmbus_do_probe() (bsc#1258210).
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
    read in get_multiple (bsc#1258210).
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
    ADM1266_PDIO_NR (bsc#1258210).
  - hwmon: (pmbus/adm1266) bounce blackbox records through a
    protocol-sized buffer (bsc#1258210).
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
    read buffer (bsc#1258210).
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    (bsc#1258210).
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    (bsc#1258210).
  - batman-adv: tt: prevent TVLV entry number overflow (bsc#1258210).
  - batman-adv: tt: fix negative tt_buff_len (bsc#1258210).
  - batman-adv: tt: fix negative last_changeset_len (bsc#1258210).
  - batman-adv: tt: avoid empty VLAN responses (bsc#1258210).
  - batman-adv: tt: reject oversized local TVLV buffers
    (bsc#1258210).
  - batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1258210).
  - batman-adv: tp_meter: avoid role confusion in tp_list
    (bsc#1258210).
  - batman-adv: tp_meter: fix race condition in send error reporting
    (bsc#1258210).
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver
    shutdown (bsc#1258210).
  - batman-adv: tp_meter: directly shut down timer on cleanup
    (bsc#1258210).
  - batman-adv: tp_meter: avoid use of uninit sender vars
    (bsc#1258210).
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped
    interface (bsc#1258210).
  - batman-adv: bla: avoid double decrement of bla.num_requests
    (bsc#1258210).
  - batman-adv: bla: fix report_work leak on backbone_gw purge
    (bsc#1258210).
  - batman-adv: frag: disallow unicast fragment in fragment
    (bsc#1258210).
  - batman-adv: fix tp_meter counter underflow during shutdown
    (bsc#1258210).
  - batman-adv: fix fragment reassembly length accounting
    (bsc#1258210).
  - batman-adv: dat: handle forward allocation error (bsc#1258210).
  - batman-adv: clear current gateway during teardown (bsc#1258210).
  - batman-adv: mcast: fix use-after-free in orig_node RCU release
    (bsc#1258210).
  - batman-adv: iv: recover OGM scheduling after forward packet
    error (bsc#1258210).
  - batman-adv: tvlv: reject oversized TVLV packets (bsc#1258210).
  - batman-adv: tvlv: abort OGM send on tvlv append failure
    (bsc#1258210).
  - batman-adv: v: stop OGMv2 on disabled interface (bsc#1258210).
  - drm/amd/display: Validate payload length and link_index in
    dc_process_dmub_aux_transfer_async (bsc#1258210).
  - drm/amd/display: Validate GPIO pin LUT table size before
    iterating (bsc#1258210).
  - drm/amd/display: Fix integer overflow in bios_get_image()
    (bsc#1258210).
  - drm/bridge: megachips: remove bridge when irq request fails
    (bsc#1258210).
  - drm/bridge: it66121: acquire reset GPIO in probe (bsc#1258210).
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (bsc#1258210).
  - drm/virtio: use uninterruptible resv lock for plane updates
    (bsc#1258210).
  - drm/v3d: Release indirect CSD GEM reference on CPU job free
    (bsc#1258210).
  - drm/v3d: Fix use-after-free of CPU job query arrays on error
    path (bsc#1258210).
  - drm/msm: Fix shrinker deadlock (bsc#1258210).
  - device property: set fwnode->secondary to NULL in fwnode_init()
    (bsc#1258210).
  - LoongArch: Remove unused code to avoid build warning
    (bsc#1258210).
  - LoongArch: kprobes: Use larch_insn_text_copy() to patch
    instructions (bsc#1258210).
  - fwctl: pds: Validate RPC input size before parsing (bsc#1258210).
  - RDMA/siw: Reject MPA FPDU length underflow before signed
    receive math (bsc#1258210).
  - spi: ti-qspi: fix use-after-free after DMA setup failure
    (bsc#1258210).
  - spi: sprd: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - spi: ep93xx: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - scsi: isci: Fix use-after-free in device removal path
    (bsc#1258210).
  - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after
    SM8650 G4 fix (bsc#1258210).
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    (bsc#1258210).
  - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for
    Exynos7870 (bsc#1258210).
  - spi: qup: fix error pointer deref after DMA setup failure
    (bsc#1258210).
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
    probe (bsc#1258210).
  - virt: sev-guest: Explicitly leak pages in unknown state
    (bsc#1258210).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when
    OOM (bsc#1258210).
  - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem()
    when OOM (bsc#1258210).
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h
    (erratum #1235) (bsc#1258210).
  - KVM: arm64: vgic: Free private_irqs when init fails after
    allocation (bsc#1258210).
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
    num_eventid_bits (bsc#1258210).
  - arm64: probes: Handle probes on hinted conditional branch
    instructions (bsc#1258210).
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    (bsc#1258210).
  - cifs: Fix busy dentry used after unmounting (bsc#1258210).
  - wifi: mac80211: consume only present negotiated TTLM maps
    (bsc#1258210).
  - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    (bsc#1258210).
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    (bsc#1258210).
  - ice: restore PTP Rx timestamp config after ethtool set-channels
    (bsc#1258210).
  - ice: fix setting promisc mode while adding VID filter
    (bsc#1258210).
  - ice: fix locking around wait_event_interruptible_locked_irq
    (bsc#1258210).
  - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    (bsc#1258210).
  - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    (bsc#1258210).
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    (bsc#1258210).
  - lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1258210).
  - rbd: eliminate a race in lock_dwork draining on unmap
    (bsc#1258210).
  - ixgbevf: fix use-after-free in VEPA multicast source pruning
    (bsc#1258210).
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1258210).
  - wifi: iwlwifi: mld: stop TX during firmware restart
    (bsc#1258210).
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    (bsc#1258210).
  - wifi: ath11k: clear shared SRNG pointer state on restart
    (bsc#1258210).
  - ice: fix VF queue configuration with low MTU values
    (bsc#1258210).
  - vsock/virtio: reset connection on receiving queue overflow
    (bsc#1258210).
  - vsock/vmci: fix UAF when peer resets connection during handshake
    (bsc#1258210).
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
    insufficient (bsc#1258210).
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    (bsc#1258210).
  - ring-buffer: Flush and stop persistent ring buffer on panic
    (bsc#1258210).
  - ring-buffer: Fix reporting of missed events in iterator
    (bsc#1258210).
  - qed: fix double free in qed_cxt_tables_alloc() (bsc#1258210).
  - l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1258210).
  - fs/ntfs3: handle attr_set_size() errors when truncating files
    (bsc#1258210).
  - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    (bsc#1258210).
  - net: ethtool: fix NULL pointer dereference in phy_reply_size
    (bsc#1258210).
  - cgroup/cpuset: Reset DL migration state on can_attach() failure
    (bsc#1258210).
  - tracing/fprobe: Check the same type fprobe on table as the
    unregistered one (bsc#1258210).
  - tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
    (bsc#1258210).
  - tracing: fprobe: use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_ARGS
    (bsc#1258210).
  - tracing: fprobe: Remove unused local variable (bsc#1258210).
  - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure
    path (bsc#1258210).
  - sched_ext: Fix missing warning in scx_set_task_state() default
    case (bsc#1258210).
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1258210).
  - netfilter: ipset: stop hash:* range iteration at end
    (bsc#1258210).
  - netfilter: nf_queue: hold bridge skb->dev while queued
    (bsc#1258210).
  - netfilter: ip6t_hbh: reject oversized option lists (bsc#1258210).
  - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    (bsc#1258210).
  - net: ifb: report ethtool stats over num_tx_queues (bsc#1258210).
  - net/mlx5e: Fix use-after-free in
    mlx5e_tx_reporter_timeout_recover (bsc#1258210).
  - net: phy: skip EEE advertisement write when autoneg is disabled
    (bsc#1258210).
  - net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1258210).
  - phonet/pep: disable BH around forwarded sk_receive_skb()
    (bsc#1258210).
  - Bluetooth: serialize accept_q access (bsc#1258210).
  - Bluetooth: MGMT: validate Add Extended Advertising Data length
    (bsc#1258210).
  - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
    stack pointer (bsc#1258210).
  - Bluetooth: hci_uart: fix UAFs and race conditions in close
    and init paths (bsc#1258210).
  - Bluetooth: bnep: Fix UAF read of dev->name (bsc#1258210).
  - Bluetooth: ISO: drop ISO_END frames received without prior
    ISO_START (bsc#1258210).
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
    l2cap_conn_del() (bsc#1258210).
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    (bsc#1258210).
  - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    (bsc#1258210).
  - mm/page_alloc: fix initialization of tags of the huge zero
    folio with init_on_free (bsc#1258210).
  - mm/memory_hotplug: fix memory block reference leak on remove
    (bsc#1258210).
  - mm: fix __vm_normal_page() to handle missing support for
    pmd_special()/pud_special() (bsc#1258210).
  - mm/memory: fix spurious warning when unmapping
    device-private/exclusive pages (bsc#1258210).
  - ipv6: ioam: refresh hdr pointer before ioam6_event()
    (bsc#1258210).
  - drivers/base/memory: fix memory block reference leak in poison
    accounting (bsc#1258210).
  - io_uring/waitid: clear waitid info before copying it to userspace
    (bsc#1258210).
  - spi: amd: Set correct bus number in ACPI probe path
    (bsc#1258210).
  - efi: Allocate runtime workqueue before ACPI init (bsc#1258210).
  - ALSA: scarlett2: Allow flash writes ending at segment boundary
    (bsc#1258210).
  - ALSA: asihpi: Fix potential OOB array access at reading cache
    (bsc#1258210).
  - ALSA: pcm: Don't setup bogus iov_iter for silencing
    (bsc#1258210).
  - ALSA: ua101: Reject too-short USB descriptors (bsc#1258210).
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to
    I2C_SMBUS_BLOCK_MAX (bsc#1258210).
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    (bsc#1258210).
  - smb: client: use data_len for SMB2 READ encrypted folioq copy
    (bsc#1258210).
  - smb: client: protect tc_count increment in
    smb2_find_smb_sess_tcon_unlocked() (bsc#1258210).
  - smb: client: require net admin for CIFS SWN netlink
    (bsc#1258210).
  - regulator: tps65219: fix irq_data.rdev not being assigned
    (bsc#1258210).
  - ksmbd: validate SID in parent security descriptor during ACL
    inheritance (bsc#1258210).
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl()
    on overflow (bsc#1258210).
  - ksmbd: fix null pointer dereference in compare_guid_key()
    (bsc#1258210).
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    (bsc#1258210).
  - sysfs: don't remove existing directory on update failure
    (bsc#1258210).
  - drm/vblank: Fix kernel docs for vblank timer (bsc#1258210).
  - drm/atomic: Increase timeout in
    drm_atomic_helper_wait_for_vblanks() (bsc#1258210).
  - drm/vkms: Convert to DRM's vblank timer (bsc#1258210).
  - drm/vblank: Add CRTC helpers for simple use cases (bsc#1258210).
  - drm/vblank: Add vblank timer (bsc#1258210).
  - Revert "ice: Remove jumbo_remove step from TX path"
    (bsc#1258210).
  - Revert "ice: fix double-free of tx_buf skb" (bsc#1258210).
  - ata: libata-scsi: do not needlessly defer commands when using
    PMP with FBS (bsc#1258210).
  - ata: libata-scsi: do not use the deferred QC feature on PMPs
    with CBS (bsc#1258210).
  - ata: libata-scsi: do not use the deferred QC feature for
    ATA_DEFER_PORT (bsc#1258210).
  - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    (bsc#1258210).
  - mfd: bcm2835-pm: Add support for BCM2712 (bsc#1258210).
  - arm64: dts: broadcom: bcm2712: Add watchdog DT node
    (bsc#1258210).
  - dt-bindings: soc: bcm: Add bcm2712 compatible (bsc#1258210).
  - smb: client: reject userspace cifs.spnego descriptions
    (bsc#1258210).
  - ksmbd: close durable scavenger races against m_fp_list lookups
    (bsc#1258210).
  - spi: spi-dw-dma: fix print error log when wait finish transaction
    (bsc#1258210).
  - bridge: mrp: reject zero test interval to avoid OOM panic
    (bsc#1258210).
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI
    de-boosting (bsc#1258210).
  - sched: Employ sched_change guards (bsc#1258210).
  - cxl/mbox: validate payload size before accessing contents in
    cxl_payload_from_user_allowed() (bsc#1258210).
  - fuse: fix uninit-value in fuse_dentry_revalidate() (bsc#1258210).
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    (bsc#1258210).
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    (bsc#1258210).
  - drm/xe/hdcp: Add NULL check for media_gt in
    intel_hdcp_gsc_check_status() (bsc#1258210).
  - commit f65e572
  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0

++++ kernel-vanilla:

  - packaging: Replace compute-PATCHVERSION with python implementation
    This script is copied by kkspec to the package directory and called from
    there. That means that libraries from kernel-source cannot be loaded,
    and that's the reason why the script is appended to the library that is
    most useful for it. compute-PATCHVERSION and mkspec are no longer
    shipped in rpm packages which means compute-PATCHVERSION could be folded
    into mkspec, and that in turn into tar-up. However, these are all
    written in different languages.
  - commit de458e0
  - update to 7.1-rc6
  - commit e6c850a

++++ labwc-tweaks:

  - Update to 0.1.0 Release
    * First Point Release

++++ lego:

  - Update to version 5.2.1:
    * fix: print the suggested configuration if the file cannot be
    created
    * docs: improve flag description related to slices

++++ live555:

  - update to 2026.05.30:
    * Updated the "RTSPServer" implementation some more to make it
    more robust if subclassed code reimplements
    "lookpServerMediaSession()" as an asynchronous operation.
    * Added an (integer) index to identify each server's
    'client connection', and changed the "fClientConnections" table
    to be indexed by this id.
    * In the "RTSPServer" implementation, removed the
    "fOurClientConnection" member variable.
    This had been left over from when the RTSP "SETUP" command had
    been implemented as a single, synchronous function.
    Now that "SETUP" is implemented using multiple functions,
    possibly asynchronously (depending upon how
    "lookpServerMediaSession()" is implemented), this member
    variable was potentially dangerous if more than one "SETUP" is
    performed concurrently on the same client connection, or on
    separate client connections.

++++ openexr:

  - version update to 3.4.12
    * Fix several minor memory leaks recovering from reading invalid
    files.
    * The compressor API incorrectly identfied `HTJ2K` and `HTJ2K256` as
    lossy; they are lossles.
    * Fix CMake AVX feature detection that caused DWA SIMD code to fail on
    certain architectures.
    * The `WidenFilename` utility function is marked as deprecated, to be
    removed in a future release.
    * `exrmetrics` now print the on-disk size of the data portion of each
    part. Useful for determining compression impact on part data
    * Reject files where the dataWindows does not match the
    pixel array dimensions.
    * Support NumPy float vector attributes
    * Reading now skips over invalid parts, returns the valid parts only.
    * Doc strings have proper indentation
    * [CVE-2026-45696](https://www.cve.org/CVERecord?id=CVE-2026-45696)
    OpenEXR `ht_undo_impl` heap-buffer-overflow READ via
    codestream/channel width mismatch in HTJ2K decode
    * [CVE-2026-44663](https://www.cve.org/CVERecord?id=CVE-2026-44663)
    Integer overflow in HTJ2K decoder ( `ht_undo_impl` ) leading to
    heap-buffer-overflow
    * [OSS-Fuzz 512895184](https://issues.oss-fuzz.com/issues/512895184)
    * [OSS-Fuzz 512314697](https://issues.oss-fuzz.com/issues/512314697)
    * [OSS-Fuzz 508362159](https://issues.oss-fuzz.com/issues/508362159)
    * [OSS-Fuzz 507413960](https://issues.oss-fuzz.com/issues/507413960)
  - fixes CVE-2026-44663 [bsc#1268550]
    CVE-2026-45696 [bsc#1268551]

++++ libcdatetime:

  - Update to release 20260602
    * Updated the internal CI/CD and testsuite scripts

++++ libclocale:

  - Update to release 20260602
    * Updates to internal CI/CD and testing scripts

++++ libcnotify:

  - Update to release 20260601
    * Updates to internal CI/CD and testing scripts

++++ libcpath:

  - Update to release 20260531
    * No changelog was provided

++++ libcthreads:

  - Update to release 20260530
    * Renamed `libcthreads_repeating_thread_start_function_helper`
    to `libcthreads_repeating_thread_callback_function_helper`.

++++ mariadb:

  - Update to 11.8.8:
    https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8
    https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8
    * fixes for the following security vulnerabilities:
    11.8.8: CVE-2026-49261
    CVE-2026-48165 (bsc#1266814)
    CVE-2026-48163 (bsc#1266815)

++++ libmd:

  - Update to version 1.2.0:
    * build: Set TAR_OPTIONS to avoid leaking maintainer information on dist
    * build: Request tar-ustar format for distribution
    * doc: Move derived code attribution to a Comment field
    * doc: Remove redundant «Copyright ©» prefix from Copyright field in COPYING
    * build: Add Maintainer and License fields to the .pc file
    * doc: Remove «All rights reserved» from COPYING
    * build: Rename LIBMD_ABI to SOVERSION
    * build: Add a coverage regex to the CI job
    * man: Sync SHA2 changes from OpenBSD
    * Fixes: commit 4c5931f53727b1428b47b6a1c0bfdad02c46f1ca
    * build: Add a new vpath-tests CI test
    * build: Refactor autogen call into before_script
    * build: Fix out-of-tree build
    * build: Terminate lists in variables with «# EOL»
    * test: Add cases for SHA224 and SHA512-256
    * test: Add a new test_eq() helper function
    * build: Rename libmd_alias() to libmd_strong_alias()
    * build: Do not use strong aliases on macOS
    * build: Require automake 1.11
    * build: Fix configure.ac indentation
    * build: Switch to debian:latest Docker image
    * build: Fix version script linker support detection
    * doc: Move mailing list reference to the end

++++ mozjs140:

  - Add mozjs140-CVE-2025-70103.patch: libjxl: take EC into account
    when checking required PNM input length (bsc#1266463
    CVE-2025-70103).

++++ ncurses:

  - Add ncurses patch 20260530
    + minor renaming, formatting to align with Juergen Pfeifer's fork.
    + add configure script check for --enable-ext-mouse2, to support ABI 7.
    + improve special case in tic for %{code} to allow any non-zero byte
    as the result %'char'
  - Add ncurses patch 20260523
    + modify _nc_wacs[] to make it per-screen (from Juergen Pfeifer's fork)
    + eliminate a special case in tic when translating %{code} to %'char',
    since %{92} mapping to %'\' works with tparm and infocmp.

++++ netpbm:

  - version update to 11.14.0
    * pcxtoppm: fix determination that palette in image is all one
    color (so probably in error) based on random memory access.
    Always broken (all-one-color feature was added in July 1995).
    * pbmtext: fix crash when input text contains a character with
    code >127.  Broken in Netpbm 10.82 (March 2018).
    * pnmhisteq: fix incorrect output with -gray: color pixels
    changed, gray pixels left alone.  Broken in Netpbm 10.30
    (October 2005).
    * asciitopgm: fix crash with missing height or width argument.
    Always broken (asciitopgm was new in the 1994 Netpbm release).
    * asciitopgm: fix crash with zero divisor.
    Always broken (asciitopgm was new in the 1994 Netpbm release).
    * libnetpbm: fix crash when caller of pm_selector_mark attempts to
    mark or test mark of out-of-bounds code point.  Abort program
    with error message instead.  Broken since Netpbm 10.91 (June
    2020).
    * build: remove ancient non-prototype function declarations; C23
    doesn't have them, so compilation fails with modern compilers.
    * build: fix compile failure of libjasper with -DDEBUG .  Broken
    some time in Netpbm 10.27 (March 2005) through 10.35 (August
    2006)).
    * pnmmargin: improve error messages.
  - modified patches
    * netpbm-gcc-warnings.patch (refreshed)

++++ nfs-utils:

  - Update to 2.9.1:
    https://lore.kernel.org/linux-nfs/955a922e-c12d-435b-a698-caf73312f01d@redhat.com/
    https://www.kernel.org/pub/linux/utils/nfs-utils/2.9.1/2.9.1-Changelog
    * Minor version being disabled (which is why the minor release was bumped)
    * New features bug fixes:
    * V4.0 is turned off on the servery by default
    * netlink is now used for upcalls in exportfs, exportd, mountd
    * signed filehandle support was added.
    * nfsdctl now checks for listeners before starting.

++++ openbabel:

  - Update to version 3.2.0:
    * Add an L-BFGS optimizer, used by default for gen3d and
    conformer searches
    * New macrocycle ring builder (Dale codes) for better initial
    3D geometry of large rings
    * Add KET (Ketcher JSON) and ChemicalJSON (.cjson) format
    support
    * Drop Python 2 support; Python 3.13 supported
    * Faster, vectorized distance-geometry implementation
    * Full CMake 4 compatibility and modernized build
    * Backwards compatible with 3.0 and 3.1
    * Fix many crash and memory-safety bugs found via OSS-Fuzz
    and TALOS, including the following security issues:
    CVE-2022-37331 (boo#1217676), CVE-2022-41793, CVE-2022-42885,
    CVE-2022-43467, CVE-2022-43607, CVE-2022-44451,
    CVE-2022-46280, CVE-2022-46289, CVE-2022-46290,
    CVE-2022-46291, CVE-2022-46292, CVE-2022-46294,
    CVE-2022-46295, CVE-2025-10994, CVE-2025-10995,
    CVE-2025-10996, CVE-2025-10997, CVE-2025-10998,
    CVE-2025-10999, CVE-2025-11000,
    CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507) and
    CVE-2026-3408 (boo#1259041)
  - Shared library soname bumped to libopenbabel8 (SOVERSION 8)
  - Drop patches now fixed upstream:
    * openbabel-3.1.1-test-python3-escape-chars.patch
    * openbabel-3.1.1-test-python3-imports.patch
    * openbabel-3.1.1-version-number.patch
    * openbabel-3.1.1-gcc-12.patch
    * openbabel-3.1.1-std-binary-function.patch
    * openbabel-3.1.1-std-bind1st.patch
    * openbabel-3.1.1-std-bind2nd.patch
    * openbabel-cmake-4.patch
    * openbabel-cmake-4-exports.patch

++++ openhtj2k:

  - Update to 0.19.0:
    * New WebTransport browser viewer for live RFC 9828 streams
    * Substantial encoder and decoder performance gains
    * Broad WASM and JPIP-viewer improvements
    * See https://github.com/osamu620/OpenHTJ2K/releases/tag/v0.19.0

++++ openjph:

  - Update to 0.27.3:
    * Changed how the QCC marker is created.
    * Add OSS fuzz corpus for ojph_compress_fuzz_target #271

++++ p8-platform:

  - Spec cleanup:
    * Pass -DCMAKE_POLICY_VERSION_MINIMUM=3.5 so the build keeps
    working under CMake 4+ (upstream requires cmake 2.8.9)
    * Use %autosetup and drop obsolete Group tags

++++ qpid-proton:

  - Added patch:
    * gcc16.patch
    + Fix build with GCC 16 (bsc#1256981)

++++ libsoc:

  - Spec cleanup:
    * Add the explicit gcc and make BuildRequires
    * Build the data-only libsoc-common subpackage as noarch
    * Drop obsolete Group tags

++++ libuna:

  - Update to release 20260602
    * Reworked internal CI/CD scripts

++++ libuna-mini:

  - Update to release 20260602
    * Reworked internal CI/CD scripts

++++ libvirt:

  - Update to libvirt 12.4.0
  - Many incremental improvements and bug fixes, see
    https://libvirt.org/news.html#v12-4-0-2026-06-01

++++ libxkbcommon:

  - Update to release 1.13.2
    * Added new keysyms: XKB_KEY_dead_apostrophe, XKB_KEY_SSHARP,
    XKB_KEY_leftsingleanglequotemark,
    XKB_KEY_rightsingleanglequotemark,
    XKB_KEY_XF86ElectronicPrivacyScreenOn,
    XKB_KEY_XF86ElectronicPrivacyScreenOff,
    XKB_KEY_XF86ActionOnSelection, XKB_KEY_XF86ContextualInsert,
    XKB_KEY_XF86ContextualQuery.
    * Changed `ISO_Group_Shift`, which is now the canonical name of
    the corresponding keysym. Previously it was `Mode_switch`,
    which refers to a core X group mechanism obsoleted by XKB.
    * Added new tool `xkbcli info` to print information about
    libxkbcommon configuration, for debugging purposes.

++++ lima:

  - Update to version 2.1.2:
    * build(deps): bump github.com/modelcontextprotocol/go-sdk
    * build(deps): bump golang.org/x/net
    * portfwd: fix gRPC tunnel connection leak
    * Add user to systemd-journal group so journalctl --user works
    * build(deps): bump github.com/mdlayher/netlink from 1.11.1 to 1.11.2
    * build(deps): bump github/codeql-action from 4.35.5 to 4.36.0
    * build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
    * make update-template-rocky.sh compatible for GNU and BSD based grep
    * update image templates
    * refactor: enable usestdlibvars linter
    * pkg/downloader: logging nit
    * fix(darwin): pin main goroutine to OS thread 0 for VZ GUI
    * Revert "nerdctl: update from v2.2.2 to v2.3.1"
    * build(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6
    * Change %q in logs and errors to %#q and modify bat (part2)
    * update golang.org/x/crypto from v0.51.0 to v0.52.0
    * nerdctl: update from v2.2.2 to v2.3.1
    * build(deps): bump github/codeql-action from 4.35.4 to 4.35.5
    * build(deps): bump github.com/diskfs/go-diskfs from 1.9.2 to 1.9.3
    * build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5
    * build(deps): bump google.golang.org/grpc in /hack/tools
    * fix(CI): skip cache for golangci-lint
    * hostagent: add regression test for ga.sock forward serialization
    * hostagent: address review feedback on ga.sock forward
    * hostagent: stop destroying ga.sock on guest-agent reconnect
    * build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1
    * preserve synced guest dir changes on TUI interruption
    * feat:Add tab suggestions for --set flag
    * refactor: reduce context.Background()
    * build(deps): bump the golang-x group across 1 directory with 2 updates
    * Missing image for debian-sid generic s390x
    * The debian genericcloud ppc64el are now gone
    * Fix sha512 digest being split in multiple lines
    * Missing image and checksum for debian-13 riscv64
    * fix:prevent docker to run as root in rootless use-case
    * fix:track driver PID to prevent zombie processes
    * qemu: pass -vga none for headless guests
    * docs: add base image update and supply chain guidance
    * Add fusermount3 custom rule
    * go.mod: github.com/containers/gvisor-tap-vsock v0.8.9
    * build(deps): bump github.com/golangci/golangci-lint/v2 in /hack/tools
    * build(deps): bump github.com/diskfs/go-diskfs from 1.9.1 to 1.9.2
    * build(deps): bump github/codeql-action from 4.35.3 to 4.35.4
    * Unpin QEMU version in Windows tests
    * build(deps): bump google.golang.org/grpc in /hack/tools
    * build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0
    * fix(validate): correct misleading mountType validation error on Windows
    * docs: document limactl network and disk management commands
    * pkg/must: add Must helper
    * Fix new lint findings from golangci-lint 2.12.1
    * build(deps): bump github.com/golangci/golangci-lint/v2 in /hack/tools
    * build(deps): bump golang.org/x/sys
    * refactor: modularize lint targets with pinned go.mod tools (refs #4606)
    * Deprecate `_LIMA_QEMU_UEFI_IN_BIOS` flag
    * qemu: fix non-deterministic boot disk with bootindex and s390x support
    * build(deps): bump github.com/modelcontextprotocol/go-sdk
    * build(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    * test: fix lint issues
    * test: improve reflectutil coverage
    * test: add reflectutil tests for UnknownNonEmptyFields
    * build(deps): bump github.com/containerd/continuity from 0.4.5 to 0.5.0
    * QEMU command line: allow `kernel-irqchip` enabled with WHPX
    * build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22
    * build(deps): bump github.com/apparentlymart/go-cidr from 1.1.0 to 1.1.1
    * templates: split template:alpine to template:alpine-{3.21,3.22,3.23}
    * Modify following PR comments
    * hostagent: wait for the guest agent before opening the inotify stream
    * Settle udev between sfdisk and lsblk
    * pkg/store: treat unknown terminal width as unlimited in `limactl ls`
    * fix: dbus and less bugs
    * feat(templates): add Fedora 44 template
    * docs: add limactl help yq-restrictions to explain yqlib limitations
    * hostagent: stop leaking inotify watchers and re-spawn the gRPC stream after guest-agent reconnect
    * genschema: switch ordered-map import to pb33f/ordered-map/v2
    * build(deps): bump github.com/invopop/jsonschema from 0.13.0 to 0.14.0
    * Busybox grep doesn't support the long form options
    * Change %q in logs and errors to %#q (cmd/limactl) and modify bats
    * openSUSE dropped the 2MB OVMF images from QEMU in version 202602
    * hostagent: close stale GuestAgentClient on reconnect to stop ClientConn leak
    * wsl2: stop spinning in for { <-ctx.Done() } after instance stop
    * bats: fix second-boundary race in "shell --instance resolves instance name"
    * shell: fix path quoting for rsync 3.0.0 through 3.2.3 --protect-args only became the default in rsync 3.2.4. Paths containing spaces were not quoted for versions 3.0.0-3.2.3, causing the remote shell to split the destination path.
    * limactl: add --param shortcut for template parameters
    * build(deps): bump postcss from 8.5.3 to 8.5.10 in /website
    * templates: k8s: pin Kubernetes version to 1.36
    * templates: add ubuntu-26.04
    * CI: pin Windows QEMU to 10.2.0
    * Bump k8s flannel version from 0.27.4 to 0.28.4
    * hack/test-templates: remove WORKAROUND_UPDATE_REBOOT
    * templates: k8s: pin Kubernetes version to 1.35
    * krunkit: support SSHOverVsock and replace SSH-based guestagent connection with vsock
    * templates: update
    * docs(blogs): link Show-and-tell discussion, fold in Akihiro's and unsuman's additions
    * docs: add blogs section with curated CNCF and nttlabs posts
    * docs(stargz): drop Rosetta requirement note and refresh benchmark
    * Fix race condition in 04-persistent-data-volume.sh
    * CI: fix zizmor errors
    * CI: add zizmor (GHA linter)
    * build(deps): bump github.com/jandubois/nobin in /hack/tools
    * build(deps): bump github.com/mikefarah/yq/v4 from 4.52.5 to 4.53.2
    * cli(shell-sync): add tests for metadata change
    * build(deps): bump github.com/mdlayher/netlink from 1.11.0 to 1.11.1
    * build(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    * Multi node k8s test updates and related fixes.
    * build(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13
    * build(deps): bump actions/cache from 5.0.4 to 5.0.5
    * build(deps): bump github.com/mdlayher/netlink from 1.10.0 to 1.11.0
    * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
    * templates: migrate from cpuType to vmOpts.qemu.cpuType
    * Fix LIMA_SHELLENV_ALLOW docs to match implementation
    * build(deps): bump github.com/modelcontextprotocol/go-sdk
    * Update `k8s.yaml` to use bootstrapToken configuration for kubeadm discovery
    * build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21
    * build(deps): bump the golang-x group across 1 directory with 3 updates
    * CI: archlinux: install updates
    * docs: fix details summary and markdown rendering in templates
    * feat(vz): select disk image format for macOS guests based on host version
    * docs: add kubecon 2026 talk and pavilion slides
    * Fix GHA syntax error in test workflow
    * fix(limatmpl): fix DNS not propagated from base template
    * build(deps): bump mvdan.cc/sh/v3 from 3.13.0 to 3.13.1 in /hack/tools
    * CI: archlinux: set upgradePackages=true
    * fix(shell): check if mounts contain hostCurrentDir, not just len > 0
    * test(localpathutil): add tests for Expand
    * fix(shell): copy sshCmd.Args to a new slice before appending in executeSSHForRsync

++++ lshw:

  - Spec cleanup:
    * Stop using the deprecated %suse_update_desktop_file macro;
    set Categories directly in lshw.desktop.in and drop the
    update-desktop-files BuildRequires
    * Drop the unneeded hicolor-icon-theme dependency from the GUI
    subpackage (its icon goes to %{_datadir}/pixmaps, not a
    hicolor theme dir)
    * Drop the stale Requires(post)/Requires(postun) scriptlet
    dependencies (there are no such scriptlets; file triggers
    refresh the desktop/icon caches)
    * Add the explicit make BuildRequires and drop obsolete Group

++++ melange:

  - Update to version 0.51.0:
    * ci: allow production.cloudfront.docker.com in harden-runner
    egress (#2552)
    * feat: Add variable substitution for licenses (#2530)
    * chore(config): also create and upload source tarballs of gitlab
    repositories (#2511)
    * go/build/v2: updated go/build pipeline (#2538)

++++ mmc-utils:

  - Use the standard gcc and make BuildRequires instead of the
    non-standard c_compiler

++++ mutter:

  - Update to version 50.2:
    + Fix size increases when quickly unmaximizing window by drag
    + Fix cursor position hint for Xwayland if scaling is used
    + Fix fullscreening of edge tiled windows
    + Scale the hotspot location for tablet tool cursors
    + Fix moving maximized windows to another monitor via keyboard
    + Fix alt-tab with sloppy/mouse focus
    + Implement support for version 2 of text_input_v3 protocol
    + Ignore repeated events for double click counting
    + Fix DND data offers on touch
    + Make DND with tablets work across surfaces
    + Do not unfullscreen fullscreened window on unmaximize
    + Fix broken switch-monitor mapping on stylus buttons
    + Fixed crashes
    + Misc. bug fixes and cleanups
    + Updated translations.
  - Add 5096.patch: Stop mutter spamming logs.
  - Rebase patches with quilt.

++++ nekobox:

    Update to 5.11.16
  - Support nekoray deep-links
  - Replace QML with QuickJS-NG
  - Add drag-and-drop support for custom sorting
  - Fix the Nekoray link sharing button

++++ ofono:

  - Spec cleanup:
    * Add the explicit gcc and make BuildRequires
    * Point URL at the upstream kernel.org git (01.org is defunct)

++++ openQA:

  - Update to version 5.1780322162.c1836389:
    * refactor: Use more readable regex in `process-docs`
    * refactor: Turn `process-docs` into proper style-checked Perl script
    * feat: Add Makefile target to tidy Shell code
    * docs: Fix links in documentation generated via `generate-docs`
    * fix(openqa-clone-job): Allow empty API key/secret for auth.method=None
    * fix(spec): Supplement bash-completion subpackage against bash-completion
    * docs: Fix broken list under "Further systemd …" and wrap consistently
    * docs: Fix example config for `git_auto_commit`
    * docs: Wrap lines consistently under "Terms and variables …"
    * docs: Fix wrapping in "Triggering tests …" section and below
    * docs: Remove Git conflict markers that were missed by b51c609679
    * feat: watch worker auto-restart systemd drop-ins for reloads

++++ opencl-headers:

  - Update to version 2026.05.29:
    * Update headers for OpenCL 3.1
    * Add OpenCL ICD Loader deinitialization support
    * Add macros for anonymous union support
    * Generate headers with cl_intel_kernel_allocations_info
    * Remove __stdcall warnings on ARM
    * Regenerate extension headers from the latest XML
    * Update copyright dates to 2026

++++ openssh:

  - Update patch to fix a possible information disclosure or denial
    of service due to uninitialized variables in gssapi patches
    (CVE-2026-3497, bsc#1259642) :
    * openssh-8.0p1-gssapi-keyex.patch

++++ os-autoinst:

  - Update to version 5.1780332012.6ee8da2:
    * chore(AGENTS.md): phrase tidying as mandatory
    * feat(mouse_drag): use the clickpoints
    * test: allow to configure full-stack test output directory
    * test: allow shortening long typing in full-stack tests
    * chore: video_stream: accept ustreamer version 8

++++ owasp-modsecurity-crs:

  - version update to 4.27.0
    * fix(920240, 920400): don't rely on content-type header
  - version update to 4.26.0
    * feat: Add WhatWAF to the scanner list
    * feat: Add ghauri to scanner list
    * feat: Expand Scanner User Agents List (v2)
    * feat: Expanded os files list
    * feat(933100): all HTTP headers should be checked
    * fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/
    * feat(934200): detect Server-Side Template Injection (SSTI) attacks
    * fix(lfi-os-files): require path prefix for .profile
    * fix(933150): remove is_int from PHP function names list
    * fix(932370): remove url from Windows LOLBIN command list
    * fix(920539): prefer a bypass on a named rule rather than n+1 bypass
    * fix(942290): add word boundary to MongoDB operator detection
    * fix: false positive with parameter name `.history`
    * fix(942410): use common exceptions instead of rule
    * fix(942200): reduce false positives on payloads with comments
    * fix(unix): exclude `pg` command from pl-1
    * fix(930130): comment out false positive prone entries
    * fix(920100): drop HTTP/0.9 GET support from request line validation
    * fix: Update restricted files to include Perl subdirectories
  - version update to 4.25.0
    * feat(930130,930140): expand AI-based paths
    * feat: add aws security agent in scanners-user-agents.data
    * feat(932390): add shell fork bomb detection rule at PL2
    * refactor: create 941250 `.ra` file
    * refactor: create 942220 .ra file
    * refactor: create rule 931100 and 931110 `.ra` files
    * feat: Adding critical ai dirs that previously not exist
    * refactor: create 933140 and 933180 `.ra` files
    * fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice
    * refactor: create 943120 `.ra` file
    * fix: false negative 932236
    * fix(933111): prevent whitespace padding bypass in PHP double-extension upload
    * fix(933110): prevent whitespace padding bypass in PHP upload detection
    * fix(944140): prevent whitespace padding bypass in JSP file upload detection
    * feat: update list of unix commands
    * fix(932180): prevent whitespace padding bypass in restricted file upload detection
    * fix: harden GitHub Actions workflows
    * refactor: create 941310 `.ra` files
    * docs: update README
    * refactor: create 941120 `.ra` file
    * fix(920540): allow rule exclusions for specific targets
    * fix(931130): ensure correct target is logged

++++ patterns-ansible:

  - Do not request molecule-plugins.

++++ plasma-branding-Kalpa:

  - Version 20260601
    * Removes aarch64 specific firstboot handling.  Flathub now
    publishes an aarch64 build of Firefox, making it un-necessary

++++ plasma6-bigscreen:

  - Enable libcec support
  - Add patch to properly link against libcec:
    * 0001-Use-libcec-symbols-directly.patch

++++ python-rpm-macros:

  - Update to version 20260601.4a231f4:
    * fix: allow function of `%pythonXX_provides` w/o /usr/bin/python3
    * Update python version handling in default-prjconf
    * Rewrite README.md to have headlines for each macro.
  - Remove upstreamed better-python-provides.patch.

++++ python-pip:

  - Update to 26.1.2 (bsc#1266669, CVE-2026-8643):
  - Reject console_scripts and gui_scripts entry points whose name
    would install a script outside the scripts directory. (#14000)
  - Fix installation incorrectly failing when the target path contains
    a doubled slash, such as with pip install --root //.... (#14001)
  - Send a consistent Accept-Encoding header to avoid a spurious Cache
    entry deserialization failed warning. (#14012)

++++ python-PyMuPDF:

  - BuildRequire llvm21-clang13 on Tumbleweed as an interim fix until
    mupdf's C++ wrapper can build with llvm 22

++++ python-alsa:

  - Use pyproject macros to build and install the module.
  - List directories under sitearch explicitly.

++++ python-azure-cosmos:

  - New upstream release
    + Version 4.16.0
    + For detailed information about changes see the
    CHANGELOG.md file provided with this package

++++ python-click-extra:

  - update to 7.18.0:
    * Add a --man option to the default set of @extra_command and
    @extra_group (via default_extra_params()): it prints the
    command's man page (roff) to stdout and exits. Also available
    as the @man_option decorator for plain Click CLIs.
    * Add an --accessible option to the default set of @extra_command
    and @extra_group (via default_extra_params()). Enabling it, or
    setting the ACCESSIBLE environment variable, is equivalent to
  - -no-color --table-format plain: it strips ANSI codes and
    renders tables without Unicode box-drawing characters, for
    screen readers. An explicit --color or --table-format (on the
    command line or in a configuration file) keeps precedence. Also
    available as the @accessible_option decorator and the
    AccessibleOption class.
    * Add a man subcommand to the click-extra CLI: click-extra man
    SCRIPT [SUBCOMMAND]... renders the man page (roff) of any
    external Click CLI without running it, resolving the target
    like show-params (console_scripts entry point, module:function
    notation, .py file, or module name). Both subcommands now also
    load .py file targets, which previously raised an unhandled
    error.
    * Generate man pages programmatically with the new
    click_extra.man_page module: render_manpage() for a single
    command, render_manpages() for the whole command tree (one page
    per subcommand), and write_manpages() to write .1 files (handy
    from a Debian override_dh_installman rule). Pages follow the
    man-pages(7) layout, discover subcommands dynamically, honor
    Click's \b no-rewrap marker and SOURCE_DATE_EPOCH for
    reproducible builds, and mirror Cloup option groups as .SS
    subsections (ungrouped options fall under an Other options
    heading).
    * Add a pre-configured -0/--zero-exit option flag, exposed as the
    @zero_exit_option decorator and the ZeroExitOption class. It
    stores the user's intent in ctx.meta under the new ZERO_EXIT
    key but does not alter the exit code itself: downstream code
    reads it to decide whether to suppress its non-zero "problems
    found" status.
    * Consolidate the --time, --jobs and -0/--zero-exit options into
    a single click_extra.execution module. The click_extra.jobs and
    click_extra.timer submodules are removed: their decorators and
    classes (timer_option, jobs_option, TimerOption, JobsOption,
    CPU_COUNT, DEFAULT_JOBS) remain importable from the click_extra
    root. The --show-params table now reports these options under
    click_extra.execution.
    * Honor the standard POSIXLY_CORRECT environment variable. When
    it is present in the environment (regardless of value),
    ExtraContext forces allow_interspersed_args to False, so every
    Click Extra command and group stops parsing options at the
    first positional argument, matching GNU getopt-based tools.
    * Add the run_config_validation() function and the
    ValidationReport dataclass to click_extra.config (both
    re-exported from the package root). They run the CLI-parameter
    strict check, the typed schema build, and every registered
    ConfigValidator in a single pass, returning the typed schema
    instance, the extracted extension sub-trees, and the list of
    ValidationErrors. collect_all=True gathers every error;
    collect_all=False stops at the first. Both --validate-config
    and normal --config loading now delegate to this primitive.
    * Unify configuration-loading errors under the single
    ValidationError type. Unknown CLI-parameter keys (strict=True)
    and unknown schema fields (schema_strict=True) previously
    surfaced as an uncaught ValueError traceback during --config
    loading; they now stop the run with a critical-level log and
    exit code 1, the same failure mode as extension-validator
    errors. Code that caught ValueError from config loading should
    catch the SystemExit from the exit (or use --validate-config /
    run_config_validation() to inspect errors without exiting).
    * Fix schema_strict=True wrongly rejecting the contents of a
    configuration field marked as an extension point with
    EXTENSION_METADATA_KEY when the field's Python type is not a
    mapping. The dataclass adapter now honors the marker the same
    way the outer strict check does, so the marked sub-tree is kept
    intact instead of being flattened and reported as unknown keys.
  - update to 7.17.2:
    * Add Mermaid diagrams throughout the documentation to render
    resolution and layering rules previously carried by prose or
    nested lists: configuration-file source selection and value
    precedence (config.md), the Click / Cloup / click-extra class
    layering and the @command/@group default-option bundle
    (commands.md), --color/--no-color ANSI enablement
    (colorize.md), the {version} and {exec_name} fallback chains
    (version.md), the decorator_factory subclass guardrail
    (decorators.md), and environment-variable id resolution
    (envvar.md).
  - update to 7.17.1:
    * Bundle click_extra/themes.toml into the Nuitka standalone
    binaries via a new [tool.nuitka] include-package-data setting.
    The 7.17.0 binaries aborted at startup with FileNotFoundError:
    themes.toml because the data file backing the built-in themes
    was not packaged, so Nuitka could not find it when
    click_extra.theme loaded it through importlib.resources.
  - update to 7.17.0:
    * All built-in themes now apply the man-pages(7) font convention:
    literal tokens (command and subcommand names, aliases, option
    flags, choice values) render bold, and replaceable tokens
    (metavars, argument names) render italic, layered on top of
    each palette's colors. The split is declared by the new
    LITERAL_STYLES / REPLACEABLE_STYLES frozensets in
    click_extra.theme, and a test enforces that every built-in
    theme keeps it. To avoid piling bold onto slots that already
    stand out, heading (now color + underline), deprecated, and
    search drop their bold; critical keeps it, as it is the only
    cue distinguishing it from error. In light and solarized_dark,
    heading is recolored (to magenta and violet respectively) so it
    stays distinct from the now-bold options and subcommands it
    previously shared a color with.
    * Add a manpage built-in theme: a colorless palette rendering the
    same bold-literal / italic-replaceable convention with no
    color, shadowing how man-pages(7) typesets a command.
    Selectable via --theme manpage.
    * HelpCommand now raises click.NoSuchCommand instead of
    click.UsageError when an unknown subcommand is requested. The
    user sees did-you-mean suggestions: Error: No such command
    'instal'. (Did you mean one of: 'install', 'uninstall'?).
    * Bump the Click floor to 8.4.1. Click 8.4.0 (PR
    pallets/click#3423) injects a space between an option's help
    text and its (DEPRECATED) label. The 8.4.1 floor (not 8.4.0) is
    required because Click 8.4.0 (PR pallets/click#3404) delayed
    set_parameter_source until after process_value, so eager
    callbacks that introspect ctx.get_parameter_source(self.name)
    read None and missed whether the option was set from the
    command line, environment, or default. This broke ColorOption's
    NO_COLOR/FORCE_COLOR precedence detection, ConfigOption's
    explicit-vs-autodiscover branching, and ShowParamsOption's
    Source column. Click 8.4.1 (PR pallets/click#3484) restores the
    pre-8.4.0 contract.
    * Remove the HelpExtraFormatter.write_usage override. Click 8.4.0
    (PR pallets/click#3420) made TextWrapper measure visible width
    instead of raw bytes, so the 24-bit-RGB-theme wrap workaround
    is no longer needed.
    * Drop the explicit type=UNPROCESSED from
    NoConfigOption.__init__. Click 8.4.0 (PR pallets/click#3363)
    auto-detects UNPROCESSED for flag_value with non-basic types,
    so the flag_value=NO_CONFIG sentinel reaches Option unchanged
    on its own.
    * Bump the requests floor to 2.34. Requests 2.34.0 ships inline
    type annotations, so the types-requests stub package is no
    longer needed and has been removed from the typing dependency
    group.
    * Bump the myst-parser floor in the docs dependency group to 5.1.
    Doc builds now use myst-parser's native "alert" syntax
    extension (added in 5.1.0) instead of the in-tree regex
    converter in click_extra.sphinx.alerts; "alert" is added to
    myst_enable_extensions in docs/conf.py. The in-tree converter
    remains in place for the base test dependency group, where
    myst-parser>=4 still resolves to 4.x on Python 3.10.
    * Drop the colorama test-matrix variation. Click PR
    pallets/click#3505 merged the Colorama-removal branch into
    stable, making a dedicated CI axis unnecessary.

++++ python-google-api-python-client:

  - Update to 2.197.0
    * **aiplatform:** Update the api
    * **aiplatform:** Update the api
    * **alloydb:** Update the api
    * **androidmanagement:** Update the api
    * **androidpublisher:** Update the api
    * **backupdr:** Update the api
    * **ces:** Update the api
    * **ces:** Update the api
    * **chat:** Update the api
    * **chromemanagement:** Update the api
    * **classroom:** Update the api
    * **classroom:** Update the api
    * **clouddeploy:** Update the api
    * **cloudidentity:** Update the api
    * **cloudidentity:** Update the api
    * **cloudtasks:** Update the api
    * **cloudtrace:** Update the api
    * **compute:** Update the api
    * **compute:** Update the api
    * **contactcenterinsights:** Update the api
    * **containeranalysis:** Update the api
    * **dataflow:** Update the api
    * **datalineage:** Update the api
    * **datamanager:** Update the api
    * **datamigration:** Update the api
    * **dataplex:** Update the api
    * **dataplex:** Update the api
    * **dataproc:** Update the api
    * **datastream:** Update the api
    * **dfareporting:** Update the api
    * **dialogflow:** Update the api
    * **discoveryengine:** Update the api
    * **dlp:** Update the api
    * **documentai:** Update the api
    * **firebaseappdistribution:** Update the api
    * **firebasedataconnect:** Update the api
    * **firebaseml:** Update the api
    * **firebaseml:** Update the api
    * **gkehub:** Update the api
    * **gmail:** Update the api
    * **healthcare:** Update the api
    * **health:** Update the api
    * **homegraph:** Update the api
    * **merchantapi:** Update the api
    * **merchantapi:** Update the api
    * **migrationcenter:** Update the api
    * **mybusinessaccountmanagement:** Update the api
    * **netapp:** Update the api
    * **networkconnectivity:** Update the api
    * **networkmanagement:** Update the api
    * **networkservices:** Update the api
    * **ondemandscanning:** Update the api
    * **ondemandscanning:** Update the api
    * **oracledatabase:** Update the api
    * **osconfig:** Update the api
    * **privateca:** Update the api
    * **run:** Update the api
    * **run:** Update the api
    * **saasservicemgmt:** Update the api
    * **servicecontrol:** Update the api
    * **solar:** Update the api
    * **sqladmin:** Update the api
    * **tagmanager:** Update the api
    * **walletobjects:** Update the api
    * **workspaceevents:** Update the api
    * **workstations:** Update the api
    * **youtubereporting:** Update the api
    * **admin:** Update the api
    * **clouderrorreporting:** Update the api
    * **cloudkms:** Update the api
    * **threatintelligence:** Update the api
    * **trafficdirector:** Update the api

++++ python-google-auth:

  - Update to version 2.53.0
    * allowlist agents-nonprod trust domains for agent identity (#17155)
    * fail-fast on invalid or non-workload certificate configs in agent
    identity discovery (#17116)

++++ python-greenlet:

  - Update to 3.5.1
    * Add preliminary support for Python 3.15b1. This has not been
    reviewed by CPython core developers, but all tests pass. Binary
    wheels of this version won't work on earlier Python 3.15 builds and
    may not work on later 3.15 builds.
    * Fix the discrepancy in the way the two ``getcurrent`` APIs behave
    during greenlet teardown. One API (the C API used by, e.g.,  gevent
    raised a ``RuntimeError``; the other (the Python ``greenlet.getcurrent``
    API) returned ``None``. This second way is incompatible with greenlet's
    type annotations, so ``greenlet.getcurrent`` now raises a ``RuntimeError``
    as well.

++++ python-libvirt-python:

  - Update to 12.4.0
  - Add all new APIs and constants in libvirt 12.4.0
  - Switch to the pyproject macros to build and install.

++++ python-socksio:

  - Initial version 1.0.0

++++ radeontop:

  - Spec cleanup:
    * Add the explicit gcc and make BuildRequires
    * Drop the obsolete radeontop-rpmlintrc (its
    shlib-policy-name-error filter no longer matches anything)
    * Use %autosetup and drop obsolete Group tag

++++ rpcbind:

  - Update to rpcbind 1.2.9
    https://lore.kernel.org/linux-nfs/5cad3ab4-d24a-45fa-b1e9-d57b2c47a5e4@redhat.com/
    * A number of memory leaks fixes
    * A couple buffer overflow fixes

++++ rubygem-agama-yast:

  - Allow configuring the space policy for creating LVM physical
    volumes (jsc#PED-14153).

++++ shotwell:

  - Update to version 0.32.16:
    + Fix crashes on invalid dimensions in export
    + Support GExiv2 0.16
    + Updated translations.

++++ spyder:

  - Update to 6.1.4
    [#]# New features
    * Add option to disable Enter for accepting code completions in the Editor. The
    option is available in Preferences > Completion and linting > General.
    * Support SSH config files to create connections in Tools > Manage remote
    connections.
    * Add support to delete, upload and download multiple files when working with
    remote filesystems in Files.
    * Add button to Files to go to the directory of the current file in the Editor.
    [#]# Important fixes
    * Docstring generation has been massively overhauled to:
    * Parse and incorporate the sections of the function's existing docstring.
    * Support generating return types from the function body for Sphinxdoc.
    * Fix dozens of bugs and limitations with the existing docstring generation.
    * Resolve numerous formatting issues and follow the relevant specifications.
    * Default shortcut for docstring generation was changed to Ctrl/Cmd+Alt+Shift+D
    to avoid a conflict on macOS.
    * Allow macOS standalone app to access the microphone and camera.
    * Include pyarrow in the standalone installers to allow viewing dataframes
    created with Pandas 3.0+.
    * Remove the deprecated atomicwrites package as a dependency.
    * Constraint chardet version for licensing reasons in the standalone
    installers and fix compatibility with its latest versions.
    * Several fixes for remote connections:
    * Fix errors when stopping SSH connections.
    * Fix some misspelling in error messages.
    * Handle keyring backend load failures on Linux.
    * Fix connections to JupyterHub servers.
    [#]# API changes
    * Add remove_item_from_menu method to SpyderMenuMixin.
  - Update to 6.1.3
    [#]# New features
    * Allow to reconnect to remote kernels after the connection is lost.
    * Add ability to explore objects that depend on custom library code to the
    Variable Explorer.
    [#]# Important fixes
    * Fix memory leak on Linux when getting user's environment variables.
    * Fix several issues with the auto-update process of the standalone
    installers.
    * Fix segfault on closing with PyQt6.
    * Fix errors when creating new remote connections if credentials are wrong.
    * Finish fixing and improving docstrings for modules under spyder.api.
    [#]# API changes
    * Add sig_update_performed signal to Update manager plugin.
    * All public and most private APIs in spyder.api now have comprehensive
    docstrings and type hints with descriptions, parameters, returns and
    raises, and are thoroughly rewritten for correctness, clarity and proper
    formatting. They are also now fully built and richly rendered on the new
    Spyder developer docs site.
    * spyder.api.plugin_registration modules
    * The mixins module, containing the mixin used internally for handling the
    @on_plugin_available and @on_plugin_teardown decorators in the
    SpyderPluginV2 class, is now documented as pending deprecation as a
    public module, will become an alias of a private _mixins module and issue
    a DeprecationWarning in Spyder 6.2, and have the public alias be removed
    in Spyder 7.0. It is a private implementation detail that wasn't designed
    or intended to be used directly by external code; plugins access its
    functionality through the SpyderPluginV2 class instead.
    * The registry module's vestigial SpyderPluginRegistry.old_plugins attribute,
    originally added in Spyder 5 to list legacy Spyder 4 plugins, has been
    removed. It was mistakenly left over when Spyder 6 fully dropped support
    for Spyder 4 plugins, which never actually functioned as intended and
    should be updated to support modern Spyder 5+ plugins instead.
    * In the registry module's SpyderPluginRegistry class, setters for the
    all_internal_plugins (set_all_internal_plugins()), all_external_plugins
    (set_all_external_plugins()) and main (set_main()) instance attributes
    are now documented as pending deprecation, will raise a DeprecationWarning
    in Spyder 6.2, and will be removed in Spyder 7.0. Set the attributes
    directly instead.
    * In the registry.SpyderPluginRegistry class' register_plugin() method,
    passing arbitrary *args and **kwargs is now documented as pending
    deprecation, will raise a DeprecationWarning in Spyder 6.2 and will be
    removed in Spyder 7.0. This was only needed for backward compatibility
    before the Editor plugin was migrated in Spyder 6 to the new plugin API
    introduced in Spyder 5.
    * spyder.api.plugins modules
    * Importing from the enum and new_api modules is now documented as pending
    deprecation. In Spyder 6.2, they will be renamed to the private _enum and
    _api modules, respectively, with the original names becoming aliases
    raising a DeprecationWarning on import, that will be removed in Spyder 7.0.
    They should be imported from their canonical location, the top-level
    spyder.api.plugins module, instead.
    * The SpyderPluginV2's main instance attribute is now a property, to reduce
    duplication with the identically-valued _main attribute.
    * SpyderPluginV2's _added_toolbars and _actions private attributes have been
    removed, as they are not used at least in Spyder 6 and above.
    * Obsolete checks/warnings for SpyderPluginV2's removed register() and
    unregister() methods have been removed, as they have been unsupported
    since Spyder 5.1/5.2 and any code still using them is already broken. The
    respective on_initialize() and on_close() methods should be used instead.
    * spyder.api.widgets modules
    * In the mixins module's SpyderActionMixin.update_actions() method, remove
    the spurious leftover options parameter that does nothing, and is
    inconsistent and incompatible with all its actual current usage. As this
    is an abstract method and none of its implementations include it, any
    plugin code that does will already raise an error at runtime.
    * In the menus and toolbars modules, the SpyderMenuProxyStyle and
    ToolbarStyle proxy style classes are now documented as pending deprecation.
    In Spyder 6.2, they will be renamed to the private _SpyderMenuProxyStyle
    and _ToolbarStyle classes, respectively, with the original names becoming
    aliases raising a DeprecationWarning on use, that will be removed in
    Spyder 7.0. They were never intended to be used directly by plugins.
    * In the toolbars module, ToolbarStyle.pixelMetric() now correctly raises a
    SpyderAPIError (instead of silently not working as intended save for a
    spurious print() call) if the TYPE class attribute is not set to one of the
    two valid values, "Application" or "MainWindow". Additionally, using
    SpyderToolbar directly rather than its ApplicationToolbar and MainWidgetToolbar
    subclasses is now documented as formally discouraged so their respective
    styling will be applied.
    * In the toolbars module, the ToolTipFilter class is now correctly underscored
    as private, as it is only for internal use handling Qt events by a private
    attribute of the SpyderToolbar class.

++++ tiled:

  - Update to 1.12.2:
    * Added whitespace trimming for custom property names (#4486)
    * Reduced animated tile marker opacity during terrain editing (#4449)
    * Fixed ability to change properties after deselecting the current object (#4440)
    * Fixed Properties view getting stuck with updates disabled (#4506)
    * Fixed copy/paste of list properties losing item types (#4514)
    * Fixed resolving of class members values in lists on export (#4525)
    * Fixed locale-aware parsing of numbers in expression-capable spin boxes (#4507)
    * Fixed Tile Animation Editor update after tileset image reload (#3923)
    * Fixed runtime language switching in many editor widgets and models (#4411)
    * Fixed multi-object selection bounding box for point objects (#4401)
    * Fixed non-tile locations in wrapping Tilesets view being selectable (#3498)

++++ trivy:

  - Update to version 0.71.0 (bsc#1267268, CVE-2026-44740,
    bsc#1268356, CVE-2026-46680,
    bsc#1269271, CVE-2026-54448):
    * release: v0.71.0 [main] (#10638)
    * ci: use only the first line of commit message in release-please workflow (#10766)
    * feat: add WithDriver and WithProvider options to ospkg detector (#10740)
    * chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
    * refactor(secret): normalize configPath once in Init (#10702)
    * feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704)
    * chore(deps): bump the common group across 1 directory with 25 updates (#10758)
    * chore: migrate from gomodguard to gomodguard_v2 (#10739)
    * chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
    * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)
    * ci: scope GitHub App tokens to minimum required permissions (#10755)
    * chore(deps): upgrade go-redis from v8 to v9 (#10736)
    * fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
    * fix(misconf): skip resources with no after changes (#10352)
    * fix(misconf): reject nil plays during playbook parsing (#10273)
    * fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
    * fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
    * refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
    * chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
    * fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
    * fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions (#10731)
    * chore(deps): upgrade github.com/cenkalti/backoff dependency to v5 (#10705)
    * chore: bump golangci-lint to v2.12 (#10726)
    * feat(spdx): add SHA-512 hash algorithm support to SPDX serializer (#10719)
    * feat(sbom): support for CycloneDX 1.7 (#10715)
    * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.300.0 to 1.302.0 in the aws group (#10708)
    * chore: migrate from helm.sh/helm/v3 to helm.sh/helm/v4 (#10678)
    * fix(image): correctly reconstruct RUN instructions built without BuildKit (#10714)
    * feat(java): support <mirrors> from settings.xml (#10692)
    * fix(java): surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files (#10693)
    * chore: bump go to 1.26.3 (#10683)
    * fix(nodejs): handle legacy license formats in npm lockfile parser (#10684)
    * fix(secret): correctly skip secret-scanner config file from scanning (#10666)
    * feat(ubuntu): detect Ubuntu 26.04 LTS (#10592)
    * refactor(nodejs): deduplicate license traversal across package managers (#10681)
    * fix: overwrite OS packages PURLs after overwrite OS (#10298)
    * feat(secret): add Azure secret detection rules (#10562)
    * fix(misconf): prevent path traversal in Terraform filesystem functions (#10664)
    * feat(secret): add a way to customize skipped folders, files and exts (#10550)
    * ci: migrate PAT tokens to GitHub App (#10628)
    * chore(deps): bump the aws group across 1 directory with 6 updates (#10598)
    * chore(deps): bump the docker group across 1 directory with 3 updates (#10596)
    * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10608)
    * chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#10641)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#10648)
    * ci: migrate PAT tokens to GITHUB_TOKEN for reusable-release workflow (#10655)
    * feat(seal): add vendor support for language file detection. (#10297)
    * fix(misconf): make identifiers in ignore rules case-insensitive (#10375)
    * fix: pull instead of clone when test repo already exists (#10636)
    * docs: document how to disable check.trivy.dev connections (#10623)
    * docs(misconf): fix typo in misconfiguration config (#10619)
    * ci: remove secrets from run block (#10590)
    * docs: fix typos (#10605)
    * refactor(deps): replace archived go-homedir with os.UserHomeDir (#10484)
    * chore(deps): Bump `go-ini` and fix the import path. (#10489)
    * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10495)
    * chore(deps): bump github.com/aquasecurity/testdocker (#10543)
    * docs: convert README demonstration videos to mp4 (#10419)
    * chore(deps): upgrade vm scan dependency for bug fix (#10575)
    * docs(nodejs): clarify package.json behavior in image scanning (#10572)
    * chore(deps): replace xeipuuv/gojsonschema and invopop/jsonschema with google/jsonschema-go (#10528)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (#10554)
    * chore(deps): bump alpine to 3.23.4 (#10552)
    * ci(helm): bump Trivy version to 0.70.0 for Trivy Helm Chart 0.22.0 (#10547)

++++ vifm:

  - Update to 0.14.4:
    Invocation:
    * Reworked --help output to be more compact and readable.
    Documentation:
    * Added menu index to the documentation. Patch by CaptainFantastic.
    * Improved description of the local filter in the documentation.
    * Documented quoting and escaping on command-line. Patch by Kirill Rekhov.
    * Documented name conflict resolution dialog. Patch by Kirill Rekhov.
    * Rewrote documentation about command-line ranges to make it complete and more readable.
    * Improved wording in documentation describing general behaviour of visual mode.
    Menus and dialogs:
    * Improved potentially confusing wording in the dialog confirming exit while background jobs are running.
    * Don't offer "append the tail" conflict resolution option for al and rl
    operations because it's inappropriate for creation of symbolic links.
    File preview:
    * Display an error on trying to switch from external preview to raw mode.
    Integration:
    * Fall back to using standard::fast-content-type from GLib if
    standard::content-type is missing. Patch by Jan Palus (a.k.a. jpalus).
    Other changes:
    * Added example of handling .deb-files to sample vifmrc. Patch by Kirill Rekhov.
    * Updated sample vifmrc files to use vi as a last resort if it exists.
    * Updated list of categories in .desktop-file. Patch by Jared Cervantes (a.k.a. Jaredy899).
    Fixes:
    * Fixed :normal not being able to run commands which end with whitespace.
    * Fixed printing newline on cancelling choosing a directory via --choose-dir option.
    * Fixed escaping characters with codes greater than 127 producing garbage.
    * Fixed vifm-media-osx script for modern versions of OS X.
    * Fixed weird delays in FUSE when running an AppImage caused by a trailing colon in $LD_LIBRARY_PATH.
    * Fixed a small memory leak on trying to display a map menu which doesn't show up because it would be empty.
    * Fixed vifm-pause and other helpers not being available from within AppImage.
    * Fixed vifm.vim not cleaning up buffers properly when used as a netrw replacement.
    * Fixed a crash if GLib didn't return a file type. Patch by Jan Palus (a.k.a. jpalus).
    * Fixed undoing of chmod operation not restoring owner's read permission.
    * Fixed incorrect progress indicator for dp and do keys in compare view.
    * Fixed UID/GID occasionally not being formatted as requested (numeric vs. symbolic form) in the UI.
    * Fixed rl normal mode key sometimes not moving cursor to the newly inserted link and simultaneously logging partial name in the undo history message, which is merely informative.
    * Fixed :open not entering symbolic links to directories if there is no vifm executable in $PATH.
    * Fixed :yank and :delete not handling optional count parameter correctly (a regression since v0.11-beta).
    * Fixed completion of :highlight truncating long custom column names.
    * Fixed a Lua column disabling search highlighting for all columns to its right.
    * Fixed a buffer overflow in trie implementation (CVE-2026-8997).
    * Fixed Lua modules written in C not being loaded on Unix-like systems.

++++ w_scan:

  - Spec cleanup:
    * Add the explicit gcc and make BuildRequires
    * Drop obsolete Group tag

++++ weechat:

  -  Update to 4.9.1:
    * core: fix option weechat.look.color_real_white not applied when
    color is "white" on 16+ colors terminals (#1742)
    * irc: fix tag in message with list of names when joining a channel
    * relay: limit size of decompressed websocket frame with
    permessage-deflate to prevent memory exhaustion (GHSA-v2v4-45wm-5cr3)
    * relay: fix timing attack on password authentication (GHSA-vhv8-g2r9-cwcc)
    * api, relay: fix timing attack on TOTP validation (GHSA-vhv8-g2r9-cwcc)

++++ wireless-regdb:

  - Update to version 20260530:
    * wireless-regdb: update regulatory database based on preceding changes
    * wireless-regdb: Update regulatory rules for Sri Lanka (LK)
    * wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
    * wireless-regdb: allow 320MHz channel width for Russia
    * wireless-regdb: Update 6 GHz rules for South Korea (KR)
    * wireless-regdb: Update 6 GHz rules for South Africa (ZA)
    * wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
    * wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
    * wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
    * wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance

++++ xdg-desktop-portal-cosmic:

  - Update to version 1.0.14:
    * made the cursor show by default if client doesn't request a cursor mode
    * data: Use oo7-portal as secret portal
    * i18n: translation updates from weblate
    * chore: add Zed fmt config
    * chore: update libcosmic
    * chore: fmt
    * chore: clippy
    * chore: update dependencies
    * fix: update accent color when light/dark mode switched

++++ yq:

  - Fix multiple CVEs:
    * CVE-2026-27136 (GO-2026-5030)
    CVE-2026-25681 (GO-2026-5029)
    CVE-2026-25680 (GO-2026-5028)
    CVE-2026-42502 (GO-2026-5027)
    CVE-2026-42506 (GO-2026-5025) (bsc#1267053)
    * CVE-2026-39821 (GO-2026-5026) (bsc#1267199)

------------------------------------------------------------------
------------------  2026-5-31  -  May 31 2026  -------------------
------------------------------------------------------------------

++++ OpenShadingLanguage:

  - restore pybind11 helper to make cmake find the 311 library

++++ aqbanking:

  - Update to 6.9.2:
    + newest git status with a bugfix
    + added a flag to fix a problem with Consorsbank:
    enable "Force National Account Specs for GetTransactionsJob"
    and prefer CAMT
    + cleanup code for user and account flag handling

++++ asl:

  - Update to version 142-bld307
    * Add register symbols for 8080/8085.

++++ llvm22:

  - Update to version 22.1.6.
    * This release contains bug-fixes for the LLVM 22.1.0 release.
    This release is API and ABI compatible with 22.1.0.

++++ libdnf-plugin-txnupd:

  - Update to 0.3.0
    + Add txnupd command plugin for dnf5 to support apply-live and rollback
    + Migrate buildsys from meson to cmake
    + Add man pages

++++ fastfetch:

  - Update to version 2.63.1:
    * Release: v2.63.1
    * Wifi (Linux): disables usage of Netlink on big-endian platforms
    * CommandOption: fixes segfault with unknown module
    * Media (Linux): be compatible with signed media length
    * Packaging: update debian stuff [ci skip]
    * DisplayServer (Linux): fixes a memory leak
    * Settings (Linux): shuts libeet down if applicate
    * Release: v2.63.0
  - Update to version 2.63.0:
    * DisplayServer (Linux): fixes a memory leak
    * Settings (Linux): shuts libeet down if applicate
    * Release: v2.63.0
    * Common (Linux): tidy
    * CI (Linux): installs libefl
    * Logo (Builtin): add Ximper Linux
    * DE (Linux): fixes an inverted test
    * Global: adds missing `#endif`s back
    * Doc: update changelog

++++ ghc-commonmark:

  - Update commonmark to version 0.3.
    [#]# 0.3
    * Applicative instances of IsBlock, IsInline etc. (Ashley Yakeley).
    [API change]
    * Require separation between title quotes and URL (Michael Howell).
    This commit brings commonmark-hs into alignment with commonmark.js.
    * Don't warn about deriving typeable.
    * Add CPP to avoid warning for ghc >= 9.10.

++++ ghc-commonmark-extensions:

  - Update commonmark-extensions to version 0.2.7.
    [#]# 0.2.7
    * Math extension: bail out on pathological nestings.
    This means we can't handle TeX math with more than 1000 levels of
    `{..}` nesting, but no real formula will go this far.
    * Math extension: do not allow math closer followed by digit (#167,
    Michael Howell). With this change, closing `$` cannot be
    followed by a decimal digit. For example, `$1$` is fine, but
    `$1$2` is not. This avoids some false positives like `Current
    conversion rate makes US$99 about A$137`.
    * Fix the blank line scanner after the `]` (Michael Howell).
    * Fix disagreement with GitHub about block nesting in tasklists
    (Michael Howell). Text on the same line as the task marker can't
    start a block. It has to be paragraph text.
    * Fix incorrectly computed indent on `task_list` (Michael Howell).

++++ ghc-commonmark-pandoc:

  - Update commonmark-pandoc to version 0.3.
    [#]# 0.3
    * Define Applicative instances of IsBlock, IsInline etc.
    (Ashley Yakeley).
    * Track wikilinks with a class instead of the title (Evan Silberman).
    The use of `title="wikilink"` in HTML output likely traces back to
    Pandoc's hijacking of the title attribute for this purpose back when
    Pandoc links didn't have Attrs. A coordinated change in Pandoc moves
    this more appropriately into a class.

++++ ghc-http-types:

  - Update http-types to version 0.12.5.
    Upstream has renamed and modified the change log file(s) in this
    release. Unfortunately, the automatic updater cannot reliable
    determine relevant entries for this release.

++++ gnome-boxes:

  - Add qemu-chardev-spice, qemu-hw-usb-smartcard,
    qemu-hw-usb-redirect and qemu-hw-usb-host Requires: Minimum
    needed for gnome-boxes to use qemu.

++++ gpgme:

  - Update to 2.1.0:
    * New flags "is_de_vs" and "beta_compliance" for encryption
    results
    * New decryption flag GPGME_DECRYPT_SESSION_HASH and new field
    session_hash in gpgme_decrypt_result_t.  For details see the
    gpg option --show-session-key
    * Setting of attributes for CMS signatures is now supported via
    gpgme_sig_notation_add
    * New context flag "export-filter"
    * Extend the internal gpgsm_assuan_simple_command to consume all
    received lines.  This fixes a possible lockup introduced by a
    fix for a previous issue
    * Fix passphrase cancel handling
    * Handle the case when pinentry is invoked multiple times
  - drop gpgme-Treat-empty-DISPLAY-variable-as-unset.patch, included

++++ gpgmepp:

  - Update to 2.1.0:
    * New methods to query the compliance of encryption results
    * New function Subkey::keyGrips to get the list of keygrips for
    a subkey using combined algorithms
    * New function Context::generateRandomZBase32String to get a
    cryptographically strong string of z-base-32 characters

++++ heroic-games-launcher:

  - Fix Cannot find module 'locate-path' (boo#1266288)
  - Fix runtime crashes caused by missing modules inside the ASAR archive:
    * Force injection of ajv, ajv-formats, and builder-util-runtime
    into production dependencies during offline tarball generation.
    * Fix build failure with electron-builder >= 26.12 by removing
    deprecated 'shrinkwrapIgnoreDev' schema property.
  - Refactor get-sources.sh:
    * Preserve upstream dependency tree structure.
    * Restore optional dependencies for esbuild, swc, and rollup to
    properly support multi-arch (aarch64) builds.
    * Simplify pnpm overrides and lockfile generation.
  - Clean up spec file:
    * Move architecture-specific binary cleanup to the %install phase.
    * Remove unused build dependencies (@esbuild, @swc, @rollup)
    from the final package to reduce RPM size.
    * Optimize stripping of native .node binaries.
    * Fix rpmlint duplicated files warnings by applying %fdupes -s
    across the entire Heroic installation directory.
    * Removing release_tags that are no longer needed.

++++ icinga2:

  - Update to version 2.16.1:
    * Revert "Merge pull request #10668 from Icinga/perfdata-writers-connection-handling"
    * Update version to v2.16.1
    * Update changelog for v2.16.1
    * Revert "Merge pull request #10799 from Icinga/fix-pdwc-tls-host-check"
    * Fix openSUSE 15.6 GitHub actions
    * docs: note OTLP metrics package limitation on Debian 11 and Ubuntu 22.04 and Amazon Linux 2
    * Add Fedora 44 to CI workflow
    * Add Ubuntu 26.04 to CI workflow

++++ noise-suppression-for-voice:

  - Update to version 1.21:
    * build: Fix macOS juceaide deployment target
    * JUCE/VST2: Prevent crash with null speaker arrangements
    * JUCE: Disable LTO for juceaide to save build time
    * JUCE: Add LV2_COPY_DIR property
    * JUCE: Remove splash screen
    * JUCE: Use FST headers instead of VST2
    * git subrepo clone --force external/JUCE 7.0.12
    * build: Adjust project for JUCE 7.0.12
    * build: Disable ladspa plugin by default with MSVC compiler
    * ci: Update to windows-2022
    * build: Properly set opt level for different compilers in Release
    * ci: Fix Linux build
    * build: Fix macOS build
    * ci: Update ccache-action
    * ci: Update to actions/upload-artifact v4
    * build: Fix Clang linking issue
    * feat: Enable IPO/LTO for release
    * feat: Use INT8 weights by default, yielding 4x speed with AVX
    * docs: Fixup example of pipewire configuration
    * fix: Use unique LADSPA plugin IDs
    * fix: Treat last voiced block as initially absent
    * feat: Add audio evaluation tool
    * docs: Add macOS plugin installation instructions
    * docs: Improve Equalizer APO setup instructions
    * feat: Raise default VAD threshold
    * feat: Add dry mix control
    * build: Raise CMake minimum version
    * build: Default JUCE source directory
    * build: Declare top-level project version
    * build: Enable RNNoise RTCD for release builds
    * build: Detect UBSan before enabling it for tests
    * external/rnnoise: Update generated weights
    * git subrepo pull (merge) external/rnnoise

++++ libcdirectory:

  - Update to release 20260530
    * Support for Linux whiteout file objects

++++ libcfile:

  - Update to release 20260530
    * No changelog was provided

++++ libcpuid:

  - Update to version 0.8.1 (includes 0.8.0):
    * Add detection for many new CPUs: Intel Lunar Lake, Arrow Lake
    (incl. -HX/-U/-H), Twin Lake, Granite Rapids-SP, newer Raptor
    Lake variants; AMD Turin Dense, Strix Halo, Krackan Point;
    plus more ARM CPUs and ARMv9.5-A support
    * Add technology_node field to struct cpu_id_t
    * 0.8.0 is a backwards-incompatible release: the size of
    cpu_raw_data_t and cpu_id_t changed
    * Build the Python bindings without requiring wheel
    * Several build-warning and portability fixes
    * Massive CPU database updates

++++ libfvalue:

  - Update to release 20260531
    * Add missing public declarations for
    `libfvalue_data_handle_append_value_entry`
  - Delete 0001-Export-libfvalue_value_get_entry.patch (merged)

++++ msgpack-c:

  - Update to release 7.0.0
    * Updated just build requirements

++++ qgpgme:

  - Update to 2.1.0:
    * Fixed assertion when parsing DNs that end with a hex string
    * Allow forcing the deletion of secret keys without confirmation
    * Allow specifying an export filter when exporting keys

++++ quazip-qt5:

  - Update to 1.7.1
    * Fix two installation issues in regard to QTextCodec support

++++ quazip-qt6:

  - Update to 1.7.1
    * Fix two installation issues in regard to QTextCodec support

++++ libwtcdb:

  - Update to release 20260527
    * Safer path handling in wtcdbtools

++++ matomo:

  - Update to 5.10.1
    * Security
  - 24468: Store and verify user on 2FA verification process.
  - 24567: Improve Row evolution.

++++ msgpack-cxx:

  - Update to release 8.0.0
    * Add missing include for <type_traits>

++++ nushell:

  - Update to version 0.113.1:
    This patch release fixes issues introduced in 0.113.0, including
    YAML string quoting behavior, reliability problems across the `idx` command
    family, and a REPL regression in `commandline edit`.
    For a full list of changes see:
    https://www.nushell.sh/blog/2026-05-30-nushell_v0_113_1.html
  - Update to version 0.113.0:
    + Fast file search with `idx` command family for in-memory indexing
    and search (files, dirs, find, search, export, import)
    + Stream inspection without collection via `peek`
    + Verbose file operations (`mkdir -v`, `mv -v`, `rm -v`) now
    return structured tables
    + `from md` now defaults to a more concise human-friendly output
    mode (previous AST mode behind `--verbose`)
    + Fish-style abbreviations that expand on enter/space
    + Breaking changes
    * `kill` signal shorthand handling updated; use `kill -s N pid`
    * `parse` no longer implicitly splits byte streams into lines
    * `mkdir -v`, `mv -v`, `rm -v` return tables instead of strings
    * `from xlsx --header-row` default changed to first non-empty row
    + Additions
    * Preserve TOML comments when saving files
    * Named gradients for `ansi gradient` (rainbow, pastel, etc.)
    * New vi normal mode commands: `o` and `O`
    * Terminal emulator progress bars via `std-rfc/pb`
    * `peek` command for inspecting streams without collecting
    * 20+ new `polars selector` subcommands
    * `idx` family: `idx init`, `idx status`, `idx dirs`, `idx files`,
    `idx find`, `idx search`, `idx export`, `idx import`, `idx drop`
    * Custom completions can filter by description
    * `std-rfc/iter prod` for cartesian products
    * `to nuon --no-commas` flag
    * `pre_prompt`/`env_change` hooks can modify the commandline
    * `ps -l` now has `virtual`, `working`, `paged` columns
    * History config values locked during REPL with clear errors
    * Other additions
    + Deprecations
    * `watch` optional closure argument deprecated
    * Implicit `name` column for `grid` deprecated
    + Removals
    * Removed `--datasource-ls` of `metadata set`
    + Other changes
    * `to csv`/`to tsv` now stream to `save` without buffering
    * `to yaml` correctly quotes string values
    * Default MCP promote-after raised to 2m
    * Dynamic dispatch for `%` sigil with `%($cmd)` and `%$cmd`
    * Improved escape handling with more validated sequences
    * `env_hook` case insensitive for `PWD`
    * Additional changes
    + Bug fixes
    * Fix internal sigil recursion error
    * `http` commands now respect `$env.NO_PROXY`
    * `finally` no longer suppresses error messages
    * Return value of `finally` is the value of `try`/`catch`
    * Fix Rename event path order in `watch`
    * Fix `try` executing code twice
    * `try` blocks can now be interrupted with ctrl-c
    * Annotated default values typed as `glob` are properly handled
    * `mkdir` tries all directories even if errors occur
    * Empty blocks' output types match their input types
    * Fix hash-quoting for `to nuon --raw-strings`
    * Other fixes
    + For a full list of changes with detailed descriptions, see:
    https://www.nushell.sh/blog/2026-05-23-nushell_v0_113_0.html

++++ pantheon-dock:

  - Update to version 8.3.3:
    + Introduce Itemgroup
    + Updated translations
    + Fix typo

++++ polari:

  - Update to version 50.0:
    + Improve thumbnails on HiDPI display.
    + Port thumbnailer to GTK4.
    + Misc. bug fixes and cleanup.
    + Updated translations.
  - Add fdupes BuildRequires and macro, remove duplicate files.

++++ regreet:

  - Update to version 0.4.0:
    + Config option to skip selecting user/session, with auto-login support and
    info message on skip. Passwordless users are excluded from auto-login
    + Added background image/webp/gif/video support via GStreamer
    + GTK4 pango markup is now supported in the clock widget format (the
    widget.clock.format configuration options)
    + The background_fit configuration option is now case-insensitive
    + greetd info messages are now displayed as notifications, just like greetd
    error messages
    + Session dropdown is not empty anymore on a fresh state file
    + Hid the border of the notification bar frame that shows up even when no
    notification is displayed

++++ ryzenadj:

  - update to 0.19.0:
    * Update readme (gh#FlyGoat/RyzenAdj#348)
    * krackan point: use full name (gh#FlyGoat/RyzenAdj#351)
    * update for ryzen_smu 0.1.7 (gh#FlyGoat/RyzenAdj#352)
    * add strix point table from ryzen_smu (gh#FlyGoat/RyzenAdj#353)
    * Add basic Dragon Range and Fire Range support
    (gh#FlyGoat/RyzenAdj#359)
    * wrap macro argument usage in parentheses (gh#FlyGoat/RyzenAdj#364)
    * added support for PRO variant of HX 370 (gh#FlyGoat/RyzenAdj#360)
    * api: add more table offsets for Strix Point
    (gh#FlyGoat/RyzenAdj#366)
    * Improve Krackan Point support (gh#FlyGoat/RyzenAdj#368)
    * lib: osdep_linux: fix license headers (gh#FlyGoat/RyzenAdj#376)
    * main: add missing family name strings (gh#FlyGoat/RyzenAdj#378)
    * Fix spelling mistakes across documentation, CLI, and Windows
    tooling (gh#FlyGoat/RyzenAdj#389)
    * feat: add support for Strix Point PM Table version 0x005D0009
    (gh#FlyGoat/RyzenAdj#394)
    * fix: PM table size mismatch on Raven/Picasso with ryzen_smu
    (gh#FlyGoat/RyzenAdj#399)
    * api: add Strix Point PM table version 0x5d000b support
    (gh#FlyGoat/RyzenAdj#403)

++++ switchboard-plug-about:

  - Update to version 8.2.3:
    + HardwareView: Fallback to "Unknown Processor" instead of blank CPU name
    + ARMPartDecoder: Update ARM CPU mapping table with util-linux 2.39.3

++++ switchboard-plug-sound:

  - Update to version 8.0.3:
    + CanberraGtk4: Don't write if as else-if
    + meson: Fix warnings
    + Fix empty "Applications" tab
    + AppRow: Fix default toggle position

++++ vermouth:

  - Bump to version 1.8.4
  - Upstream changes:
    * Menu items and flatpak fixes (#48)
    * Add multiarch permission to flatpak configs
    * Updated readme, sums and commits

++++ xdg-desktop-portal-pantheon:

  - Update to version 8.2.0:
    + A new design for Portals
    + Updated translations

------------------------------------------------------------------
------------------  2026-5-30  -  May 30 2026  -------------------
------------------------------------------------------------------

++++ adriconf:

  - Update to version 2.7.4
  - Stop using the deprecated %suse_update_desktop_file macro;
    install the desktop file (Source1) directly and drop the
    update-desktop-files BuildRequires
  - Install the .desktop and icon as 0644 instead of 0755
  - Run the upstream unit tests via ctest in a %check section:
    * Add adriconf-system-gtest.patch to build the tests against
    the system GTest/GMock instead of downloading googletest at
    build time (which needs network access), and to register the
    test binary with CTest
  - Drop obsolete Group tag

++++ uwsgi:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ bitcoin:

  - Update to version 31.0 (from 28.1; includes the 29.0 and 30.0
    major releases). Highlights across these releases:
    * Build system migrated from Autotools to CMake
    * Legacy BerkeleyDB wallet support removed; only descriptor
    (SQLite) wallets remain
    * Built-in UPnP port-mapping support removed
    * New unified "bitcoin" command-line wrapper
    * Numerous P2P, mempool policy, RPC and wallet improvements
    * See the upstream release notes for the full details
  - Port the package to the CMake build system
  - Build the GUI against Qt6 (was Qt5); rename the GUI subpackage
    from bitcoin-qt5 to bitcoin-qt6 (Obsoletes for a clean upgrade)
  - Add fix-boost-1.91-multi_index.patch: fix the build against
    Boost >= 1.91 (bitcoin/bitcoin#35175)
  - Drop now-unneeded BuildRequires:
    * libdb-4_8-devel (legacy BDB wallet removed)
    * libminiupnpc-devel (UPnP removed)
    * pkgconfig(protobuf), pkgconfig(openssl) (BIP70 long gone)
    * autoconf, automake, libtool (Autotools replaced by CMake)
    * java-devel, lcov, git
  - Convert BuildRequires to pkgconfig() style and express the
    upstream minimum versions (Boost 1.74, libevent 2.1.8,
    SQLite 3.7.17, Qt 6.2)
  - Stop using the deprecated %suse_update_desktop_file macro;
    ship bitcoin-qt.desktop (Source2) and install it directly,
    and drop the update-desktop-files BuildRequires
  - Drop the incorrect update-desktop-files post/postun scriptlets
    (the desktop database is refreshed by file triggers)

++++ boringssl:

  - Drop 0001-Compile-for-RISC-V.patch: it was an orphaned source
    (shipped but unreferenced, tripping the factory-auto check that
    caused the previous decline) and is obsolete anyway -- the
    pinned boringssl snapshot already carries the RISC-V detection
    in include/openssl/base.h
  - Spec cleanup: drop obsolete Group tags and use macros for paths

++++ chirp:

  - Update to version 20260529:
    * Fix RT-900 non-BT, increase to 999 channels.
    * Fix escape character in log message for UV-5R Mini

++++ clang-extract:

  - Update to version 0~20260529.63e5c9b:
    * Add support for LLVM-22

++++ cozette-fonts:

  - Update to version 1.30.0:
    * Huge changelog. See CHANGELOG.md.

++++ ebizzy:

  - Fix a typo in the summary (applicatin -> application)
  - Spec cleanup: modernize the License tag to SPDX GPL-2.0-only,
    drop obsolete Group/BuildRoot/%defattr, mark LICENSE as
    %license, add missing BuildRequires: gcc

++++ golang-github-prometheus-prometheus:

  - update to 3.12.0:
    This release contains security fixes, new features (especially
    around PromQL and Service Discovery), performance improvements in
    TSDB, Start Timestamp improvements and numerous bug fixes.
    Key Highlights
    * Security: Two security vulnerabilities have been addressed: a
    denial of service in remote-write (snappy decompression limit)
    and a secret exposure leak in STACKIT service discovery.
    * PromQL & Metadata: Several features and bug fixes related to
    the experimental "start timestamps" support, including updates
    to rate(), irate(), increase(), and resets(). New experimental
    functions start(), end(), range(), and step() are introduced.
    * TSDB Performance: Optimizations in head chunk lookup (constant
    time) and mmap operations to reduce CPU usage.
    * Service Discovery: Added support for DigitalOcean Managed
    Databases and Outscale VM, along with improvements to AWS SD
    (IPv6 support for EC2, external ID support).
    * UI: Added a web interface for deleting time series and cleaning
    tombstones.
    Changelog
    * [SECURITY] Remote: Reject snappy-compressed received requests
    via Remote Write whose declared decoded length exceeds the
    32MB. Thanks to @hibrian827 for reporting it. #18642
    * [SECURITY] STACKIT SD: Fix secrets being exposed in plaintext
    via /-/config endpoint. Thanks to @August829 and @Phaxma for
    reporting. GHSA-39j6-789q-qxvh #18649
    * [SECURITY] CVE-2026-39821: Fix validation bypass and privilege
    escalation by updating golang.org/x/net to version 0.55.0
    (bsc#1266608)
    * [CHANGE] TSDB/Agent: Adds Start Timestamp field to all WAL
    Histogram samples in memory; used st-storage flag is enabled.
    [#18221]
    * [FEATURE] API: Add /api/v1/status/self_metrics endpoint
    returning the current state of the Prometheus server's own
    metrics about itself as JSON. #18411
    * [FEATURE] Discovery: Add DigitalOcean Managed Databases service
    discovery #18287
    * [FEATURE] Prometheus: Add support for the aix/ppc64 compilation
    target #18321
    * [FEATURE] Discovery: Add Outscale VM service discovery
    (outscale_sd_configs) for discovering scrape targets from the
    Outscale Cloud API. #18139
    * [FEATURE] PromQL: Emit a warning when sort, sort_by_label or
    sort_by_label_desc is used within range (matrix) queries, as
    these functions do not have effect in that context. #18498
    * [FEATURE] PromQL: Add start(), end(), range(), and step()
    experimental functions #17877
    * [FEATURE] PromQL: Update resets() function to consider start
    timestamp resets. Hidden behind use-start-timestamps feature
    flag. #18627
    * [FEATURE] Prometheus: Promote auto-reload-config as stable
    [#18620]
    * [FEATURE] TSDB/Agent: Add CheckpointFromInMemorySeries option
    to agent.DB that enables checkpoint based on in-memory series.
    [#17948]
    * [FEATURE] UI: Add a web interface for deleting time series and
    cleaning tombstones, accessible from the Status menu. #18390
    * [FEATURE] PromQL: Use start timestamps for rate(), irate(), and
    increase() calculations, behind a feature flag
    use-start-timestamps. Doesn't work together with extended range
    selectors anchored and smoothed. #18344
    * [FEATURE] Scrape: Added a feature flag st-synthesis which
    synthesizes unknown STs for scraped cumulative metrics. Useful
    when Remote Writing 2.0 with delta or Otel-based backends.
    [#18279]
    * [FEATURE] promqltest: support @st annotation in load blocks to
    specify per-sample start timestamps. #18360
    * [ENHANCEMENT] API: reject concurrent fgprof profiles. #18651
    * [ENHANCEMENT] AWS SD: Add optional external_id field to
    ECS/MSK/RDS/Elasticache. #18579
    * [ENHANCEMENT] AWS SD: Add optional external_id field. #17171
    * [ENHANCEMENT] Discovery: Propagate SD target updates faster by
    introducing dynamic backoff interval instead of static 5s
    interval for throttling. #18187
    * [ENHANCEMENT] Promtool: Add --header flag to query instant
    command, matching existing query range behaviour. #18418
    * [ENHANCEMENT]: AWS SD: Allows EC2 service discovery to discover
    IPv6 addresses to communicate with target endpoints. The
    private IPv4 address remains the default when both IPv4 and
    IPv6 addresses are present. #16088
    * [PERF] TSDB: Make head chunk lookup in range queries constant
    time instead of quadratic time #18302
    * [PERF] TSDB: Skip entire stripes in mmapHeadChunks when no
    series need mmapping, reducing CPU utilization significantly at
    production-relevant scales. #18541
    * [PERF] TSDB: Skip clean series during periodic head chunk mmap
    using cached head chunk count #18272
    * [PERF] PromQL: Address FloatHistogram.KahanAdd performance
    regression on Go 1.26. #18568
    * [BUGFIX] PromQL: Fix info() function incorrectly handling
    negated __name__ matchers #17932
    * [BUGFIX] API: Return duration expressions in /parse_ast. #18624
    * [BUGFIX] API: correctly document formats accepted for duration
    query request parameters (step, timeout and lookback delta) in
    OpenAPI spec #18305
    * [BUGFIX] Scrape: AppenderV2 now tracks staleness even when
    OOO/duplicate series errors happen similar to AppenderV1 #18567
    * [BUGFIX] Config: Validate remote_write queue_config fields at
    load time to prevent runtime panic and silent misconfiguration.
    [#18209]
    * [BUGFIX] Discovery/Consul: Add health_filter for Health API
    filtering, fixing breakage when using Catalog-only fields like
    ServiceTags in filter. #18479 #18499
    * [BUGFIX] OTLP: limit decompressed body size for gzip-encoded
    OTLP write requests. #18408
    * [BUGFIX] PromQL: Fix smoothed rate/increase returning zero
    instead of no result when all data falls strictly after the
    query range. #18523
    * [BUGFIX] PromQL: Fix metric name not being dropped when
    last_over_time or first_over_time is applied to subqueries
    containing name-dropping functions like abs(). #18409
    * [BUGFIX] PromQL: Fix missing warning when mixing exponential
    and custom-bucket histograms in stats queries. #18660
    * [BUGFIX] PromQL: Fix parsing of range() keyword in duration
    expressions such as foo[5m+range()]. #18623
    * [BUGFIX] PromQL: Fix smoothed vector selector returning no
    results in binary operations when the @ modifier is used.
    [#18531]
    * [BUGFIX] PromQL: Reject NaN, infinite, and out-of-range
    duration expressions instead of silently producing an
    out-of-range time.Duration. #18639
    * [BUGFIX] Scrape: Fix panic when scraping malformed native
    histograms. #18414
    * [BUGFIX] Scrape: fix panic when scraping a target exposing a
    summary with no quantiles via the protobuf format. #18382
    * [BUGFIX] Scrape: fix scrape failure log file occasionally not
    applied after a configuration reload. #18421
    * [BUGFIX] TSDB: Allow retention percentage with new data path.
    [#18628]
    * [BUGFIX] TSDB: Preserve decimal precision in percentage-based
    retention #18374
    * [BUGFIX] TSDB: fix prometheus_tsdb_head_chunks going negative
    after WAL replay #18401
    * [BUGFIX] TSDB: panic with native histograms during query of
    overlapping chunks. #18692
    * [BUGFIX] Tracing: fix startup failure for insecure OTLP HTTP
    tracing #18469
    * [BUGFIX] UI: Escape label values offered by PromQL
    autocomplete. #18658
    * [BUGFIX] UI: Improve Y-axis tick label precision for graph
    values over small ranges. #18682
    * [BUGFIX] prometheus_sd_refresh* and
    prometheus_sd_discovered_targets metrics for specific scrape
    jobs are deleted when the scrape job is removed. #17614
    * [BUGFIX] Remote: fixed validation for received RW2 requests
    when parsing metadata unit symbols. This fixes a case when
    request would cause (recovered) handler panic. #18641
    * [BUGFIX] TSDB/Agent: fix race in agent appender where
    concurrent appends for the same label set could produce
    duplicate in-memory series and duplicate WAL records. #18292
    * [BUGFIX] Config: Update --enable-feature flag description and
    sort feature names. #18487

++++ govc:

  - Update to version 0.54.1:
    * chore(deps): bump dessant/lock-threads from 6.0.1 to 6.0.2
    (#4023)
    * chore(deps): bump dessant/lock-threads from 6.0.0 to 6.0.1
    (#4019)
    * chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#4020)
    * chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to
    7.2.2 (#4018)

++++ goverlay:

  - Update to version 1.8.2:
    * Non-Steam games management
    * vksumi support
    * proton tweaks
    * UI improvements
    * Fixes

++++ gpu-screen-recorder:

  - Update to version 20260529:
    + Fixes
  - Fixed -c whip not working for live streams
    (avoid avio_open on live streams)
  - Added libavformat version check before using
    hybrid_fragmented
    (workaround for old FFmpeg bugs)
  - Fixed gsr_pipewire_video_remove_modifier removing
    incorrect modifiers
  - Fixed audio/video desync when recording while
    replaying or streaming
    + PipeWire / Portal
  - Added fallback to no modifier for PipeWire video capture
  - Added fallback to no modifier for desktop portal capture
  - Fixed PipeWire modifier handling
    + Plugins
  - Added is_damaged and clear_damage APIs
  - Added screenshot plugin support
  - Added invert Y-axis plugin example
    + Vulkan
  - Implemented Vulkan Video encoding
    (H.264, HEVC, AV1)
  - Removed Vulkan dependency from Meson
    (only headers are required)
    + Misc
  - Added --list-monitors option
  - Added -low-power option for AMD GPUs
  - Removed deprecated overclocking option

++++ gpu-screen-recorder-gtk:

  - Update to version 20260415:
    * Remove steam deck warning
    * Update to new startup scheme (xdg autostart instead of systemd)
    * More info about input remapping software

++++ hobbits:

  - Build with Ninja (%define __builder ninja) via %cmake_build for
    faster builds
  - Build with -fsigned-char: bitarray.cpp initialises char[] bit
    masks with negative literals (-128, -65, ...), which fails to
    compile where char is unsigned by default (aarch64, ppc64le,
    s390x, ...)

++++ python-plotly:

  - Skip testing with scikit-image and xarray for python311:
    Python 3.11 is out of SPEC-0 and packages drop support

++++ kbom:

  - Update to version 0.3.4 (no releases between .1 and this one):
    * Do not push docker image
    * Ignore unsupported windows/arm build target
    * Fail on high
    * Update deps
    * FIx linter
    * Bump go version, fix vulnerabilities
    * Update homebrew tap repo name to rad-security/homebrew

++++ kubelogin:

  - Update to version 0.2.18:
    * What's Changed
  - Add kubelogin-version.txt as a release asset to avoid GitHub
    API rate limits by @Copilot in #749
    * Maintenance
  - Bump kubelogin build toolchain pins to Go 1.26.3 for
    CVE-2026-27137 remediation by @Copilot in #753
  - Update README with official Azure kubelogin sources by @bcho
    in #751

++++ kubescape:

  - Update to version 4.0.9:
    * fix: populate generationTime in JSON report and invocations in
    SARIF (#2331)
    * fix(cautils): make SetTopWorkloads idempotent (#2330)
    * feat(getter): resolve namespaceSelector for cluster exceptions
    (#2322)
    * anonymizer: hide git repository context metadata (#2327)
    * fix(opaprocessor): isolate rego dependency control inputs
    (#2329)
    * fix(imagescan): repair interleaved type definitions in test
    file (#2328)
    * test: add fixhandler and report conversion coverage (#2248)
    * test: add containerscan unmarshal coverage (#2246)
    * test(imagescan): cover severity threshold (#2211)
    * anonymize resource source metadata in hidden output (#2326)
    * test(imagescan): cover severity filtering (#2210)
    * fix(cache): canonicalise framework/control cache filenames
    (#2313)
    * Add image command RunE tests (#2182)
    * test(opaprocessor): cover mapControlToInfo (#2208)
    * chore(deps): bump dependencies to fix security advisories
    (#2324)
    * fix(opaprocessor): preserve cluster-scoped paths across
    namespace iterations (#2311)
    * fix: propagate context through cosign OPA built-in functions
    (#2191)
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#2318)
    * chore(deps): bump github.com/containerd/containerd/v2 (#2319)
    * docs: add Gitlab CI/CD Integartion Guide with gitlab-ci.yml
    example (#2310)
    * fix: nil pointer panic in SARIF, HTML, and JUnit printers when
    control is missing from summary details (#2315)
    * fix(anonymizer): anonymize annotation values for hidden scans
    (#2316)
    * fix: restore kubescape_resource_* metrics in prometheus output
    (#2256)
    * fix: close output file after each printer finishes to prevent
    file descriptor leak (#2259)
    * fix(printer): bucket failed controls by their own category, not
    a hardcoded ID allowlist (#2306)
    * fix: add --scan-timeout flag and fix context propagation in K8s
    resource collection (#2305)
    * Emit SecurityException events for posture exception matches
    (#2291)
    * Feat/vap enforcement reconcile (#2307)
    * Prevent PR scanner checkout from failing on stale submodule
    metadata (#2309)
    * fix(anonymizer): extend --hide coverage for container config
    references (#2300)
    * ci(workflows): pin Go via go.mod instead of undefined
    GO_VERSION input (#2302)
    * fix: validate threshold ranges in scan image and patch commands
    (#2274)
    * fix: resolve TOCTOU race in TimedCache.invalidateTask() (#2295)
    * fix: normalize mixed-case manifest extension detection (#2293)
    * feat(diff): add kubescape diff command to compare two scan
    reports (#2245)
    * feat(fix): emit values.yaml guidance for Helm-rendered
    resources (#2083)
    * clarification for score threshold scope (#2290)
    * fix: prevent panic from double-close of stopChan in (#2288)
    * docs: add Jenkins CI/CD integration guide with Jenkinsfile
    example (#2278)
    * chore: refresh branch mergeability
    * fix(imagescan): harden custom DB URL validation
    * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0
    * fix(bugs): clearning blockers
    * fixing lint errors
    * fix(fixhandler): reconcile unfixed controls against planned
    YAML edits
    * fix: add bounds check before accessing container index in
    addContainerNameToAssistedRemediation
    * fix: add bounds check before accessing container index in
    addContainerNameToAssistedRemediation
    * fix: deduplicate # HELP and # TYPE headers across multiple
    metric famolies
    * fix(prometheus): add # HELP and # TYPE metadata lines to
    prometheus output
    * fix: add # HELP and # TYPE headers to kubescape_score metric
    Fixes #2237
    * test: cover newline replacement without trailing newline
    * test: cover yml extension detection
    * test: add request and resource handler coverage
    * chore: refresh branch mergeability
    * test: add hostsensor CRD coverage
    * test: add metrics and ksinit coverage
    * test: add v1 printer coverage
    * Nil guard for kubernetes client initialisation
    * fix(tests): correct import statement placement in setup_test.go
    * test(rootutils): remove redundant logger name tests and update
    BoolPtrFlag error handling
    * fix(opaprocessor): sanitize namespace split parsing
    * test(imagescan): fix DB load validation tests damaged after
    rebase
    * fix(crd): add optionalOldSelf to CEL rule so it fires on CREATE
    * test(cautils): handle os.WriteFile error in TestIsFileAndIsDir
    * fix(crd): use oldSelf in CEL rule for expiresAt to support
    GitOps reconcilers
    * test(cautils): add TestIsFileAndIsDir unit test
    * test(cautils): expand floatutils tests
    * test(cautils): expand normalize image name tests
    * test(cautils): add unit tests for BoolPtrFlag, isHTTPURL,
    unique, GetInputFiles, Cleanup and helpers
    * test(cmd): cover KS_LOGGER_NAME env
    * test(cmd): cover initLogger name precedence
    * test(cautils): assert operator scan request fields
    * test(metrics): assert Init registers counters
    * fix(coderabbit): Coderabbit findings
    * fix(patch): use ExporterDocker + docker load for no-push path
    * vap: resolve CEL control IDs for policy bindings
    * test(cmd): cover KS_LOGGER_NAME env
    * ci: fix indentation in dependabot.yaml
    * test(imagescan): cover default matcher config
    * test(httphandler): add unit tests for RecoverFunc panic handler
    * ci: fix indentation in dependabot.yaml
    * test(cautils): add unit tests for YAML separator, mergeMaps,
    and splitYAMLDocuments
    * ci: fix indentation in dependabot.yaml
    * test(fixhandler): add unit tests for YAML handler helpers
    * test(cautils): add unit tests for datastructures helpers
    * test(cautils): add unit tests for operator scan info validation
    * ci: fix indentation in dependabot.yaml for httphandler gomod
    entry
    * test(metrics): add unit tests for Init and Update functions
    * test(imagescan): cover DB load validation
    * ci: add gomod Dependabot entry for httphandler module
    * fix: propagate context through httphandler storage API calls
    * ci: pin Codium-ai/pr-agent to full commit SHA in comments.yaml
    * ci : add github-actions ecosystem to dependabot config
    * test(opaprocessor): cover manual review summary
    * test(listener): cover TLS key loading
    * test(listener): cover env config helpers
    * fix: add error log when ProcessRulesListener fails in scan.go
    * test(imagescan): cover default DB config
    * refactor: replace unstructured Warning(err.Error()) with
    helpers.Error(err) in fix.go
    * refactor: replace unstructured Warning(err.Error()) with
    helpers.Error(err) in customerloader.go
    * Fix lint baseline issues
    * fix(patch): use canonical image reference for buildkit export
    name
    * fix(printer): never fall back to stdout for pdf/html on
    file-create errors
    * test(anonymizer): reorganize and expand unit coverage
    * test(imagescan): cover default db config
    * unit tests for user push opt in
    * fix(printer): wire PartialGVRPulls into report serialization
    and CLI output
    * fix(resourcehandler): surface partial GVR collection failures
    instead of silently suppressing them
    * fix: User must opt in to push, default behaviour is now false
    * fix(httphandler): set response.Type on successful GET /results
    * test: keep BoolPtrFlag state on unknown
    * refactor: replace fmt.Sprintf with structured helpers.Error in
    getHostSensorHandler
    * fix(coderabbit): coderabbit findings
    * fix(printer): default pdf/html output to file instead of stdout
    * fix: filter empty and whitespace-only --format entries
    * test: cover patch default tags
    * perf: parallelize K8s resource collection in pullResources
    * test: cover requiresResourceMatch designator constraints
    * Add BoolPtrFlag unit tests
    * test(httphandler): assert wantType in offline fallback table
    test
    * Use deduplicated unfixed control count in summary
    * Add threshold bounds unit tests
    * Add workload identifier parsing tests
    * Fix control scan validator error
    * fix(anonymizer): support unstructured container metadata
    anonymization
    * test: expand scan validators coverage
    * test: expand workload scan unit tests
    * fix: route PrometheusPrinter.Score() output to pp.writer
    instead of stdout Fixes #2176
    * fix: honor namespace argument in list_vulnerability_manifests
    MCP tool
    * Fix inverted keepResults cleanup logic
    * test(httphandler): cover Results endpoint state and
    offline-fallback branches
    * fix: validate --format flag value in patch command before
    running
    * fix: replace read-all with explicit permissions for fork PRs
    * fix: explicit --account and --access-key flags take precedence
    over env vars
    * fix: use flag.Changed to detect explicit --cache-dir,
    preventing KS_CACHE_DIR override
    * test(resourcehandler): add edge case coverage for empty and
    malformed namespace inputs
    * Fix field selector state carryover across resource queries
    * fix(resourcehandler): dedupe cluster-scoped LISTs under
  - -include-namespaces
    * fix: trim whitespace in Formats() to normalize comma-separated
    tokens
    * Use deduplicated unfixed control count in summary
    * Fix false-positive master node taint classification
    * Avoid nil source dereference in report marshal logging
    * docs: fix misleading Short and Long description in patch
    command
    * fix: anonymize labels-to-copy values when --hide flag is set
    * fix: propagate request context through CallTool to Kubernetes
    API calls (fixes #2145)
    * test: add regression test for anonymizeEphemeralContainerList
    with runtime []interface{} shape
    * add account id validation tests
    * fix: always propagate f.Close() error in writeScanErrorToFile
    * add scan info policy tests
    * fix: resolve variable shadowing in writeScanErrorToFile
    * add attack track printer tests
    * add rbac report tests
    * fix: handle error from defer f.Close() in writeScanErrorToFile
    * fix: handle error from defer f.Close() in writeScanErrorToFile
    * fix: use JSON marshal/unmarshal in anonymizeContainerList to
    replace broken type assertion (fixes #2132)
    * fix: correct typo 'arguement' to 'argument' in
    completion_test.go
    * fix: clear Env[].ValueFrom in removeContainersData and
    removeEphemeralContainersData (fixes #2131)
    * fix: correct typo 'arguement' to 'argument' in completion.go
    * refactor: replace log.Printf with logger.L().Info() in
    mcpserver.go
    * feat(scan): anonymize container names and images for --hide
    * Improve validation and error handling for config set
    * add core patch os tests
    * fix(coderabbit): extract dedup helper, add partial-control
    regression test, strip UTF-8 BOM
    * fix(review): phase-aware unfixed summary and per-rule fix
    tracking
    * test: add coverage for Status handler and serverState lifecycle
    * Respect CLI logger flag precedence over KS_LOGGER
    * fix: preserve delete-all behavior for results endpoint
    * Preserve RelatedResourcesIDs in scanned control rules
    * fix(coderabbit): Exorcising the bugs coderabbit caught
    * fix: report controls that  did not auto-remediate
    * test: seed and assert ResourceAttackTracks remap in ID
    consistency test
    * fix: clear EnvFrom in removeContainersData to prevent secret
    name leakage
    * test: expand ID consistency test to cover all remapped
    collections
    * test: add unit tests for anonymizer package
    * fix: add request context to score calculation warning log
    * fix: handle error returned by scorewrapper.Calculate() in
    processorhandler.go
    * fix: handle json.Marshal errors in mcpserver CallTool (fixes
    [#2111])
    * fix: harden /v1/results IDOR remediation
    * fix(test): assert flag inheritance on control subcommand
    * fix(scan): validate --fail-coverage-below is in range 0-100
    * fix(scan): enforce coverage threshold in scan control
    subcommand
    * test(junit): table-driven test for skip message across all
    sub-statuses
    * fix: point krew-release-bot at goreleaser-generated manifest
    * fix(scan): remap control summary resource IDs during
    anonymization
    * refactor: replace all context.TODO() with context.Background()
    * refactor: replace context.TODO() with context.Background() in
    downloader/main.go
    * fix(scan): remap control summary resource identifiers during
    anonymization
    * test(junit): Coderabbit - cover Errors aggregation
    independently of Failures/Tests
    * test(junit): add multi-framework regression for
    parent-vs-children counts(Matthias reported bug)
    * fix(scan): anonymize orphan resource references in hidden scan
    output
    * refactor: replace context.TODO() with context.Background() in
    initutils_test.go
    * fix(junit): make --format junit output spec-compliant
    * fix(scan): anonymize resource references across scan results
    * feat(scan): add --fail-coverage-below flag for CI coverage gate
    * test: use valid download target in RunE happy-path test
    * fix: remove unreachable args check and fix arguements typo
    * fix(list): correct missing policy type error
    * Accept advertised base URI format in vulnerability manifest
    parser
    * fix: use StopError on exception/config loading failure
    * fix: strip URI prefix before splitting in ReadResource
    * fix(list): correct typo 'requeued' -> 'required' in error
    message (#2092)
    * fix: correct typo 'requeued' to 'required' in list error
    message
    * fix: avoid malformed skip message when subStatus is empty
    * fix(resourcehandler): build ScanCoverage before GetResources
    error return
    * fix(scan): align hide flag behavior and remove debug traces
    * feat(junit): populate skip message from StatusInfo
    * feat(scan): anonymize resource names and namespaces in scan
    results
    * fix: align mockCounters.All() with real ICounters
    implementations
    * fix(resourcehandler): record failed GVR statuses before
    all-failed early return
    * test: add unit tests for findFile early-exit path
    * docs: add missing supported format values for patch --format
    flag
    * fix(opaprocessor): remove synthetic resource results for
    not-evaluated controls
    * fix:deduplicate pretty-printer fallback and scanType
    * feat(scan): add hide flag and anonymization pipeline scaffold
    * test: address review comments on gotree tests
    * test: add compliance results baseline tests across four
    packages
    * chore(deps): bump github.com/in-toto/in-toto-golang in
    /httphandler
    * chore(deps): bump github.com/in-toto/in-toto-golang
    * typo fixed
    * multiple pretty-printer handled
    * chore(deps): bump k8s-interface to v0.0.209 for multi-group fix
    * multiple format output example added
    * printer validation added
    * fix(policyhandler): close load spinners with StopError on
    failure instead of always StopSuccess
    * test: add coverage for compliance and risk score accessors in
    ResultsHandler
    * fix: handle walk errors and stop early in findFile
    * fix: remove unread buildChannel to prevent goroutine leak in
    patchWithContext
    * fix(resourcehandler): build ScanCoverage before no-resources
    early return
    * feat: report scan coverage gaps and not-evaluated controls
    * docs: fix grammatically incorrect Short description in operator
    vulnerabilities scan command
    * security(ci): pin GHA using SHAs not tags

++++ lego:

  - Update to version 5.2.0:
    * chore: update dependencies (#3145)
    * chore: bump some dependencies major versions (#3144)
    * informaniak: support API v2 (#3139)
    * chore: add more tests on DNS providers (#3143)
    * Add DNS provider for Poweradmin (#3136)
    * Add DNS provider for OpusDNS
  - Update to version 5.1.0:
    * Prepare release v5.1.0
    * chore: improve workflows
    * docs: improve root command description (#3130)
    * chore: update dependencies (#3129)
    * feat: use config file for list related commands (#3128)
    * fix: improve env file parsing on Windows (#3126)
    * Add DNS provider for Dynadot (#3125)
    * Add DNS provider for Connbyte (#3042)
    * fix(cfg): server shortcode evaluation (#3124)
    * timewebcloud: update API client to new API version (#3120)
    * chore: add more tests on DNS providers (#3117)
    * stackpath: provider deprecation (#3116)
    * chore: add more tests on DNS providers (#3115)
    * chore: remove DumpRequest from tests (#3114)
    * simply: update API client implementation (#3113)
    * chore: add no blank issues action (#3112)
    * fix: ignore ARI and random sleep if SANs changed (#3108)
    * chore: enforce run command flags validation (#3107)
    * chore: minor changes
    * chore: improve challenge resolver logs (#3105)
    * chore: improve issue templates
    * docs: fix typos
    * docs: fix templates (#3099)
    * docs: improve hooks documentation (#3098)
    * docs: improve commands reference (#3097)
    * docs: improve references and explanations (#3096)
    * dnsupdate: fix IPv6 nameserver parsing (#3094)
    * Detach v5.0.4

++++ libcpath:

  - Update to release 20260530
    * Safer getcwd implementation

++++ libdb_java-4_8:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ libgphoto2:

  - libgphoto2 2.5.34 release
    ptp2:
    * new Canon EOS SDRAM capture method added
    * new Nikon Z series property code list method added
    * Sony generation 2 vs 3 handling enhanced
    * Security issues fixed:
    * CVE-2026-40333: information disclosure and denial of service via
    unbounded reads in ptp unpack EOS events (bsc#1262445)
    * CVE-2026-40334: information disclosure and denial of service via
    missing null terminator ptp_unpack_Canon_FE (bsc#1262446)
    * CVE-2026-40335: information disclosure via out-of-bounds read
    in ptp_unpack_DPV (bsc#1262447)
    * CVE-2026-40336: memory leak in ptp_unpack_Sony_DPD() can lead to
    denial of service (bsc#1262448)
    * CVE-2026-40338: information disclosure and denial of service
    via out-of-bounds read in the PTP_DPFF_Enumeration case of
    ptp_unpack_Sony_DPD() (bsc#1262449)
    * CVE-2026-40339: information disclosure via out-of-bounds read in
    ptp_unpack_Sony_DPD() (bsc#1262450)
    * CVE-2026-40340: information disclosure and denial of service via
    out-of-bounds read in ptp_unpack_OI() (bsc#1262452)
    * CVE-2026-40341: denial of service via out-of-bounds read from
    untrusted USB devices in ptp_unpack_EOS_FocusInfoEx (bsc#1262454)
    * chdk: several bugfixes for liveview
    * configs:
    * nikon: flashready, infodisperrstatus added
    * sony: exposureprogram mode3, focusdistancemeters, shutter lag timing, focus indication, shutter type, drange optimizer added, silent mode
    * canon eos: remoterelease config values changed
    * panasonic: bulb added
    * leica: detect not yet listed leicas better in generic mode
    * added ids:
    * Sony: ILCE-1M2
    * Nikon: CoolPix P1100, S3500, Z50_2,
    * Canon: EOS R1, R6 Mark III
    * Fuji Finepix S4200, X-E5,
    * Leica SL3
    jd11:
    * allow TIFF / DNG export
    * needs libtiff library to work
    all:
    * some bugfixes
    * replaced various strcpy with strncpy
    translations:
    * updated gregorian, spanish
    * added arabic

++++ modemu2k:

  - modemu2k 0.2.2, initial package

++++ ossim:

  - Drop the redundant "Provides: libossim-devel" from the -devel
    subpackage
  - Fix build with current CMake and GCC:
    * Drop the stale bundled standard CMake modules (an old
    CMakeParseArguments shadowed the built-in and broke
    check_type_size; the old Find* modules error out) and use
    the system ones
    * Build the C sources with -std=gnu17 -- old K&R declarations
    in vpfutil are rejected by GCC's C23 default
  - Add ossim-link-system-tiff.patch: link the system libtiff via
    TIFF_LIBRARIES (set by CMake's own FindTIFF), needed once the
    bundled finders are dropped
  - Build with Ninja via %cmake_build
  - Convert BuildRequires to pkgconfig() style; drop obsolete
    Group tags

++++ subversion:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ linkerd-cli-edge:

  - Update to version 26.5.5:
    * chore(deps): upgrade proxy-init to v2.4.9 & cni-plugin to
    v1.6.8 (#15332)
    * build(deps): bump socket2 from 0.6.3 to 0.6.4 (#15331)
    * build(deps): bump mio from 1.2.0 to 1.2.1 (#15330)
  - Update to version 26.5.4:
    * build(deps): bump zerocopy from 0.8.48 to 0.8.49 (#15328)
    * build(deps): bump hyper from 1.9.0 to 1.10.0 (#15327)
    * chore: update linkerd-await from 0.3.2 to 0.3.3 (#15329)
    * build(deps): bump memchr from 2.8.0 to 2.8.1 (#15321)
    * proxy: v2.354.0 (#15323)
    * build(deps): bump docker/setup-buildx-action (#15312)
    * build(deps): bump bumpalo from 3.20.2 to 3.20.3 (#15309)
    * build(deps): bump autocfg from 1.5.0 to 1.5.1 (#15308)
    * build(deps): bump log from 0.4.29 to 0.4.30 (#15313)
    * build(deps): bump github.com/containerd/containerd from 1.7.30
    to 1.7.32 (#15302)
    * build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0
    (#15304)
    * build(deps): bump serde_json from 1.0.149 to 1.0.150 in the
    serde group (#15303)
    * build(deps): bump either from 1.15.0 to 1.16.0 (#15300)
    * build(deps-dev): bump webpack-dev-server from 5.2.3 to 5.2.4 in
    /web/app (#15282)

++++ marknote:

  - Update to 1.6.0
    * Sub-folders are supported now
    * command bar exposed by Marknote, now allows you to search
    for notes across all your notebooks
    * made it easier to add emojis to your notes

++++ mesheryctl:

  - update to 1.0.34:
    * General
  - fix(server): detach goroutine context in
    NotifySmOfConnectionStatusChange @ishwar170695 (#19757)
  - [Docker] Build docker extension UI on the build platform
    @copilot-swe-agent[bot] (#19743)
    * Maintenance
  - [CI] Reconcile playground Deployment env from manifest on
    every release @leecalcote (#19748)
  - fix(workflow): set explicit ref on cross-repo workflow
    dispatch @hamza-mohd (#19742)
    * Documentation
  - docs: fix documentation typos and terminology inconsistencies
    @AbhishekMauryaGEEK (#19752)- update to 1.0.33:
  - update to 1.0.33:
    * Maintenance
  - Remove persisted files except previews @CodexRaunak (#19733)
  - Fix docs versions @CodexRaunak (#19736)
  - [CI] Harden release notes publishing against release/tag race
    conditions @copilot-swe-agent[bot] (#19738)
  - fix: reorder steps for downloading Allure artifact in
    workflow @ianrwhitney (#19739)
  - fix: update path for downloading Allure results in workflow
    @ianrwhitney (#19729)
    * Documentation
  - Fix docs versions @CodexRaunak (#19736)
  - Update the go.mod to use the latest layer5io/docs
    @CodexRaunak (#19728)
  - update to 1.0.32:
    * Meshery CLI
  - [mesheryctl] Refactor: rename --register flag to
  - -skip-registration @YASHMAHAKAL (#19709)
    * Maintenance
  - provider-ui: refresh provider chooser layout and per-provider
    info popover @hortison (#19711)
  - Bump tmp from 0.2.5 to 0.2.6 in /ui @dependabot[bot] (#19716)
  - fix: disable S1003 check in golangci-lint configuration
    @lekaf974 (#19723)
    * Documentation
  - [mesheryctl] Refactor: rename --register flag to
  - -skip-registration @YASHMAHAKAL (#19709)
  - Disable Publishing categories and tags page @CodexRaunak
    (#19713)
  - update to 1.0.31:
    * Maintenance
  - chore: update end-to-end test command in CI workflow
    @ianrwhitney (#19717)
  - chore: consolidate CI workflows and enhance end-to-end
    testing setup @ianrwhitney (#19549)
    * Documentation
  - [docs] Fix tab rendering in meshery-metrics.md @Sbragul26
    (#19590)
  - [Docs] Remove Meshery UI references outside extensions docs
    @AnjaliMishra1st (#19710)
  - update to 1.0.30:
    * General
  - Update provider capabilities for new version @marblom007
    (#19685)
  - Roadmap: v1.2 and v1.3 clarifications @hamza-mohd (#19679)
    * Meshery CLI
  - [mesheryctl] Remove unused manifest URL fixtures @miacycle
    (#19687)
  - [Chore] Server: Update perf profile package location
    @miacycle (#19686)
    * Maintenance
  - chore: remove direct references from workflows @miacycle
    (#19693)
  - [ci skip] Update golangci-lint configuration to enable
    staticcheck checks @hortison (#19692)
  - [Chore] Server: Update perf profile package location
    @miacycle (#19686)
  - [Docs] Cleanup tutorials @hortison (#19680)
    * Documentation
  - [Docs] fix: REST API references page to use Qanelas Soft font
    @Utkarsh-0304 (#19639)
  - [Docs] Add creating-a-meshery-design guide; replace vendor
    refs with Design Configurator @yi-nuo426 (#19181)
  - [Docs] More cleanup @yi-nuo426 (#19684)
  - [Docs] cleanup v0.8 and v0.9 static list @arjunmehta-git
    (#19681)
  - [Docs] Cleanup tutorials @hortison (#19680)
  - update to 1.0.29:
    * General
  - [Server] Fix silent config corruption on YAML parse failure
    in validate.go @Pranav-d33 (#19671)
  - Update providers constants list @simihablo (#19677)
  - Update Makefile.core.mk @leecalcote (#19675)
  - fix: cluster count issue @saurabhraghuvanshii (#19662)
    * Meshery CLI
  - [Tests] Use Meshery as the remote provider in e2e tests
    @leecalcote (#19631)
    * Maintenance
  - [Tests] Use Meshery as the remote provider in e2e tests
    @leecalcote (#19631)
  - chore: update e2e test workflow to use correct artifact name
    @ianrwhitney (#19632)
    * Documentation
  - docs: fix spelling mistakes in MeshSync docs
    @AbhishekMauryaGEEK (#19642)
  - update to 1.0.28:
    * no CLI-related changes or dependency updates
  - update to 1.0.27:
    * General
  - [Chore]: Bump meshery/schemas to v1.2.23 @l5io (#19623)
  - [Server] Index matchlabels and binding identification loops
    @guan404ming (#19529)
  - chore(system): consume meshery/schemas v1.2.23 system types
    @leecalcote (#19600)
  - fix: batch-load connection environments to eliminate N+1
    queries @hortison (#19599)
    * Meshery CLI
  - Single-source the remote-provider list across install
    artifacts @hortison (#19621)
  - fix: improve error handling for performance profile server
    failures @Omkar-Ugal (#19571)
  - Remove example URL from ParseURLGithub @arjunmehta-git
    (#19598)
    * Maintenance
  - Single-source the remote-provider list across install
    artifacts @hortison (#19621)
  - Bump github.com/containerd/containerd from 1.7.30 to 1.7.32
    @dependabot[bot] (#19593)
  - Bump github.com/containerd/containerd/v2 from 2.2.0 to 2.2.4
    @dependabot[bot] (#19594)
    * Documentation
  - Fix heading formatting @rishiraj38 (#19627)
  - Single-source the remote-provider list across install
    artifacts @hortison (#19621)

++++ minicom:

  - Add 0002-dial-Fix-use-of-check_io_frontend.patch
  - Add 0003-window-Consider-that-wcwidth-can-return-1-on-invalid.patch

++++ mksh:

  - Compile with built-in printf

++++ monero:

  - Update to version 0.18.5.0 (includes 0.18.4.4 and 0.18.4.5):
    * Several wallet fixes around reserve proofs (reject duplicate
    outputs, validate amounts via decodeRct, handle parse errors)
    and spend proofs
    * Fix an edge case where a transaction's key images stayed
    marked unspent; identify spends in the pool while scanning
    * daemon: remove the built-in miniupnp/UPnP support
    * zmq: add missing restricted-RPC checks (GetInfo,
    get_block_headers_by_height, ...) and fix mempool stem/fluff
    reporting
    * p2p: fix a race causing dropped connections during sync and
    improve shutdown handling
    * multisig: fix key-exchange failure in
    monero-gen-trusted-multisig
    * ledger: add Nano Gen5 device id; handle view-key export
    rejection
    * Fix a logging deadlock; build with clang 21
  - Packaging cleanup: drop the now-unused libminiupnpc
    BuildRequires (upstream removed UPnP support), convert
    BuildRequires to pkgconfig() style, drop obsolete Group tags

++++ monero-gui:

  - Update to version 0.18.5.0 (includes 0.18.4.4 - 0.18.4.7):
    * Embedded P2Pool updated to v4.15
    * Security: escape untrusted text in RichText views
    * Transfer: disable offline tx creation with long
    payment id
    * Use the WalletManager URI parser in the URI handler
    * Replace rand() with QRandomGenerator
    * Several wallet-creation wizard password-handling fixes
    * PasswordDialog: fix lack of focus on window change
    * Intercept quit event to avoid a deadlock on exit
    * More accurate blockchain size estimate
    * Add support for the new Ledger Nano gen5 hardware wallet
  - Drop the dead libminiupnpc-devel BuildRequires (upstream
    removed UPnP port-mapping support)
  - Stop using the deprecated %suse_update_desktop_file macro;
    install monero-gui.desktop (Source1) directly
  - Spec cleanup:
    * Convert BuildRequires to pkgconfig() style
    * Drop redundant/unused BuildRequires (automake, libgcrypt20)
    * Add the explicit gcc-c++ BuildRequires

++++ packetdrill:

  - Update to version 2.0+git.20260514:
    * Add PSP Security Protocol support: script-parser
    encapsulation, header parsing, psp_state and
    psp_rx_assoc/psp_tx_assoc syscalls, real AES-GCM crypto,
    ynl-c based libraries, and BPF-filter/iptables handling
    plus test cases
    * Add Accurate ECN (AccECN) TCP option support and expose
    AccECN counters/status and ecn_mode through tcpi
    * Sync struct _tcp_info with the v6.16 kernel uAPI header
    * Print TCP option names and contents instead of the
    numerical kind
    * Assorted test-harness and README improvements
  - Rebase make-build-more-consistent-with-openSUSE-packaging.patch
    for the restructured upstream Makefiles; the -static removal it
    used to carry is now the upstream default, so only the
    CFLAGS/LDFLAGS handling remains
  - Build with -fno-strict-aliasing and drop the spec's own -Werror
    and -Wno-* flags: the checksum code type-puns the packet buffer,
    which -O2 strict aliasing miscompiled and made checksum_test fail;
    the distribution build flags are now used as-is (only
  - fno-strict-aliasing is added)

++++ patterns-kalpa:

  - Replace openSUSE branding with Kalpa branding

++++ perl-Test-MockModule:

  - updated to 0.185.2 (v0.185.2)
    see /usr/share/doc/packages/perl-Test-MockModule/Changes
    [#]# 0.185.2 — 2026-05-29
    [#]# What's Changed
    * Fix/90 optional moose test deps by @geofffranks in https://github.com/geofffranks/test-mockmodule/pull/91
    * *Full Changelog**: https://github.com/geofffranks/test-mockmodule/compare/0.185.1...0.185.2
    [#]# 0.185.1 — 2026-05-26
    [#]# What's Changed
    * fix(GH #87): gate author-perlcritic.t behind AUTHOR_TESTING by @geofffranks in https://github.com/geofffranks/test-mockmodule/pull/88
    * *Full Changelog**: https://github.com/geofffranks/test-mockmodule/compare/0.185.0...0.185.1

++++ plasma-branding-Kalpa:

  - Version 20260530
    * Set breeze as default icon set

++++ python-OWSLib:

  - Update to 0.35.0
    * Remove git typo by @geographika in #1009
    * WCS: ensure identifier is a string (not a list) (#1010) by
    @tomkralidis in #1012
    * increase ISO contact parsing by @tomkralidis in #1014
    * add headers to HTTP DELETE operations by @tomkralidis in #1017
    * WMS 1.3.0: support any boolean for queryable layers (#993) by
    @tomkralidis in #1016
    * Skip connected systems tests if the server is unavailable by
    @geographika in #1019
    * pygeoapi test fix by @geographika in #1018
    * update to Python 3.12 support by @tomkralidis in #1015
    * Fix str2bool call by @geographika in #1020
    * Increase timeout for demo.pycsw.org tests by @geographika in
    [#1022]
  - Release 0.34.1
    * OGC version updates by @geographika in #1003
    * ISO: add support for gmd:illuminationElevationAngle by
    @tomkralidis in #1004
    * Make smaller map request by @geographika in #1005
    * OGC API: add support for sorting by @tomkralidis in #1006
  - Release 0.34.0
    * Exclude Python files from test folder in tarball by
    @geographika in #986
    * Enhance datatype determination and improve service_ok util by
    @KaiVolland in #994
    * Add option to pass cookies to WMTS by @ashergg in #995
    * do not show warnings on missing style name&title by
    @pvgenuchten in #990
    * Update WFS usage docs by @KaiVolland in #996
    * update wfs url in docs (wfs not available anymore) by
    @pvgenuchten in #997
    * Add None guard for extract_xml_list by @geographika in #1000
    * Update links and add missing APIs by @geographika in #1001
  - Release 0.33.0
    * Use build library for packaging by @geographika in #969
    * Filter out ExtendedCapabilities when reading WebMapTileService
    by @geographika in #968
    * OGC API: add support for collection level transactions by
    @tomkralidis in #971
    * CI: Fix failing tests and doc builds by @geographika in #974
    * Docs: Add doc on using proxies by @geographika in #975
    * Fix FutureWarnings for testing lxml elements by @geographika in
    [#979]
    * Remove unknown pytest.mark.unit by @geographika in #980
    * Add URL check for https://demo.pycsw.org/cite by @geographika
    in #982
    * Default to text/xml if server doesn't return a Content-Type by
    @geographika in #977
    * add a null check before using attrib by @pvgenuchten in #978
    * Test for XML in response, regardless of mimetype by
    @geographika in #984
  - Release 0.32.1
    * Skip failing tests by @geographika in #957
    * FIX: numpy floats parsed incorrectly by @juhi24 in #955
    * Add offline testing to CI by @geographika in #952
    * Allow build_getmap_request test to run offline and for all WMS
    versions by @geographika in #959
    * Strip out redundant new to enable object pickling by @vjf in
    [#548]
    * Update WMTS server to new URL by @geographika in #962
    * [iso19139:2007] add more generic char/anchor check by
    @pvgenuchten in #954
    * Catch and raise HTTP 403 Forbidden errors by @geographika in
    [#958]
    * OGC API: handle URLs with URIs as ids by @tomkralidis in #964
    * Attempt to reduce coveralls errors by @geographika in #960
    * fix OGC API coverages subset and datetime not forwarded by
    @fmigneault in #967
  - Release 0.32.0
    * CI: change base URL for GeoNetwork based CSW by @tomkralidis in
    [#926]
    * Add exception handlers for Polygon and Locale methods by
    @vietnguyengit in #929
    * remove root loggers (#923) by @tomkralidis in #930
    * OGC API: capture response headers by @tomkralidis in #931
    * OGC Connected Systems API by @ChainReaction31 in #928
    * Fix parsing of options - support missing options by @pduchesne
    in #939
    * OAProc: add support for process execution by @tomkralidis in
    [#940]
    * drop Python 3.8/3.9, unpin old dependencies by @tomkralidis in
    [#941]
    * Fix flake8 issues by @kalxas in #943
    * add stalebot GitHub Action by @tomkralidis in #942
    * WFS 2.0 URL building by @geographika in #612
    * changed all 'already exists' errors to warnings by
    @speleophysics in #769
    * Lint fixes by @geographika in #948
    * Add srsname to wfs200.py getfeature GET request by @lpartington
    in #945
    * Remove dependency on the Pytz library by @spillner in #949
    * adds support for gmx:anchor in gmd:identifier by @pvgenuchten
    in #947
    * enables gmx:anchor for otherconstraints by @pvgenuchten in #844
    * Raise an error if GetCapabilities requests don't return XML by
    @geographika in #861
    * Add Windows Build Action with Tests by @geographika in #950

++++ python-extra-platforms:

  - update to 13.0.0:
    * Add IBM i platform detection: OS400 / is_os400(), recognized
    via sys.platform == "os400" (reported by Python 3.9+ in IBM i's
    AIX-compatible PASE runtime). Grouped under UNIX_LAYERS
    alongside Cygwin.
    * Detect the active shell on Windows by walking the parent
    process tree via the Win32 Tool Help API
    (CreateToolhelp32Snapshot), where neither /proc nor ps exists.
    is_powershell(), is_cmd(), Git Bash detection through
    is_bash(), current_shell() arbitration, and
    current_shell_path() now rely on the actual ancestor processes
    rather than only the PROMPT/PSModulePath environment variables.
    Executable paths are resolved with QueryFullProcessImageNameW.
    The ctypes bindings live in a new extra_platforms._windows
    module, imported lazily and only on Windows.
    * Add current_shell_path() returning the executable path of the
    current shell (from the process tree when available, falling
    back to SHELL). Shell.info() now exposes the running shell's
    binary in its "path" field instead of always returning the
    configured login shell from SHELL.
    * Detect interpreter-hosted shells like Xonsh, which runs as a
    Python script so the process tree shows python rather than
    xonsh. The tree walk scans interpreter arguments for the
    shell's launcher file, matching only an existing file named
    exactly after the shell to avoid false positives. A new
    interpreter field on Shell declares the host interpreter (XONSH
    sets it to python).
    * Recognize shells running under a user-mode CPU emulator: under
    foreign-architecture emulation (like docker run --platform
    linux/arm64 on an x86 host), the process tree shows
    qemu-aarch64 /bin/bash … rather than bash; the walk strips a
    leading qemu-<arch> (or rosetta) wrapper and reads the emulated
    command, composing with interpreter-hosted detection.
    * Detect the active shell on illumos, Solaris, and AIX/IBM i.
    Their System V /proc exposes process status as binary pstatus_t
    with no /proc/<pid>/cmdline or exe: the /proc walk previously
    raised UnicodeDecodeError, crashing current_shell(). It now
    reads /proc records as bytes and falls back to ps when /proc
    yields nothing. The ps invocation uses the portable POSIX form
    (-o pid=,ppid=,args=) with positional parsing of empty headers,
    working across the System V ps of all three.
    * Extend shell detection via the process tree to macOS and the
    BSDs: the /proc-based walk was Linux-only, and the ps-based
    fallback now covers macOS, FreeBSD, DragonFly, and other
    systems without /proc. The walk also recognizes login shells
    (argv[0] like -bash), survives an unreadable /proc/<pid>/exe
    via /proc/<pid>/cmdline, and reads parent PIDs from BSD procfs
    layout (/proc/<pid>/status).
    * Render GitHub-style alerts (> [!NOTE], > [!WARNING], …) as
    admonitions in the documentation by enabling MyST's alert
    extension (requires myst-parser>=5.1).
    * Drop the types-requests typing stub and the now-empty typing
    dependency group, and require requests>=2.34, which ships
    inline type hints (PEP 561).

++++ python-pyproj:

  - Unskip python311, xarray is optional

++++ rumdl:

  - Update to version 0.2.4:
    * Fixed
  - md060: apply aligned-delimiter when a table auto-compacts
    past max-width (663f4ba)
  - md034: don't flag URL arguments of MyST colon directives
    (d55ed20)
  - embedded: gate markdown code block formatting behind
    code-block-tools opt-in (bd23ad1)
  - md046: treat MyST directive body as directive, not indented
    code block (060bae2)

++++ vorta:

  - Update to version 0.11.5:
    * Do not overwrite prune_keep_within during profile load
    * Resolve symlinks when matching active borg mount points
    * Normalize CRLF line endings to LF
  - Update to version 0.11.4:
    * Show total size and file count on the source tab
    * Add Select All / Select None buttons to the WiFi network list
    * Wait for network before backing up remote repositories
    * Fix backup failure with non-ASCII (e.g. Korean) repo paths
    * Fix timezone handling for Borg 2.x archive timestamps
    * Fix WiFi detection when a wired connection is primary
    * Include the exclusion list in profile export/import
    * Various crash and typo fixes
  - Declare the bundled vorta.desktop as Source1: it was shipped but
    not referenced, tripping the factory-auto orphaned-source check
    that declined the previous submission

++++ wine:

  - updated to 11.10 release
  - Bundled vkd3d upgraded to version 2.0.
  - XPath support reimplemented without libxml2.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.10 release

++++ wine-staging:

  - updated to 11.10 release
  - Bundled vkd3d upgraded to version 2.0.
  - XPath support reimplemented without libxml2.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.10 release

++++ wine-staging-wow64:

  - updated to 11.10 release
  - Bundled vkd3d upgraded to version 2.0.
  - XPath support reimplemented without libxml2.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.10 release

++++ wine-wow64:

  - updated to 11.10 release
  - Bundled vkd3d upgraded to version 2.0.
  - XPath support reimplemented without libxml2.
  - More VBScript compatibility improvements.
  - Various bug fixes.
  - update staging to 11.10 release

------------------------------------------------------------------
------------------  2026-5-29  -  May 29 2026  -------------------
------------------------------------------------------------------

++++ ImageMagick:

  - in default security policy, allow reading from symbolic links
    [bsc#1265373]
  - modified patches
    * ImageMagick-configuration-SUSE.patch
  - fixes CVE-2026-53461 [bsc#1268107]
    CVE-2026-53460 [bsc#1268108]

++++ LibVNCServer:

  - added patches
    CVE-2026-44988: missing validation of rectangle width in tight gradient decoding can lead to server-triggered out-of-bounds write [bsc#1266459]
    * LibVNCServer-CVE-2026-44988.patch

++++ aaa_base:

  - Update to version 84.87+git20260529.c4391e5:
    * $status -> $?
    * Simplifying the sh part too
    * Addressing review comments and simplifying a bit
    * Handle javas managed by libalternatives and by update-alternatives alike

++++ agama:

  - Add "access" key to profile to allow after installation
    remote access via ssh or cockpit (jsc#AGM-151)

++++ apptainer:

  - Fix CVE-2026-39821 (GO-2026-5026) (bsc#1266656)
    Update golang.org/x/net to 0.55.0.

++++ argocd-cli:

  - Update to version 3.4.3:
    * Bug fixes
  - f435b0f fix(cli): return immediately from 'app wait' when app
    is already in desired state (#12211) (#27503) (#27713)
    (jheyduk)
    * Dependency updates
  - 0edd404 chore(deps): bump redoc/dompurify to v3.4.0 in /ui
    for fixing CVE-2026-41240(cherry-pick 3.4) (#27913) (Alka
    Kumari)

++++ asl:

  - Drop unneeded Provides/Obsoletes for a %{name}-doc subpackage
    that does not exist
  - Spec cleanup:
    * Use %make_build, add missing BuildRequires: make
    * Drop duplicate COPYING from the doc directory
    * Drop the unreachable upstream Source URL (the OBS source
    validator cannot fetch the upstream :8000 host); the tarball
    is tracked in the package and the URL is kept in a comment

++++ aws-lc:

  - Update to version 5.0.0:
    + Test key import in EVPTest a bit more extensively
    + Add OPENSSL_cleanse to zero stack secrets before return
    + Fix: Apply COHABITANT_HEADERS logic to location of tool binaries
    + Fix wherelen handling in BIO_ADDR_rawmake AF_UNIX path
    + Harden PKCS7 and OCSP error handling
    + Reject len < -1 in ASN1_mbstring_ncopy
    + Free existing union arm by current type in PKCS7_set_type
    + Ensure no trailing data for PKCS8 EVP_parse_private_key
    + Include trailing NUL in BIO_ADDR_rawaddress AF_UNIX length
    + Reject negative pass_len in PEM_ASN1_write_bio
    + Check parameters before comparing pqdsa public keys
    + Free existing responderId union arm in OCSP_RESPID setters
    + Release cipher_data on error path too for EVP_CTRL_INIT and EVP_CTRL_COPY
    + ci: declare contents: read on zig compiler workflow
    + Add new review workflow
    + Log versioning and library names druing cmake build step
    + Tighten OCSP_parse_url URL parsing
    + Add SHRT_MAX caps to bound iteration and input lengths
    + Fix correctness findings from penpal testing
    + Document new versioning scheme and bump mainline to v5.0.0
    + Decouple the FIPS version number from the AWS-LC version number
    + Bump the github-actions group with 2 updates
    + Bump time from 0.3.36 to 0.3.47 in /tests/ci/lambda
    + tool-openssl/s_client: default SNI to -connect host to match OpenSSL
    + Reject undersized buffer in pkey_dsa_sign
    + Drop obsolete test_pkey_rsa.rb hunk from Ruby 3.4 patch
    + Enable Windows 7 compat path on MinGW builds
    + Add getauxval availability detection with /proc/self/auxv fallback for uclibc targets
    + Prefer CRLs with specific IDP match
    + Fix manylinux1 build: O_CLOEXEC fallback in getauxval shim
    + Gate Linux specific code to fix compilation on AIX
    + BoringSSL: Harden nc_email name constraint checking
    + Fix python 3.13 patch
    + Make rustfmt optional for Rust bindings generation
    + Skip MariaDB socket conflict test unable to run as root
    + use /map: linker flag to avoid running a binary to capture the hash
    + Add inline documentation for API contracts
    + ML-DSA support as a TLS 1.3 signature scheme
    + Make FIPS compiler wrapper unconditional

++++ rust1.96:

  - Add rust1.96
  - Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.96.0

++++ chromium:

  - Chromium 149.0.7827.53
  - added patches:
    * chromium-149-profile_no_const.patch
    try to complete deconstifying the use of Profile*
    started in upstream 2ac4e0f090a26f86e9ffa4bc6c22743911b9be35
    * ppc-fedora-0003-third_party-libvpx-Add-ppc64-vsx-files.patch
    * ppc-libvpx-add-missing-prototype.patch
  - removed patches:
    * chromium-141-glibc-2.42-SYS_SECCOMP.patch
    * fix_building_widevinecdm_with_chromium.patch
    * disable-ai.patch: known rebase conflicts on 149
  - modified patches:
    * chromium-125-compiler.patch (context)
    * chromium-143-revert_rust_is_multiple_of.patch (drop one hunk)
    * chromium-146-value_or.patch (drop one hunk, add one hunk)
    * ppc-fedora-0002-third_party-libvpx-Remove-bad-ppc64-config.patch
    (regenerated)
    * ppc-fedora-0002-regenerate-xnn-buildgn.patch (regenerated)
    * chromium-146-ignore-for-ubsan.patch (redone)
    * chromium-148-no_dep_on_intree_rustc_binary.patch
    * ppc-fedora-0001-Implement-support-for-ppc64-on-Linux.patch
    * ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch
    * ppc-fedora-0001-Add-pregenerated-config-for-libaom-on-ppc64.patch
    (regenerated, disable code to regenerate at build for now)
  - changed patch ranges, global patches up to 449,
    ppc patches from 450-599 now
  - keeplibs:
    added: third_party/devtools-frontend/src/front_end/third_party/puppeteer/package/lib/esm/third_party/urlpattern-polyfill
  - bump BR for gn to 0.20260429 for expand_directory
  - fixes reading mode (boo#1265854)

++++ cloud-hypervisor:

  - Update to version 52.0:
    + fix CVE-2026-45782
    + Confidential VM Support: KVM SEV-SNP
    + VFIO Device Passthrough via iommufd and vfio-cdev
    + Multi-Connection TCP Live Migration
    + Userfaultfd Demand-Paged Snapshot Restore
    + Configurable PCI BDFs for Devices
    + AIO Block Backend write_zeroes and punch_hole Support
    + Asynchronous QCOW2 Backend with io_uring
    + Generic vhost-user Device Support
    + Core Scheduling for vCPU Threads
    + Snapshot/Restore and Live Migration Improvements
    + New Command-Line and API Options
    + MSHV Support Improvements
    + Fix a guest-triggerable VMM panic
    + Saturate instead of underflowing on a malformed balloon actual
    value reported by the guest
    + IOMMU address translation now returns errors instead of panicking
    on malformed guest input
    + Several virtio device error paths now reset queues instead of
    panicking or exiting the worker
    + Virtio barriers are now sized from the number of queues actually
    activated by the guest, fixing pause hangs
    + PCI segment ACPI _UID values now match the segment ID
    + Fix VHDX multiqueue data corruption
    + Fix block-device resize-disk
    + Fix vdpa RX failure after device reset by always using base 0
    + Fix rebooting with landlock and a pty console
    + Reject rate limiting with vhost-user
    + Cancel vhost-user reconnection if the device has been unplugged
    + Remove the API socket path when start_vmm fails
    + Add missing ID validation for the virtio-rng device
    + Fix UB in MemoryRangeTable::read_from
    + DIO alignment is now queried directly from the underlying file
    rather than assumed
    + QCOW2 metadata access is now thread-safe with num_queues > 1
    + Block devices unconditionally assume sparse support, matching
    QEMU and avoiding a non-existent probe ioctl
    + Multi-value CLI options now use .action(ArgAction::Append) so
    that repeating an option appends rather than replacing
    + AIO completions are batched in next_completed_request for the
    block backend, reducing per-completion overhead
    + Fix O_DIRECT writes failing with EINVAL on the synchronous
    QCOW2 backend
    + Fix O_DIRECT reads failing with EINVAL on the async io_uring
    QCOW2 read path
    + Move QCOW2 compressed-cluster decompression out of the metadata
    lock, removing a bottleneck for compressed images
    + Clamp the balloon's reported range to its region before
    processing unused pages
    + Validate the requested balloon size against total guest RAM
    + Reject --memory-zone configurations that set both mergeable
    and shared
    + Disable sector 0 writes for autodetected VHD images

++++ cloudflared:

  - Update version to 2026.5.2
    * Add more information to proxy-dns removal message
    * Update tail command to use /management/logs endpoint
    * Add cloudflared management token command
    * Fix bugs
    * Update golang.org/x/net to 0.55.0 (boo#1266794, boo#1265920, CVE-2026-39821
    CVE-2026-33814)
  - Drop update-crypto.patch, fixed by upstream

++++ conscrypt:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ diun:

  - Update to version 4.32.0:
    * Update CHANGELOG
    * log gRPC server listener address
    * add Prometheus metrics endpoint
    * add string helpers to notification templates
    * chore(deps): bump github.com/PaulSonOfLars/gotgbot/v2
    * chore(deps): bump github.com/panjf2000/ants/v2 from 2.12.0 to
    2.12.1
    * docs: clarify default tag filter semantics
    * ntfy: click action support
    * healthcheck: support UUID as secret
    * Add new blog post about monitoring Docker updates
    * mail: use default HELO when localName is unset
    * mail: rely on go-mail message IDs
    * mail: wrap notification send errors
    * switch to github.com/wneessen/go-mail
    * teams: retry webhooks after rate limits
    * teams: handle webhook error responses
    * chore(deps): bump docker/metadata-action from 6.0.0 to 6.1.0
    * chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0
    * chore(deps): bump docker/setup-buildx-action from 4.0.0 to
    4.1.0
    * chore(deps): bump docker/login-action from 4.1.0 to 4.2.0
    * matrix: retry sends after rate limits
    * telegram: retry sends after rate limits
    * slack: retry webhook sends after rate limits
    * discord: retry after rate limits
    * webhook: fail on unexpected status
    * test: satisfy lint for handlers
    * use Go 1.26 pointer value construction
    * test(k8s): cover pod de-duplication
    * test(pkg/docker): cover image helpers
    * test(kubernetes): cover pod metadata
    * test(swarm): cover service metadata
    * test(docker): cover container metadata
    * test(dockerfile): cover provider jobs
    * test(mqtt): cover publish flow
    * test(script): cover command execution env
    * test(signalrest): cover send payload
    * test(elasticsearch): cover document indexing
    * test(teams): cover message card payload
    * test(rocketchat): cover chat message requests
    * test(apprise): cover notify requests
    * test(slack): cover webhook attachment
    * test(discord): cover webhook payload
    * test(gotify): cover message delivery
    * test(notif): cover notifier fanout
    * test(grpc): cover image service operations
    * test(registry): make registry tests hermetic
    * vendor: update to gopkg.in/yaml.v3 v3.0.1
    * vendor: update to github.com/bmatcuk/doublestar/v4 v4.10.0
    * hack: switch to gomod-updates
    * vendor: update to github.com/hashicorp/nomad/api v2.0.2
    * fix notification HTML paragraph trimming
    * handle database manifest entries consistently
    * ntfy: notification icon support
    * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.1
    * chore(deps): bump github.com/rabbitmq/amqp091-go from 1.10.0 to
    1.11.0
    * chore(deps): bump golang.org/x/mod from 0.35.0 to 0.36.0
    * chore(deps): bump maunium.net/go/mautrix from 0.26.4 to 0.28.0
    * chore(deps): bump github.com/moby/buildkit from 0.29.0 to
    0.30.0
    * chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1
    * chore(deps): bump docker/bake-action from 7.1.0 to 7.2.0
    * chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0
    * update go.podman.io/image/v5 to 5.40.0
    * migrate github.com/docker/docker to github.com/moby/moby
    * simplify provider job iteration
    * modernize config defaults and remove obsolete utl helpers
    * simplify shutdown lifecycle
    * chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1
    * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.5
    * chore(deps): bump
    crazy-max/.github/.github/workflows/zizmor.yml
    * chore(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0
    * fix lint issues
    * update to go 1.26
    * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10
    * chore(deps): bump github.com/docker/go-connections from 0.6.0
    to 0.7.0
    * chore(deps): bump softprops/action-gh-release from 2.6.1 to
    3.0.0
    * chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
    * chore(deps): bump docker/bake-action from 7.0.0 to 7.1.0
    * telegram: set default api url in config and clarify docs
    * docs: fix download links to use latest stable git tag
    * docs: clarify the project description
    * docs: enable magiclink and external links
    * update CHANGELOG PRs links
    * docs: fix opensource etiquette link
    * MkDocs Materials 9.7.5
    * chore(deps): bump github.com/moby/buildkit from 0.27.1 to
    0.29.0
    * chore(deps): bump golang.org/x/mod from 0.34.0 to 0.35.0
    * chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0
    * chore(deps): bump go.podman.io/image/v5 from 5.39.1 to 5.39.2
    * chore(deps): bump github.com/go-playground/validator/v10
    * chore(deps): bump github.com/alecthomas/kong from 1.14.0 to
    1.15.0
    * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9
    * chore(deps): bump github.com/crazy-max/gonfig from 0.7.1 to
    0.8.0
    * chore(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0
    * chore(deps): bump maunium.net/go/mautrix from 0.26.3 to 0.26.4
    * Revert "Merge pull request #1636 from
    crazy-max/ref-parse-rework"
    * Revert "Merge pull request #1637 from
    crazy-max/docker-auth-rework"
    * chore(deps): bump
    crazy-max/.github/.github/workflows/zizmor.yml
    * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    * Add configurable Telegram Bot API URL for proxy support
    * chore(deps): bump github.com/rs/zerolog from 1.34.0 to 1.35.0
    * new year
    * chore(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0
    * fix zizmor findings
    * zizmor workflow
    * log startup config as structured debug field
    * chore(deps): bump github.com/panjf2000/ants/v2 from 2.11.5 to
    2.12.0
    * chore(deps): bump k8s.io/client-go from 0.35.2 to 0.35.3
    * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3
    * registry: use docker cli auth config
    * use distribution reference for image parsing and lookups
    * chore(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0
    * chore(deps): bump k8s.io/client-go from 0.35.1 to 0.35.2
    * chore(deps): bump maunium.net/go/mautrix from 0.26.1 to 0.26.3
    * chore(deps): bump github.com/PaulSonOfLars/gotgbot/v2
    * chore(deps): bump golang.org/x/mod from 0.31.0 to 0.33.0
    * chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0
    * fix webhook method configuration handling
    * chore(deps): bump docker/setup-buildx-action from 3 to 4
    * chore(deps): bump docker/bake-action from 6 to 7
    * chore(deps): bump docker/metadata-action from 5 to 6
    * chore(deps): bump docker/login-action from 3 to 4
    * chore(deps): bump docker/setup-qemu-action from 3 to 4
    * chore(deps): bump crazy-max/ghaction-github-status from 4 to 5
    * chore(deps): bump crazy-max/ghaction-github-pages from 4 to 5
    * chore(deps): bump crazy-max/ghaction-github-labeler from 5 to 6
    * chore(deps): bump actions/download-artifact from 7 to 8
    * chore(deps): bump actions/upload-artifact from 6 to 7
    * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    * chore: add signal textmode option to docs
    * feat: add ability to use styled text with signal api
    * chore(deps): bump k8s.io/client-go from 0.34.1 to 0.35.1
    * fix: environment variable prefixes in transposed config file
    * chore(deps): bump github.com/panjf2000/ants/v2 from 2.11.4 to
    2.11.5
    * chore(deps): bump github.com/alecthomas/kong from 1.13.0 to
    1.14.0
    * chore(deps): bump go.podman.io/image/v5 from 5.38.0 to 5.39.1
    * chore(deps): bump github.com/moby/buildkit from 0.26.3 to
    0.27.1
    * chore(deps): bump github.com/dromara/carbon/v2 from 2.6.15 to
    2.6.16
    * chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0
    * fix CHANGELOG
    * chore(deps): bump github.com/crazy-max/gohealthchecks
    * chore(deps): bump github.com/panjf2000/ants/v2 from 2.11.3 to
    2.11.4
    * chore(deps): bump github.com/go-playground/validator/v10

++++ dos2unix:

  - update to 7.5.6:
    * Updated translations of the manual.
  - new website

++++ flowgrind:

  - Modernize spec file; no change to the produced package:
    * Add explicit gcc and make BuildRequires
    * Switch to %autosetup, drop obsolete Group tag and the
    %defattr/%attr file-mode workarounds

++++ forgejo-runner:

  - Update to version 12.10.2:
    + fix: remove containers after failed start-up
    + fix: reject invalid cron schedules while parsing workflows
  - Update to version 12.10.1:
    + feat: merge reusable expansion caller's 'if' into expanded jobs
    + fix: workflow-level 'env' is lost during job parsing
    + chore: remove go-git
  - Update to version 12.10.0:
    + feat: enable entrypoint customization of job containers
    + feat: enable entrypoint customization for services
    + feat: improve pulling of container images
    + fix: trim whitespace around cache secret
    + fix: preserve workflow-level env & enable-openid-connect during workflow
    expansion

++++ fwupd:

  - Update to version 2.1.4:
    + This release adds the following features:
  - Add a libcrypto-based JCat implementation for Android
  - Add support for NixOS to the quickstart script
  - Add support for the Compal BIOS version format
  - Allow a remote to specify that a username or password is required
  - Allow storing a per-user password in XDG_CONFIG_HOME
  - Detect encrypted swap devices below device-mapper
  - Ensure that all firmware subclasses set the maximum size
  - Remove the flashrom plugin
  - Save the SMBIOS BiosReleaseDate string to uploaded reports
  - Tell Star Labs coreboot users to manually update when required
    + This release fixes the following bugs:
  - Add a retry limit when updating failing Goodix MoC devices
  - Add several bounds checks for when updating Dell docks
  - Add vendor name and name for the various Framework UEFI certificates
  - Allow recovery if the Lenovo dock internal state is invalid
  - Avoid truncation when calculating the AMD GPU atombios size
  - Check firmware size against Novatek flash start address
  - Check for config offset overflow when updating Synaptics RMI devices
  - Check for multiplication overflow in BCM57xx stage1 size calculation
  - Check for overflow when writing to CCGX DMC devices
  - Check stream size before calculating Legion HID ID offset
  - Check stream size before subtracting Ilitek ITS CRC length
  - Clear Sunplus camera download state if the previous flash failed
  - Do not show plugin warnings when using --version
  - Filter the install flags provided by the D-Bus client
  - Fix a potential heap buffer overflow in FDT strlist parsing
  - Fix a potential heap buffer overflow in Nordic HID peer validation
  - Fix a potential OOB read in DFOTA modem response parsing
  - Fix a potential path traversal vulnerability in firmware backup
  - Fix a regression when searching for file magic
  - Fix a regression when using report-export --sign
  - Fix fwupd domain check bypass when using Qubes
  - Ignore efivar free space requirement on Microsoft Hyper-V hosts
  - Limit the number of hints a D-Bus client can set
  - Limit the size of parsed USB descriptors to ~64KiB
  - Make it easy to enable an authenticated remote
  - Make the Novatek boot update more reliable
  - Only read BCR from Intel SPI controllers
  - Prevent a possible division by zero error in the progressbar code
  - Prevent decompression bomb attacks in uSWID zlib payload parsing
  - Prevent NVRAM-seeded ptential path traversal when loading ESP files
  - Redact the username and password of remotes when using a non-active console
  - Require authorization for firmware installation on emulated devices
  - Require authorization for more D-Bus methods from non-local users
  - Restrict Curl protocols to prevent potential SSRF attacks
  - Restrict ModifyRemote to prevent a supply-chain redirection
  - Show a short easy-to-read string as the Pixart touchpad name
  - Tolerate post-quantum CA PKCS#7 failures when using Qubes
  - Validate ACPI PHAT specific data offset before parsing
  - Validate Corsair write size before subtracting header size
  - Validate DFU address offset before parsing the header
  - Validate Elan touchpad IAP address is within firmware bounds
  - Validate Logitech TAP AP region bounds before calculating size
  - Validate payload length is large enough for FPC sec-link
  - Validate sector range before writing pixart-tp firmware
  - Validate VBE area start does not exceed area size
  - Validate write offset does not exceed TI TPS6598x stream size
    + This release adds support for the following hardware:
  - Egis MoC devices with PID 9201
  - Intel Arc Pro B65 and Arc Pro B70 (#10389)
  - Lenovo dock devices in 'provisioned' mode
  - Pixart TP devices with PID 1343
  - Several GigaDevice and Puya SPI chips
  - Drop no longer needed BuildRequires: pkgconfig(jcat),
    pkgconfig(flashrom)

++++ girara:

  - Cleanup spec file with spec-cleaner
  - Drop dependency on girara-devel from the devel-doc
    subpackage (a -doc package should not require -devel)

++++ git-next:

  - Update to version 2026.5.4:
    * Features
  - feat(webhook): add deep /ready endpoint for readiness checks
    (c42cba35)
    * Other Changes
  - refactor(forgejo): split forgejo/tests.rs into submodules
    (b4971030)
  - refactor(gitlib): split GitRepository into extension trait
    modules (7c300612)
  - refactor: remove blanket allow(dead_code) and clean up unused
    code (0e0006d5)
  - chore(ci): remove redundant check/build steps from CI recipe
    (1799c5b7)
  - refactor(git): add delegation macro for OpenRepositoryLike
    (8747fb66)
  - MEGAMERGE (ff5c8071)
  - chore(deps): bump kameo from 0.16 to 0.20 (kameo_actors 0.1
    to 0.5) (82a023ea)
  - refactor(gitlib): extract error types and test helpers from
    god file (08de1cfc)
  - chore(deps): bump tree_type from 0.1.1 to 0.4 (b5a918c7)
  - refactor: make docker-release recipe idempotent and resumable
    (fdf7a410)
  - Update to version 2026.5.3:
    * Bug Fixes
  - fix(gitlib): refresh ODB before commit_log to fix nightly
    test failure (6b3018ba)
  - fix(repo): prevent duplicate pushes to next branch (64c6fd47)
    * Other Changes
  - chore(deps): bump toml from 0.8 to 1.0 (4daf3072)
  - chore(build): update to rust v5.4.0 image (b0c037a3)
  - chore(docker): remove redundant docker schema reference
    (5e85a2c1)

++++ gnome-control-center:

  - Update to version 50.2:
    + Device Security: Make labels fit in mobile width
    + Global Shortcuts: Relas app-id validation requirements
    + Notifications: Fix "Show Content" notification setting
    + System: Give "Software Updates" row a "button" accessible role
    + Wellbeing: Make lables fit into mobile width
    + Updated translations.
  - Update vendored libgxpd sub-project.

++++ gnome-kiosk:

  - Update to version 50.1:
    + Various code cleanup and coding style fixes

++++ shadowsocks-v2ray-plugin:

  - Update version to 5.49.0
    * Update v2ray-core to 5.49.0
    * Update grpc to 1.81.1 (boo#1260328 and CVE-2026-33186)

++++ v2ray-core:

  - Update version to 5.51.2
    * Wireguard Add TCP Listener support for wireguard outbound
    * Stun Nat Type Testing
    * Better server failure detection and PreserveSourceIPPortWhenDestNATMapping
    detection
    * Improve API instance support
    * feat: grpc: allow configurable keepalive and initial windows size
    * Add RRPIT - Rapid Reliable Packet Interactive Transport
    * Add WebRTC Tunnel Support in V2Ray(unreleased)
    * also parse X-Forwarded-For in httpupgrade
    * gdocsviewer: Add Google Docs Viewer based transport
    * gdocsviewer: Refine poll logic and allow custom headers to reduce rate limiting
    * gdocsviewer: allow adding headers in public config
    * Fix bugs (boo#1258546 and CVE-2026-27017)
  - Update geoip.dat, dlc.dat and v2ray-extra
  - Add update-net.patch, update golang.org/x/net to 0.55.0 to fix boo#1266787 and
    CVE-2026-39821
  - Drop update-grpc.patch, fixed by upstream

++++ goshs:

  - Update to version 2.1.0
    * Address security advisory GHSA-3whc-qvhv-xqjp
    * Address security advisory GHSA-j48m-h7xq-2xpj
    * Bump github/codeql-action from 4.35.5 to 4.36.0
    * Fix issue #166
    * General bug fixing and improving security posture.

++++ haproxy:

  - Enable more debugging tools after recommendation from upstream
    https://github.com/haproxy/haproxy/issues/3401
  - Add haring as haproxy-haring

++++ hbci4java:

  - Added patch:
    * java-home.patch
    + Use the system JAVA_HOME variable instead of computing it

++++ hwdata:

  - Update to version 0.407:
    * Update pci and vendor ids
  - Add missing "BuildRequires: make"

++++ icedtea-web:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ ior:

  - Update to version 4.0.0:
    * New md-workbench benchmark (now shipped alongside ior and
    mdtest)
    * New/rewritten S3, PMDK, CHFS, AIO and BFS backends,
    GPUDirect Storage support, CSV output and extensive mdtest
    correctness fixes (see NEWS for the full list)
  - Add ior-4.0.0-option-c23-fp.patch: fix a function-pointer
    call rejected by gcc 15 under C23 (fixed in upstream git)
  - Disable the RADOS backend: it is broken in the 4.0.0 release
    (src/aiori-RADOS.c was not ported to the new AIORI API);
    this also drops the librbd-devel BuildRequires and the arch
    restriction
  - Drop unused libs3-devel BuildRequires (the S3 backend was
    never enabled)
  - Strip a bogus relative RUNPATH (check/lib64) from the
    installed binaries

++++ ipp-usb:

  - Update to version 0.9.33:
    + Added quirks for HP LaserJet M406
    + Changed priority order of IPP attributes for obtaining DNS-SD name
  - Update to version 0.9.32:
    + Use ctags instead of the gotags
    + Workaround for "Pantum BP5100DN series" initialization failure

++++ jansi:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ java-11-openj9:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-11-openjdk:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-17-openj9:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-17-openjdk:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available (bsc#1264396)

++++ java-1_8_0-openj9:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-1_8_0-openjdk:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-21-openj9:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-21-openjdk:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available (bsc#1264397)

++++ java-25-openj9:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available

++++ java-25-openjdk:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available (bsc#1264398)

++++ java-26-openjdk:

  - Use libalternatives instead of update-alternatives for
    distributions where libalternatives is available
  - Update to upstream tag jdk-26.0.1+8 (April 2026 CPU)
    * CVEs
    + CVE-2026-22007 (bsc#1262490)
    + CVE-2026-22008 (bsc#1262493)
    + CVE-2026-22013 (bsc#1262494)
    + CVE-2026-22016 (bsc#1262495)
    + CVE-2026-22018 (bsc#1262496)
    + CVE-2026-22021 (bsc#1262497)
    + CVE-2026-23865 (bsc#1259118)
    + CVE-2026-34268 (bsc#1262500)
    + CVE-2026-34282 (bsc#1262501)
    * Changes
    + JDK-8348014: Enhance certificate processing
    + JDK-8364373: Transform Affine transformations
    + JDK-8364465: Enhance behavior of some intrinsics
    + JDK-8367463: Improved Arena allocations
    + JDK-8369575: Enhance crypto algorithm support
    + JDK-8370489: Some compiler tests miss the @key randomness
    + JDK-8370529: Enhance Path Factories Redux
    + JDK-8370615: Improve Kerberos credentialing
    + JDK-8370986: Enhance Zip file reading
    + JDK-8370995: Enhance ZipFile usage
    + JDK-8371830: Enhance certificate chain validation
    + JDK-8371935: Enhance key generation
    + JDK-8372589: VM crashes on init when NonNMethodCodeHeapSize is
    set too small and UseTransparentHugePages is enabled
    + JDK-8372592: Adjust logger usage in java2d tests
    + JDK-8372661: Add a null-safe static factory method to
    "jdk.test.lib.net.SimpleSSLContext"
    + JDK-8373290: Update FreeType to 2.14.1
    + JDK-8373476: (tz) Update Timezone Data to 2025c
    + JDK-8373520: Bump update version for OpenJDK: jdk26u to 26.0.1
    + JDK-8373625: CPUTimeCounters creates a total counter for
    unsupported GCs
    + JDK-8373632: Some sound tests failing in CI due to lack of
    sound key
    + JDK-8373793: TestDynamicStore.java '/manual' disables use of
    '/timeout'
    + JDK-8374434: Several JShell tests report JUnit discovery
    warnings
    + JDK-8374557: Enhance TLS connection handling
    + JDK-8374644: Regression in GZIPInputStream performance after
    JDK-7036144
    + JDK-8375063: Update Libpng to 1.6.54
    + JDK-8375094: RISC-V: Fix client builds after JDK-8368732
    + JDK-8375530: PPC64: incorrect quick verify_method_data_pointer
    check causes poor performance in debug build
    + JDK-8375657: RISC-V: Need to check size in
    SharedRuntime::is_wide_vector
    + JDK-8375994: Change milestone to fcs for all releases
    + JDK-8377905: gcc.md included with every build
    + JDK-8378623: Use unique font names in FormatCharAdvanceTest
    + JDK-8379035: (tz) Update Timezone Data to 2026a
    + JDK-8379158: Update FreeType to 2.14.2

++++ jenkins-x-cli:

  - Update to version 3.17.6:
    * Bug Fixes
  - implement signature verification for jx upgrade and update
    k8s docs (Mallikarjunadevops)
    * Chores
  - deps: upgrade jenkins-x-plugins/jx-gitops to version 1.3.0
    (root)
    * Other Changes
    These commits did not use Conventional Commits formatted
    messages:
  - Revert "fix: implement signature verification for jx upgrade
    and update k8s docs" (Mårten Svantesson)

++++ jfrog-cli:

  - Update to version 2.105.0:
    * New Features
  - [build-info-go] added nix package manager support #378
    (@reshmifrog)
  - [jfrog-cli] add nix package manager support #3471
    (@reshmifrog)
  - [jfrog-cli-artifactory] RTECO-1266 - Implement ai plugins
    publish command #454 (@udaykb2)
  - [jfrog-cli-artifactory] add nix package manager #442
    (@reshmifrog)
  - [jfrog-cli-core] RTECO-1266 - Add Subcommand to command #1560
    (@udaykb2)
  - [jfrog-cli-security] XRAY-140488 - Implement graceful dotnet
    restore error for all dotnet … #752 (@gauriy-tech)
    * Bug Fixes
  - [jfrog-cli] RTECO-1368 - Fix metrics collection for agent
    detection and interactive context fields #3518 (@fluxxBot)
  - [jfrog-cli-artifactory] Fix: Return error when jfrog server
    is not configured #459 (@udaykb2)
  - [jfrog-cli-core] RTECO-1368 - Fix metrics collection for
    agent detection and interactive context fields #1566
    (@fluxxBot)
  - [jfrog-cli-security] Fix nil dereference issue regarding
    Applicability Scan results #755 (@eranturgeman)
  - [jfrog-cli-security] Populate project key to
    GetConfigProfileByUrl #763 (@eranturgeman)
  - [jfrog-cli-security] Adjust rtRepository path when in project
    context #764 (@eranturgeman)
    * Internal Changes
  - [jfrog-cli-security] Update AnalyzerManager default version
    to 1.34.1 #754 (@attiasas)
  - [jfrog-cli-security] Update dependencies for 1.29.2 #765
    (@eranturgeman)
    * Other Changes
  - [jfrog-cli] Enable JSON error output for commands with HTTP
    requests #3493 (@ehl-jf)
  - [jfrog-cli] Make jf uv command publicly available #3511
    (@agrasth)
  - [jfrog-cli-artifactory] RTECO-1266 - Rename ai plugins to
    agent plugins #456 (@udaykb2)
  - [jfrog-client-go] Expose full HTTP response in case of error
    [#1345] (@ehl-jf)

++++ jline3:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ juniversalchardet:

  - Allow building with JDK that uses libalternatives instead of
    update-alternatives

++++ keybase-client:

  - Add update-go-crypto.patch to address boo#1266158.
  - Add update-go-net.patch to address boo#1266596.

++++ kpt-cli:

  - Update to version 1.0.0~beta.64:
    * Bump SDK version (#4538)

++++ kubectl-klock:

  - Update to version 0.9.1:
    * Fixes
  - fix: add mutex to table.Model to prevent concurrent access
    panic (#227)
    * Updates
  - Bump k8s.io/cli-runtime from 0.36.0 to 0.36.1 (#234)
  - Bump k8s.io/kubectl from 0.36.0 to 0.36.1 (#235)
  - Bump k8s.io/client-go from 0.36.0 to 0.36.1 (#237)
  - Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 in the all
    group (#238)
  - Bump github.com/fsnotify/fsnotify from 1.10.0 to 1.10.1
    (#231)
  - Bump github.com/gookit/color from 1.6.0 to 1.6.1 (#232)
  - Bump github/codeql-action from 4.35.2 to 4.35.4 in the all
    group (#233)
  - Update golang.org/x/net v0.51.0 -> v0.54.0 (#230)
  - Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 in the
    all group (#229)
  - Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.0 (#228)
  - Bump k8s.io/kubectl from 0.35.4 to 0.36.0 (#224)
  - Bump k8s.io/apimachinery from 0.35.4 to 0.36.0 (#225)
  - Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 in the
    all group (#226)

++++ kubie:

  - Update to version 0.28.0:
    * fix: handle kubectl connection error in ns selection by
    @pasteley in #400
    * fix: bump skim to v3.3 by @pasteley in #399
    * fix: handle EDITOR env variable correctly by @aellwein in #393
    * Bump the all group with 2 updates by @dependabot[bot] in #402
    * Bump the all group with 4 updates by @dependabot[bot] in #407
    * Bump the all group across 1 directory with 2 updates by
    @dependabot[bot] in #413

++++ spirv-tools:

  - Update to release 2026.2
    * Handle OpAbortKHR in spvOpcodeIsAbort

++++ libdrm:

  - update to 2.4.134
    * Sync drm_fourcc.h with drm-next
    * meson: do not mark exynos/omap/tegra as disabled features
    * omap: stop including linux/types.h
    * add missing include to util_math.h
    * amdgpu/modetest: fix discards 'const' qualifier from pointer target type
    * ci: bump debian from bookworm to trixie
    * ci: fix indentation

++++ openapv:

  - Update to version 0.2.1.3:
    + Validates that the image buffer has enough space for the decoded image

++++ planify:

  - Update to version 4.19.4:
    + Fixed a crash when updating a task
    + Fixed completed tasks generating an ambiguous local timestamp in the VTODO
    + Fixed inconsistent accent colors across the app
  - Update to version 4.19.3:
    + Fixed CalDAV sync with Mailbox
    + Fixed cursor jumping to the end of the text when editing task titles
    + Fixed long text expanding the sidebar beyond its intended width in HeaderItem
  - Update to verison 4.19.2:
    + Added automatic daily backup with support for extra backup folder locations
    + Added support for system accent color
    + Added CalDAV section support via VTODO List prefix
    + Added past date selection in the date picker
    + Added Export as .ics option in the context menu for CalDAV tasks
    + Improved change history
    + Fixed HTTP 200 being treated as an error on Horde and similar servers when
    creating or updating tasks
    + Fixed subtasks appearing as main tasks when Horde sends multiple VTODOs in
    a single .ics file
    + Fixed calendar events not updating when Planify is kept open past midnight
    + Fixed labels not being removed when deselected in the multi-select toolbar
    + Fixed label picker incorrectly assigning labels from one task to others
    when closing without changes in multi-select mode
    + Fixed inaccurate section task counts in Board view after drag and drop
    + Fixed inbox section visibility and UX in Board view — now auto-hides when empty
    + Fixed moving tasks between different sources (e.g. CalDAV → Local)
    + Fixed double sync triggered when adding a new source

++++ re:

  - Update to version 4.8.1
    Security related fixes
    * GHSA-hvxv-v2gp-v93h
    websock: Fix integer overflow in websock_decode() masked frame
    check (#1584).
    * baresip/baresip#3705
    Fix DTLS single_conn mode lacks peer address validation,
    allowing connection hijacking and DoS.
    Changes
    * fmt/pl: add pl_strip_html().
    * sys/fs: add getpwuid fallback for fs_gethome.
    * tls: remove unused include rsa.h
    * ice: check source address of incoming application packets.

++++ sofia-sip:

  - Update to version 1.13.17+50:
    + Fixes: CVE-2022-31001, CVE-2022-31002, CVE-2022-31003
    + Please see upstream git for full changes.
    https://github.com/freeswitch/sofia-sip
  - Update to url/sources to same upstream Arch Linux is using, stop
    using debian packages.
  - Use source service for tarball.
  - Following the above, add libtool BuildRequires and bootstrap the
    build.

++++ libsoup:

  - Add libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch
    Revert upstream commit fd7ce01a, this request drop methods
    path() and build_root() which are deprecated on 0.62 but existed
    in 0.54.
  - This fix could enable the libsoup update to the latest verion in
    SLE-15-SP4 and SP5, which fix many CVE bugs.
  - This fix only enable on SLE-15-SP4 and SP5 in SPEC file.
  - Add libsoup-revert-dep-meson-0.62-part01-4209dbec.patch:
    Revert upstream commit 4209dbec, this request bump meson version
    from 0.54 to 0.62.
  - This fix could enable the libsoup update to the latest verion in
    SLE-15-SP4 and SP5, which fix many CVE bugs.
  - This fix only enable on SLE-15-SP4 and SP5 in SPEC file.
  - Add libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch:
    Revert upstream commit 6b34bc58, this request tell gir that
    doc-format is gi-docgen, this version() check function requires
    meson 0.62.
  - This fix only enable on SLE-15-SP4 and SP5 in SPEC file.
  - Add libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch:
    Revert upstream commit e315cf2d, this request add --quiet and
  - -warn-all args to gir in meson.build.
  - This fix only enable on SLE-15-SP4 and SP5 in SPEC file.

++++ systemd:

  - Temporarily add
    1001-units-drop-Before-sockets.target-from-networkd-resol.patch until upstream
    releases it.

++++ systemd-mini:

  - Temporarily add
    1001-units-drop-Before-sockets.target-from-networkd-resol.patch until upstream
    releases it.

++++ libzypp:

  - Fix potential crash on malformed or malicious repository
    metadata (fixes #740)
  - version 17.38.11 (35)

++++ linux-npu-driver:

  - Build only on x86_64 as supported NPU are Intel based only

++++ lxqt-wayland-session:

  - Update to version 0.4.1:
    * Updated wiki link in niri configs
    * Updated for labwc 0.20.0
    * Migrated hyprland config to lua for 0.55, and fixed error with
    legacy config
    * bumped version in lxqt-sway.config and removed doubled keybind
    * added method to show lxqt-clip to lxqt-qdbus script
    * added powerkeys actions shortcuts for suspend and sleep
    (hibernate)

++++ lxqt-panel:

  - Update to 2.4.1:
    * Fixed but with volume scrolling not respecting the configured
    steps
    * Changed volume plugin configuration steps default value from 3
    to 5

++++ mame:

  - Updated to 0.288
    * Changed mame-fortify.patch
    * Added mame-sdl_ini_path-hardcode.patch
    * Migrated to Qt6.
    * /usr/share/doc/packages/mame/whatsnew-0.288.txt

++++ mcphost:

  - Fix CVE-2026-39821 (GO-2026-5026) (bsc#1266572)
    CVE-2026-27136 (GO-2026-5030)
    CVE-2026-25681 (GO-2026-5029)
    CVE-2026-25680 (GO-2026-5028)
    CVE-2026-42502 (GO-2026-5027)
    CVE-2026-42506 (GO-2026-5025) (bsc#1267109)
    Update golang.org/x/net to 0.55.0.

++++ melange:

  - Update to version 0.50.8:
    * fix(pipelines/strip): Don't try to strip ELFs for non-native
    platforms (#2542)
    * build(deps): bump the gomod group across 1 directory with 11
    updates (#2541)
    * fix(docker): use per-invocation unique image tag to avoid
    concurrent race (#2532)
    * build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2536)
    * build(deps): bump the actions group across 1 directory with 2
    updates (#2534)
    * fix(maven): mirror only Maven Central, not all repositories
    (#2524)

++++ mistral-vibe:

  - Update to 2.13.0:
  - Added
  - enable_system_trust_store config flag to switch the shared
    SSL context to the OS trust store for corporate TLS
    / private CA setups
  - Changed
  - MCP HTTP transport now uses Vibe's shared SSL context so it
    honors SSL_CERT_FILE / SSL_CERT_DIR and the system trust
    store opt-in
  - API key onboarding and plan-upgrade CTAs now link to the
    new Mistral Vibe Code extensions page
  - Compaction summaries are now injected into the conversation
    instead of replacing it
  - Fixed
  - Crash during initialization
  - VS Code extension promo banner now sits at the top of the
    conversation instead of being pinned above the input
  - Update build and use requirements for this package.

++++ native-platform:

  - Use the system JAVA_HOME instead of computing the wrong one

++++ newsflash:

  - Update to version 5.1.0:
    + Swipe between articles
    + Support feed: URI scheme
    + Use glycin to decode images
    + Add switch to disable selectable text
    + Show url overlay if text is not selectable
    + Render LaTeX in article title
    + Switch from MathJax to RaTeX (no js runtime needed anymore)
    + Update tag popover visuals
    + Cannot enter custom secret
    + Load backend only after activation for a nicer cli experience
    + Unwatch expressionwatches (memory usage)
    + Trim memory every time the window gets hidden
    + Lots of html2gtk fixes

++++ opa:

  - Update to version 1.17.0:
    * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
    * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
    * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages < package < document < rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
    * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
    * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
    * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
    * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -> go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2

++++ openSUSE-release-tools:

  - Update to version 20260529.ebc6e9d1:
    * Avoid division by zero.

++++ opentofu:

  - Update to version 1.12.1:
    Full Changelog:
    https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md
    * SECURITY ADVISORIES:
  - Previous releases in the v1.12 series could be affected by
    several vulnerabilities:
  - ssh usage through OpenTofu generate hangs or panics.
  - Previously, a revoked 'SignatureKey' belonging to a CA was
    not correctly checked for revocation. Now, both the 'key'
    and 'key.SignatureKey' are checked for @revoked.
    This is fixed now by (#4145)
    * BUG FIXES:
  - Address a bug introduced in v1.12.0 causing excessive memory
    usage by providers. (#4126)
  - Address a bug introduced in v1.12.0 where
    replace_triggered_by was validated incorrectly. (#4133
  - The Azure key provider will now accept the tenant_id,
    subscription_id, environment, and metadata_host variables; a
    bug previously only allowed these to be set through
    environment variables. (#4091)

++++ perl-DateTime-Format-Natural:

  - updated to 1.260.0 (1.26)
    see /usr/share/doc/packages/perl-DateTime-Format-Natural/Changes
    1.26  2026-05-28  <schubiger@cpan.org>
  - Merged development version to stable.
    1.25_04  2026-05-27  <schubiger@cpan.org>
  - ::Calendar: make 'type' part of the object.
    1.25_03  2026-05-26  <schubiger@cpan.org>
  - Guard against non-existent calendar module when testing.
    1.25_02  2026-05-25  <schubiger@cpan.org>
  - Introduce ::Calendar which converts between calendar systems.
    1.25_01  2026-05-17  <schubiger@cpan.org>
  - New supported formats: christmas/new year's eve/day.
  - Test and document the new formats.

++++ pinact:

  - Update to version 4.0.0:
    * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
    * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
    * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
    * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
    * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
    * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age <min age>.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" && ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
    * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)

++++ prek:

  - Update to version 0.4.3:
    * Bug fixes
  - Ignore stat-only hook rewrites (#2131)
  - Update to version 0.4.2:
    * Highlights
  - 0.4.2 is mainly about making prek run faster in large repos.
    prek now does less git diff work. After hooks run, prek uses
    diff checks to detect files changed by hooks. If a hook
    modifies files, prek marks that hook as failed. That is
    important, but full diff snapshots can be slow in big repos,
    especially when they happen after every hook group.
    We skip the expensive diff path in two common cases: built-in
    hooks that prek knows are read-only, and clean worktrees
    where a cheap dirty check is enough unless a hook actually
    changes files. In the right large-repo workload, skipping
    that work can make runs up to 10x faster.
    Workspace mode is faster too. Hooks have historically been
    too serial.  Priority-based concurrency helped, but it
    required users to choose good priority values. Now sibling
    projects at the same workspace depth run in parallel
    automatically. Their files do not overlap, so this is safe
    and needs no extra config. For multi-project workspaces, this
    can dramatically reduce total hook time.
    * Enhancements
  - Run same-depth projects concurrently (#2110)
  - Make rustup install profile configurable (#2111)
  - Simplify hook progress folding (#2125)
    * Performance
  - Optimize diff checks for clean worktrees (#2109)
  - Skip diff checks for read-only hooks (#2108)

++++ python-cloudpickle:

  - Remove pointless BuildRequires on py.

++++ python-cmd2:

  - Update to 3.5.1:
  - Fixed ArgparseCompleter.print_help() not passing file stream
    to recursive call.
  - Fixed issue where constants.REDIRECTION_TOKENS was being
    mutated.
  - Update to 3.5.0:
  - Fixed issue where Rich stripped colors from text in test
    environments where TERM=dumb.

++++ python-django-cacheops:

  - Add patch support-python-314.patch:
    * Support Python 3.14 pickle changes. (bsc#1266046)

++++ python-github3.py:

  - Add patch support-new-requests.patch:
    * Support argument changes for the new requests.

++++ python-httpcore2:

  - Initial version 2.2.0

++++ python-httpx2:

  - Initial version 2.2.0
  - Add version-fallback.patch to build outside of git repo
  - Add fix-encoding-tests.patch to fix tests with chardet >= 6

++++ python-invocations:

  - Add patch switch-to-blessed.patch:
    * Use blessed, rather than blessings.
  - Add missing Requires on build and pip.

++++ python-libtmux:

  - update to 0.58.0:
    libtmux 0.58.0 fixes subprocess output decoding on non-UTF-8
    locales. Both tmux_cmd and ControlMode now enforce UTF-8 when
    reading tmux output, matching tmux's own encoding contract.
    * Fixes
  - Subprocess encoding on non-UTF-8 locales (#679)
    tmux_cmd and ControlMode now pass encoding="utf-8" to
    subprocess.Popen, ensuring tmux output is decoded correctly
    regardless of the system locale. Previously, on non-UTF-8
    locales, the FORMAT_SEPARATOR character (U+241E) was
    corrupted during decoding, causing list accessors
    (Server.sessions, etc.) to return empty results.

++++ python-mashumaro:

  - update to 3.22:
    * Added support for using Annotated[..., JSONSchema(...)] in JSON
    Schema generation (#326)
    * Added new fields contentEncoding, contentMediaType,
    contentSchema to JSONSchema (#326)

++++ python-mcp:

  - Update to 1.27.1:
  - fix: catch PydanticUserError when generating output schema
    (pydantic 2.13 compat)
  - fix(auth): coerce empty-string optional URL fields to None in
    OAuthClientMetadata
  - build: restrict httpx to <1.0.0
  - refactor: import SSEError from httpx_sse public API

++++ python-neovim:

  - Add fix-error-msg.patch to fix testsuite error

++++ python-python-gitlab:

  - update to 8.4.0:
    * Features
  - const: Add new Security Manager role (3738bb2)
    * Testing
  - const: Add tests for AccessLevel (2ab6d9f)

++++ python-ruff:

  - update to 0.15.15
    * Preview features
    * Fix Markdown closing fence handling
    * [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811)
    * Bug fixes
    * [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821)
    * Performance
    * Avoid redundant TokenValue drops in the lexer
    * Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size
    * Use ThinVec in AST to shrink Stmt
    * Documentation
    * Fix line-length example for --config option
    * [flake8-comprehensions] Document RecursionError edge case in __len__ (C416)
    * [mccabe] Improve example (C901)
    * [pyupgrade] Clarify fix safety docs (UP007, UP045)
    * [refurb] Document FURB192 exception change for empty sequences
    * [ruff] Document false negative for user-defined types (RUF013)
    * Formatter
    * Fix formatting of lambdas nested within f-strings
    * Server
    * Return code action for codeAction/resolve requests that contain no or no valid URL
    * Other changes
    * Expand semantic syntax errors for invalid walruses

++++ salt:

  - Calculate UUID grain for Xen PV guests (bsc#1255418)
  - Added:
    * calculate-uuid-grain-for-xen-pv-guests-759.patch

++++ salt-test:

  - Calculate UUID grain for Xen PV guests (bsc#1255418)
  - Added:
    * calculate-uuid-grain-for-xen-pv-guests-759.patch

++++ python-starlette:

  - Update to 1.2.0
    * Support httpx2 in the test client
  - Update to 1.1.0
    * Use "application/octet-stream" as the FileResponse media type fallback
    * Only dispatch standard HTTP verbs in HTTPEndpoint
    * Reject absolute paths in StaticFiles.lookup_path
  - Update to 1.0.1 (fixes CVE-2026-48710, bsc#1266369)
    * Ignore malformed Host header when constructing request.url
  - disable some tests that require httpx2[zstd]

++++ python-uv:

  - update to 0.11.17
    * Enhancements
    * Add a diagnostic for uv add with standard library modules
    * Expose uv workspace and its list subcommand in help output
    * Improve the "403 forbidden" hint to suggest ignore-error-codes when applicable
    * Skip direct URL lock freshness checks while offline
    * Add import-names and import-namespaces support to uv-build (PEP 794)
    * Add a --no-editable-package flag to various commands
    * Infer Python version requests from source trees in uv tool invocations
    * Preview features
    * Add module owners to uv workspace metadata
    * Do not allow uv venv --clear to remove non-virtual environments
    * Bug fixes
    * Improve the performance of large entries in tool.uv.conflicts
    * Avoid modifying the parent process' env with --env-file in uv run
    * Fix script environment creation for scripts with long filenames
    * Fix transitive Git archive dependencies in lockfiles
    * Preserve Git repository URLs in direct URL metadata
    * Support redirects in --check-url
    * Accept case-insensitive HTML tags in --find-links parsing
    * Reject duplicate script metadata blocks
    * Ban names like "python3" as script entry points
    * Validate Git LFS artifacts for Git archives
    * Use a relative path when creating symlinks in cache to improve relocatability
    * Documentation
    * Fix malformed positional anchors in the CLI reference

++++ rancher-cli:

  - Update to version 2.14.2:
    * Bump Rancher version to v2.14.2 by @tashima42 in #605

++++ re2c:

  - Fix License tag to SUSE-Public-Domain (the previous
    LicenseRef-SUSE-Public-Domain form was invalid and caused the
    Factory submission to be declined)
  - Spec cleanup:
    * Add missing BuildRequires: make
    * Drop spurious executable permission from the bundled
    examples/*/__run_all.sh helper scripts

++++ reco:

  - Update to version 5.2.1:
    + SECURITY: OpenSSF: Mention vulnerability_report_response
    + Updated translations
  - Update to version 5.2.0:
    + Support mobile devices
    + Add an opt-in switch to include artist and datetime metadata to recordings
    + Ongoing recordings are trashed instead of being deleted when canceled
    + Present processing dialog while saving to show progress and prevent users
    from interacting with UI
    + Refresh the waveform only when the window is not "suspended"
    + Use system default input device as the selected microphone

++++ regclient:

  - Update to version 0.11.5:
    * Security:
  - Prevent https to non-https downgrades and localhost
    redirects. (PR 1093)
  - Forbid sending auth on redirects. (PR 1095)
    * Features:
  - Add regbot manifest.descriptor to the sandbox. (PR 1091)

++++ rekor:

  - Update to version 1.5.2:
    * build(deps): Bump the all group across 1 directory with 7
    updates (#2829)
    * alpine: Enforce max size limit on decompression (#2831)
    * Support restricting kinds on insertion (#2814)
    * fix(trillianclient): strip dns:/// scheme from TLS ServerName
    in gRPC dial (#2812)
    * build(deps): Bump cloud.google.com/go/profiler from 0.4.3 to
    0.6.0
    * build(deps): Bump go.uber.org/zap from 1.27.1 to 1.28.0
    * build(deps): Bump golang in the all group across 1 directory
    * build(deps): Bump github.com/go-openapi/swag from 0.25.5 to
    0.26.0
    * build(deps): Bump github.com/tink-crypto/tink-go-awskms/v2 to
    v3 (#2827)
    * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2820)
    * fix fuzz build failures and crashes (#2824)
    * increase fuzz duration to address build timeouts (#2822)
    * fuzzing updates (#2815)
    * build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.4.0 to
    2.6.0 (#2810)
    * build(deps): Bump golang from 1.25.7 to 1.26.0 in the all group
    (#2746)
    * build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2809)
    * build(deps): Bump go.step.sm/crypto from 0.76.2 to 0.77.7
    (#2811)
    * add checks to ensure returned entries match client inputs to
    rekor-cli (#2799)
    * add nil pointer check to resolve fuzzing crash (#2807)
    * build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0
    (#2804)
    * client: surface last-response details after retries are
    exhausted (#2796)
    * build(deps): Bump the all group with 2 updates (#2802)
    * build(deps): Bump github/codeql-action in the all group (#2803)
    * Fix internal error detail leakage in 500 responses (#2801)
    * add defensive check to ensure tid is in config ahead of getting
    client (#2795)
    * restapi: include inactiveShards in the homepage total count
    (#2797)
    * build(deps): Bump the all group with 5 updates (#2794)
    * build(deps): Bump actions/upload-artifact in the all group
    * add generated files to pr
    * build(deps): Bump github.com/go-swagger/go-swagger
    * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
    * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.42.0 to
    1.43.0
    * build(deps): Bump google.golang.org/api from 0.269.0 to 0.271.0
    (#2781)
    * build(deps): Bump golang.org/x/net from 0.50.0 to 0.52.0
    (#2780)
    * build(deps): Bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#2789)
    * build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#2771)
    * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#2788)
    * Add changelog for v1.5.1 (#2774)
    * build(deps): Bump the all group across 1 directory with 3
    updates
    * build(deps): Bump the all group across 1 directory with 7
    updates

++++ rqlite:

  - Update to version 10.2.0:
    * Support verifying mTLS peer Common Name
    * Console supports restore from SQLite data
    * Console "count rows" respects current Tables Expand/Collapse state
    * Console supports dropping indexes
    * Further Console app improvements

++++ rubygem-passenger:

  - New upstream release 6.1.3, see bundled CHANGELOG

++++ rumdl:

  - Update to version 0.2.3:
    * Fixed
  - code-block-tools: pipe newline-terminated content to external
    tools (497d892)
  - Update to version 0.2.2:
    * Fixed
  - md081: treat unset and 0 as distinct emphasis thresholds
    (ca992bd)
  - Update to version 0.2.1:
    * Added
  - md081: add no-excessive-emphasis rule (7e9ac64)
  - Update to version 0.2.0:
    * Added
  - lsp: improve link completion ranking, ignores, and absolute
    paths (0ac911e)
  - flavor: add support for MyST (Markedly Structured Text)
    (#637) (3455840)
    * Fixed
  - md007: close ordered-ancestor exemption leak across deeper
    nested quotes (0fa6180)
  - md007: flag misindented top-level unordered list items
    (f277892)
  - md007: apply ordered-ancestor exemption only to genuinely
    nested sublists (#638) (4c96cf7)
  - md013: reflow list-item prose in normalize mode without false
    length warnings (#639) (0816967)
  - cross-file: honor inline-disable and per-file-ignores on
    lint-cache fast path (05c77e4)

++++ sidplayfp:

  - Update to version 3.0.2
    * Fixed reading config file on Windows (#127).
    No changes for Linux systems.

++++ woodpecker:

  - Update to version 3.15.0:
    * Security
  - Use Gitlab username [#6653]
  - Update uuid [#6647]
  - server: for grpc store extracted agentID in context [#6569]
    * Features
  - Support optional flag in depends_on for workflows and steps
    [#6461]
    * Enhancement
  - Use refactored pipeline builder in cli exec [#6453]
  - Add config to change default pipeline config paths and
    extensions [#6580]
  - Allow disabling service workspace volumes in k8s [#6644]
  - View warning if admin is configured at env level [#6600]
  - Add timezone support for crons [#6597]
  - Add CI_PIPELINE_RERUNS environment variable [#6588]
  - Add placeholders to inputs [#6599]
  - Refactor server/.../step_builder into pipeline/.../builder
    [#3967]
  - Group logs by command in step logs UI and make them
    collapsible [#6398]
  - Expose step type to step env [#4290]
  - pipeline runtime: move setting step environment variables
    into own func and add CI_PIPELINE_STATUS back [#6516]
  - Refactor agent rpc retry [#6515]
    * Bug Fixes
  - Fix org lookup panic [#6652]
  - Deduplicate schema linter composition errors [#6633]
  - local backend: on linux / mac start commands in own process
    group and kill the group on cancel [#6609]
  - k8s: add guards to stop pipeline services upon completion
    [#6623]
  - Fix missing log close button [#6584]
  - fix(agent): persist agent ID after auth to prevent crashloop
    duplicates [#6543]
  - fix(gitlab): preserve private flag when webhook payload omits
    project visibility [#6544]
    * Tests
  - Fix race in local backend tests [#6574]
    * Documentation
  - Add note about extension permission [#6646]
  - Add GitHub OAuth App setup hint to docker-compose page
    [#6643]
  - Update pnpm to v11.3.0 [#6639]
  - Update docs npm deps non-major [#6625]
  - Docs: Mention that you can use failure: fail [#6611]
  - Change homepage of woodpecker-shellcheck [#6594]
  - Update docs npm deps non-major [#6586]
  - Update pnpm to v11 [#6561]
  - Update docs npm deps non-major [#6555]
  - Add 3rd party secret extensions list [#6546]
  - Update dependency axios to v1.16.0 [#6538]
  - Update dependency yaml to v2.8.4 [#6536]
  - Update dependency isomorphic-dompurify to v3.12.0 [#6532]
  - Update docs npm deps non-major [#6530]
    * Dependency
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.34.0 [#6662]
  - Update dependency uuid to v14 [#6658]
  - Lock file maintenance [#6659]
  - Update golang-packages [#6637]
  - Update web npm deps non-major [#6638]
  - Lock file maintenance [#6640]
  - Update module github.com/google/go-github/v86 to v88 [#6626]
  - Update web npm deps non-major [#6624]
  - Update golang-packages [#6622]
  - Update golang-packages [#6620]
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.29.0 [#6618]
  - Update golang-packages [#6614]
  - Lock file maintenance [#6606]
  - Update web npm deps non-major [#6604]
  - Update web npm deps non-major [#6603]
  - Update web npm deps non-major [#6602]
  - Update web npm deps non-major [#6601]
  - Update dependency simple-icons to v16.20.0 [#6596]
  - Update dependency eslint to v10.4.0 [#6593]
  - Update dependency @antfu/eslint-config to v9 [#6592]
  - Update web npm deps non-major [#6591]
  - Update woodpeckerci/plugin-git Docker tag to v2.9.1 [#6589]
  - Update postgres Docker tag to v18.4 [#6590]
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.26.1 [#6587]
  - Update golang-packages [#6582]
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.26.0 [#6578]
  - Update golang-packages [#6571]
  - Update web npm deps non-major [#6446]
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.25.0 [#6566]
  - Update module github.com/google/go-github/v85 to v86 [#6560]
  - Lock file maintenance [#6563]
  - Update golang-packages [#6562]
  - Update dependency mvdan/gofumpt to v0.10.0 [#6558]
  - Update dependency golangci/golangci-lint to v2.12.2 [#6556]
  - Update pre-commit hook golangci/golangci-lint to v2.12.2
    [#6557]
  - Update dependency golang to v1.26.3 [#6554]
  - Update golang-packages [#6548]
  - Update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.24.1 [#6545]
  - Update golang-packages [#6542]
  - Lock file maintenance [#6540]
  - Update module github.com/docker/cli to v29.4.2+incompatible
    [#6539]
  - Update golangci/golangci-lint Docker tag to v2.12.1 [#6537]
  - Update pre-commit hook golangci/golangci-lint to v2.12.1
    [#6535]
  - Update docker.io/woodpeckerci/plugin-docker-buildx Docker tag
    to v6.1.0 [#6534]
  - Update dependency golangci/golangci-lint to v2.12.0 [#6533]
  - Update woodpeckerci/plugin-release Docker tag to v0.3.1
    [#6531]
  - Update docker.io/lycheeverse/lychee Docker tag to v0.24.2
    [#6529]
    * Misc
  - build: release freebsd/openbsd as binary not container
    [#6610]
  - flake.lock: Update [#6656]
  - Use "sign in/out" [#6579]

++++ tailscale:

  - Update to version 1.98.4:
    + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
  - Update to version 1.98.3:
    + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
  - Update to version 1.98.2:
    + Ensure MagicDNS resolves tailnet hostnames after a network change
  - Update to version 1.98.1:
    + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
    + IP forwarding for subnet routers and exit nodes is reported as a health check
    + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
  - Remove patch fix-CVE-2026-33747.patch, fixed upstream

++++ talosctl:

  - update to 1.13.3:
    https://github.com/siderolabs/talos/releases/tag/v1.13.3
    No talosctl-related changes
    * Dependency Changes
  - github.com/containerd/containerd/v2 v2.2.2 -> v2.2.4
  - github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
  - github.com/siderolabs/pkgs
    v-1.13.0-11-g969f61c -> v1.13.0-23-g8c18616
  - github.com/siderolabs/talos/pkg/machinery v1.13.2 -> v1.13.3
  - golang.org/x/net v0.53.0 -> v0.55.0
  - golang.org/x/sys v0.43.0 -> v0.45.0
  - golang.org/x/term v0.42.0 -> v0.43.0
  - golang.org/x/text v0.36.0 -> v0.37.0
  - google.golang.org/grpc v1.79.3 -> v1.81.0
  - k8s.io/api v0.36.0 -> v0.36.1
  - k8s.io/apiextensions-apiserver v0.36.0 -> v0.36.1
  - k8s.io/apimachinery v0.36.0 -> v0.36.1
  - k8s.io/apiserver v0.36.0 -> v0.36.1
  - k8s.io/client-go v0.36.0 -> v0.36.1
  - k8s.io/component-base v0.36.0 -> v0.36.1
  - k8s.io/kube-scheduler v0.36.0 -> v0.36.1
  - k8s.io/kubectl v0.36.0 -> v0.36.1
  - k8s.io/kubelet v0.36.0 -> v0.36.1
  - k8s.io/pod-security-admission v0.36.0 -> v0.36.1

++++ tcl:

  - Version 8.6.18:
    * Use correct equality => http 2.9.9
    * Unicode version 17
    * re-generate tclDate.c with bison 3.8.2, fixes clang-15
    compiler warnings
    * [77059c] TclPushVarName(): pointer overflow
    dde => 1.4.6
    * Add IWYU export pragma annotations for improved clangd and
    clang-tidy diagnostics
    * Install man-pages and pkg-config on Windows
    * some tests will fail if the system encoding is iso8859-1
    * raise error on empty regexp for unresolved variable
    * tcl_wordchars and tcl_nonwordchars documentation in two places
    * configure --enable-man-compression error
    * Update to zlib 1.3.2
    * String trim generates invalid utf-8 for some codepoints
    * Valgrind reported error in SetScriptLimitCallback
    * (feature) Adapt tcltest to support up to Tcl 9.1.
    => tcltest 2.5.11
    * crash in proc during namespace deletion
    * tzdata updated to Olson's tzdata2026b
  - Version 8.6.17:
    * [63449c] [namespace children] doesn't match non-glob patterns
    below the global namespace
    * [fc3509] Better error-message than "interpreter uses an
    incompatible stubs mechanism"
    * [4f0b57] Win: [exec] now works on App Execution Aliases.
    * [4e2c8b] Win: [auto_execok] handles larger set of shell commands.
    * [ba68d1] errorline from [interp eval], interp-26.9
    * [fd8341] Tcl_InitStubs compatibility for 9.1, better
    error-handling
    * [42d14c] Fix scan with long mantissa.
    Ex.: scan "1.[string repeat 1 191]e-321" %g
    * [4f338b] add missing Tcl_CloseEx docs (nadkarni)
    * [ecf35c] Correct nested handling of return option -options
    * [ecafd8] Euro/Tail-sign missing from cp864 encoding
    * [6b0f77] gcc 14 breaks configure test for bigendian leading to
    broken floating point
    * [c9f052] prevent overflow crash in Tcl_SplitList().
    * [61c01e] Flawed ref counts in filesystem implementation for
    Windows led to use-after-free
    * dde => 1.4.5
    * [992f94] avoid misaligned pointers in macOS file attribute
    functions

++++ telemetrygen:

  - Update to version 0.153.0:
    No telemetrygen-related changes
    * [chore] Manually run `update-otel` to v0.153.0 (#48631)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.29.0
    (#48528)
    * Update module
    github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common
    to v1.3.101 (#48531)
    * Update module google.golang.org/api to v0.280.0 (#48529)
    * Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in
    /internal/tools (#48518)
    * Update module github.com/google/cadvisor to v0.57.0 (#48498)
    * Update module github.com/oschwald/geoip2-golang/v2 to v2.2.0
    (#48505)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.28.0
    (#48506)
    * Update dockerfile deps (#48494)
    * Update module
    github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal
    to v0.152.0 (#48503)
    * Update module google.golang.org/grpc to v1.81.1 (#48502)
    * Update All github.com/aws packages (#48493)
    * Update module
    github.com/Azure/azure-sdk-for-go/sdk/storage/azblob to v1.7.0
    (#48496)
    * Update github-actions deps (#48495)
    * Update All github.com/datadog packages (#48488)
    * Update module
    github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common
    to v1.3.100 (#48489)
    * Update module github.com/twmb/franz-go to v1.21.2 (#48490)
    * Update module google.golang.org/grpc to v1.81.1 (#48491)
    * Update module github.com/jaegertracing/jaeger-idl to v0.7.1
    (#48297)
    * [chore] Update core dependencies (#48397)
    * Update module google.golang.org/api to v0.279.0 (#48331)
    * Update module github.com/DataDog/agent-payload/v5 to v5.0.196
    (#48319)
    * Update mcr.microsoft.com/mssql/server:2025-latest Docker digest
    to 320daf8 (#48318)
    * Update module github.com/google/go-github/v85 to v86 (#48309)
    * Update module github.com/vmware/govmomi to v0.54.0 (#48304)
    * Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.25.0
    (#48305)
    * Update module github.com/tidwall/gjson to v1.19.0 (#48303)
    * Update module modernc.org/sqlite to v1.50.1 (#48292)
    * Update All golang.org/x packages (#48293)
    * Update module github.com/hetznercloud/hcloud-go/v2 to v2.40.0
    (#48296)
    * Update docker-compose deps to v0.152.0 (#48302)
    * Update module github.com/SAP/go-hdb to v1.16.8 (#48289)
    * Update module
    github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common
    to v1.3.95 (#48290)
    * Update All github.com/splunk/stef packages to v0.1.2 (#48287)
    * Update github-actions deps (#48288)
    * Update All github.com/aws packages (#48285)
    * Update dockerfile deps (#48284)
    * Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in
    /internal/tools (#48272)

++++ terragrunt:

  - Update to version 1.0.6:
    * Bug Fixes
  - terragrunt no longer hangs when download_dir is a non-hidden
    subdirectory of the unit
    Setting download_dir (via the attribute, --download-dir, or
    TG_DOWNLOAD_DIR) to a subdirectory of the unit's working
    directory whose name did not start with a dot caused commands
    that prepare the OpenTofu or Terraform source (apply, plan,
    run, and similar) to hang.
    For example:
    [#] /infra/web/terragrunt.hcl
    download_di