------------------------------------------------------------------ --- Changelog.all ----------- Fri Sep 11 19:33:32 UTC 2026 ------ ------------------------------------------------------------------ ------------------------------------------------------------------ ------------------ 2026-9-9 - Sep 9 2026 ------------------- ------------------------------------------------------------------ ++++ openldap2_6: - Update to version 2.6.13+157: * Add export symbols related to LDAP_CONNECTIONLESS * Clear after free * prevent double free * liblber calloc * bsc#1239787 - prevent double free in info rewrite * Set default ldapi path to be consistent for SUSE * guide.html file cherry-picked from https://src.opensuse.org/jengelh/openldap2/src/branch/master/openldap-2.6.8.tgz * [PATCH] Use OpenSSL API to verify host * Change malloc to use calloc to prevent memory reuse corruption * Return to release engineering ------------------------------------------------------------------ ------------------ 2026-9-8 - Sep 8 2026 ------------------- ------------------------------------------------------------------ ++++ ansible-core: - Security fix for CVE-2026-16493 (bsc#1272369): argument injection in ansible-galaxy collection install; build the git clone options first and pass the collection URL positionally after a "--" separator, so a git+ URL beginning with "-" cannot be parsed by git as an option. Twin of CVE-2026-11332 (role path). SUSE candidate patch; upstream hardening tracked in gh#ansible/ansible#87177 (open, unmerged) -- no upstream commit has merged yet. * add ansible-core-CVE-2026-16493.patch ++++ jq: - Add patch CVE-2026-43895.patch (CVE-2026-43895, bsc#1265071) - Add patch CVE-2026-47770.patch (CVE-2026-47770, bsc#1269221) ++++ selinux-policy: - Update to version 20250627+git398.8dcc9d038: * named filetrans for netconfig (bsc#1275219) * Revert "Apply fix_unconfined.patch" (bsc#1275219) * sshd_session_t needs to access kanidm sshkeys (bsc#1275492) * Fix broken kanidm_sshkeys_t security context (bsc#1275492) ------------------------------------------------------------------ ------------------ 2026-9-7 - Sep 7 2026 ------------------- ------------------------------------------------------------------ ++++ ansible-linux-system-roles: - Update to version 1.5.0: add new role - Add himmelblau role 1.2.0 (SLE 16.1 only): - Microsoft Entra ID authentication and identity on Linux via Himmelblau (https://github.com/SUSE/ansible-himmelblau) ++++ containerized-data-importer1.65: - Security: re-vendor the bundled Go dependencies (tarball rebuilt from v1.65.0 with updated go.mod/vendor; no upstream source changes). This code stream still carried the pristine v1.65.0 vendor tree. Fixed by this update: * google.golang.org/grpc 1.65.0 -> 1.83.1: bsc#1260295 (CVE-2026-33186), bsc#1279234 (CVE-2026-84304), bsc#1279315 (CVE-2026-84303) * golang.org/x/crypto 0.31.0 -> 0.56.0: bsc#1266179 (CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598), bsc#1278621 (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662), bsc#1239322 (CVE-2025-22869), bsc#1253506 (CVE-2025-47913), bsc#1253967 (CVE-2025-47914), bsc#1253784 (CVE-2025-58181) * golang.org/x/net 0.33.0 -> 0.57.0: bsc#1238699 (CVE-2025-22870), bsc#1241838 (CVE-2025-22872), bsc#1251495 (CVE-2025-47911), bsc#1251689 (CVE-2025-58190), bsc#1265799 (CVE-2026-33814), bsc#1266639 (CVE-2026-39821), bsc#1267176 (CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506) * golang.org/x/text 0.21.0 -> 0.41.0: bsc#1272064 (CVE-2026-56852) * github.com/ulikunitz/xz 0.5.12 -> 0.5.15: bsc#1248946 (CVE-2025-58058) * github.com/moby/spdystream 0.4.0 -> 0.5.1: bsc#1262269 (CVE-2026-35469) * github.com/go-jose/go-jose/v3 3.0.3 -> 3.0.5: bsc#1262952 (CVE-2026-34986) * go.opentelemetry.io/otel 1.28.0 -> 1.44.0: bsc#1276687 (CVE-2026-41178) github.com/go-git/go-git and go-billy are not imported by any module of the tree and are no longer vendored. - Build with Go 1.26 (golang.org/x/crypto 0.56.0 requires it). ++++ sg3_utils: - Update to version 1.48~20221101+8.02dda5f: * sg_inq: avoid including 0-bytes in SCSI name strings (bsc#1277106) ++++ tomcat: - Update to Tomcat 9.0.121 * Fixed CVEs: + CVE-2026-73180: If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. (bsc#1276902) + CVE-2026-68763: An allocation leak in the HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service. (bsc#1276901) + CVE-2026-68569: For some authentication methods (e.g. CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm and JDBCRealm. (bsc#1276900) + CVE-2026-68525: The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource POST but not GET. (bsc#1276899) + CVE-2026-66422: security-role-ref definitions were incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). (bsc#1276898) + CVE-2026-66299: The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process. (bsc#1273150) + CVE-2026-65927: An off-by-one error impacting the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first rule. (bsc#1276897) + CVE-2026-65905: If, before windowSize requests had been made, a client made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request was replayable once only while the associated nonceCount remained within the replay window. (bsc#1276896) + CVE-2026-65637: The fix for CVE-2026-32990 was incomplete. (bsc#1276895) + CVE-2026-65183: A race condition when creating a Unix Domain Socket allowed an unauthorised local user to access the Unix Domain Socket. (bsc#1276894) + CVE-2026-65182: The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path. (bsc#1276893) * Catalina + Fix: Ensure that a login-config conflict when merging web.xml fragments triggers a deployment failure. (markt) + Code: Remove unnecessary calls to String.intern() in the parsing of configuration files. (markt) + Fix: Extend sessionAttributeValueClassNameFilter to include filtering of dynamic proxy interface classes. (markt) + Fix: Attempt to use rollback when persisting user data to the DataSourceUserDatabase fails and improve error reporting. (remm) + Fix: 70143: Handle InvalidFileNameException when parsing parts to rethrow it as an IllegalStateException as mandated by the Servlet specification. (remm) + Fix: Add missing reason to the JsonErrorReportValve. (remm) + Fix: evaluation of the N and C flags for rewrite rules. (remm) + Fix: qsd flag should always discard the original query string when rewriting. (remm) + Fix: Add appropriate escaping for context path, current directory name and parent directory name for directory listings produced by the default servlet. Ensure XML escaping is used with XML output. (markt) + Fix: When processing certificate subject names and issuer names within RewriteValve rules, always use the RFC 2253 format name. (markt) + Fix: the incorrect rejection of requests using digest authentication when the client provided nonce count is at the upper boundary of the window (markt). + Update: Separate the Context role mapping from the Servlet specification security-role-ref. (remm) + Fix: Handle the case where the JNDIRealm is configured to perform role searches with userRoleAttribute but the attribute is not available or not configured for the current user. (markt) + Fix: Improve handling of session attribute addition concurrent with session expiration. An application will now either see a successful addition followed by expiration or the addition will not succeed. It is no longer possible for the session to expire and the addition to succeed. This is of particular not for attributes that implement HttpSessionBindingListener. (markt) + Fix: Add a new attribute to the Context, urlPatternsProvidedInDecodedForm. This attribute controls whether URLs and URL patterns provided in the deployment descriptor (web.xml), annotations and/or their programmatic equivalents are treated as being provided in URL-encoded form (i.e. using %nn encoding) or in decoded form. The Servlet specification requires that they are provided in decoded form. However, Tomcat has historically treated them as if they are provided in encoded form. In Tomcat 12, they will always be treated as if they are provided in decoded form. This setting enables migration from encoded form to decoded form on an application by application basis. This attribute will be removed in Tomcat 12 where it will effectively be hard-coded to true. (markt) + Fix: Ensure the security constraint with the longest matching path is selected when more than one constraint matches the request path. (markt) + Fix: If the request saved by FORM authentication uses a method other than GET, ensure that the security constraints are re-assessed after the saved request is restored and before it is processed. Custom Authenticator implementations that extend FormAuthenticator and override doAuthenticate() and/or restoreRequest() will require modification. (markt) + Fix: Various improvements to the DataSourceRealm. A failure to connect to the database or an exception during either user or role lookup will now result in an authentication failure rather than a partially populated Principal. For CLIENT-CERT and SPNEGO authentication, the user must exist in the database for authentication to succeed. (markt) * Coyote + Update: Add utility AutoCloseable URLConnection wrapper, and use it to cleanup existing code patterns. (remm/markt) + Fix: When processing an HTTP upgrade from HTTP/1.1 to HTTP/2, ensure that all the HTTP/1.1 data has been processed before switching protocols. (markt) + Fix: Require every HTTP/2 request to provide an authority (either an :authority pseudo header or a Host header). (markt) + Fix: Register the use of an HTTP/2 stream identifier earlier so that there is no possibility of a re-used stream identifier being accepted, regardless of how early in the HEADERS frame processing an error is detected. (markt) + Add: new attributes (unixDomainSocketParentPermissions and unixDomainSocketParentOwner) to the NIO connector to provide additional control over the security of Unix Domain Sockets. Additional checks (enabled by default) have also been added for the directory where the Unix Domain Socket will be created.(markt) + Fix: an allocation leak in the HTTP/2 backlog tracking when a stream is reset. (markt) * Jasper + Fix: Ensure internal state is reset before re-using ELParser. (markt) * WebSocket + Add: a limit (defaults to 8KB) on the size of the HTTP response headers accepted during a WebSocket HTTP upgrade. This is configured via the org.apache.tomcat.websocket.MAX_HTTP_RESPONSE_HEADER_BYTES user property. (markt) + Fix: Improve URI template matching for WebSocket end points. Trailing slashes are now significant both for template definitions and URIs considered for potential matches to those URIs. Note that this means if a URI template ends in a variable without a trailing slash, that variable might be expanded to the empty string. (markt) + Fix: Account for session ID changes when tracking WebSocket connections for closure because they were created under an authenticated HTTP session that has since ended. (markt) * Web applications + Fix: Documentation: Better sample httpd configuration for use with SSLValve and add a note that the exact configuration required will depend on the overall httpd configuration. (markt) + Fix: Examples: Limit the buffering of messages in the WebSocket chat example to prevent a malicious client triggering excessive memory usage that could lead to a DoS. (markt) + Fix: Documentation: Expand the description of the %S (session ID) access log pattern token. (markt) + Fix: Manager: Use reflection to load clustering classes in sessionsList.jsp so the sessions list page renders correctly when clustering JARs are not present. (csutherl) * Other + Update: Maven Resolver Ant Tasks to 1.6.1. (rjung) + Update: Objenesis to 3.6. (markt) + Update: JSign to 7.5. (markt) + Update: Bouncy Castle to 1.85. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji. (markt) * Cluster + Add: Change the default encryptionAlgorithm for the EncryptInterceptor to AES/GCM/NoPadding. This is a breaking change for the EncryptInterceptor. (markt) + Add: Expand the documentation for the EncryptInterceptor to be more explicit regarding the security weaknesses of some supported algorithms. Also explicitly state that the replay protection is only effective for non-malleable algorithms. (markt) + Add: Expand the Javadoc for the DNSMembershipProvider in particular explaining its behaviour and providing configuration advice if control more over cluster membership is required. (markt) * jdbc-pool + Fix: 70164: Correct the documentation for the testOnBorrow attribute. Pull request #1033 provided by Kohei Tamura. (markt) ++++ tomcat10: - Update to Tomcat 10.1.59 * Fixed CVEs: + CVE-2026-73180: If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. (bsc#1276902) + CVE-2026-68763: An allocation leak in the HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service. (bsc#1276901) + CVE-2026-68569: For some authentication methods (e.g. CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm. (bsc#1276900) + CVE-2026-68525: The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource POST but not GET. (bsc#1276899) + CVE-2026-66422: security-role-ref definitions were incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). (bsc#1276898) + CVE-2026-66299: The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process. (bsc#1273150) + CVE-2026-65927: An off-by-one error impacting the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first rule. (bsc#1276897) + CVE-2026-65905: If, before windowSize requests had been made, a client made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request was replayable once only while the associated nonceCount remained within the replay window. (bsc#1276896) + CVE-2026-65637: The fix for CVE-2026-32990 was incomplete. (bsc#1276895) + CVE-2026-65183: A race condition when creating a Unix Domain Socket allowed an unauthorised local user to access the Unix Domain Socket. (bsc#1276894) + CVE-2026-65182: The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path. (bsc#1276893) * Catalina + Fix: Ensure that a login-config conflict when merging web.xml fragments triggers a deployment failure. (markt) + Code: Remove unnecessary calls to String.intern() in the parsing of configuration files. (markt) + Fix: Extend sessionAttributeValueClassNameFilter to include filtering of dynamic proxy interface classes. (markt) + Fix: Attempt to use rollback when persisting user data to the DataSourceUserDatabase fails and improve error reporting. (remm) + Fix: 70143: Handle InvalidFileNameException when parsing parts to rethrow it as an IllegalStateException as mandated by the Servlet specification. (remm) + Fix: Add missing reason to the JsonErrorReportValve. (remm) + Fix: evaluation of the N and C flags for rewrite rules. (remm) + Fix: qsd flag should always discard the original query string when rewriting. (remm) + Fix: Add appropriate escaping for context path, current directory name and parent directory name for directory listings produced by the default servlet. Ensure XML escaping is used with XML output. (markt) + Fix: When processing certificate subject names and issuer names within RewriteValve rules, always use the RFC 2253 format name. (markt) + Fix: the incorrect rejection of requests using digest authentication when the client provided nonce count is at the upper boundary of the window (markt). + Update: Separate the Context role mapping from the Servlet specification security-role-ref. (remm) + Fix: Handle the case where the JNDIRealm is configured to perform role searches with userRoleAttribute but the attribute is not available or not configured for the current user. (markt) + Fix: Improve handling of session attribute addition concurrent with session expiration. An application will now either see a successful addition followed by expiration or the addition will not succeed. It is no longer possible for the session to expire and the addition to succeed. This is of particular not for attributes that implement HttpSessionBindingListener. (markt) + Fix: Add a new attribute to the Context, urlPatternsProvidedInDecodedForm. This attribute controls whether URLs and URL patterns provided in the deployment descriptor (web.xml), annotations and/or their programmatic equivalents are treated as being provided in URL-encoded form (i.e. using %nn encoding) or in decoded form. The Servlet specification requires that they are provided in decoded form. However, Tomcat has historically treated them as if they are provided in encoded form. In Tomcat 12, they will always be treated as if they are provided in decoded form. This setting enables migration from encoded form to decoded form on an application by application basis. This attribute will be removed in Tomcat 12 where it will effectively be hard-coded to true. (markt) + Fix: Ensure the security constraint with the longest matching path is selected when more than one constraint matches the request path. (markt) + Fix: If the request saved by FORM authentication uses a method other than GET, ensure that the security constraints are re-assessed after the saved request is restored and before it is processed. Custom Authenticator implementations that extend FormAuthenticator and override doAuthenticate() and/or restoreRequest() will require modification. (markt) + Fix: Various improvements to the DataSourceRealm. A failure to connect to the database or an exception during either user or role lookup will now result in an authentication failure rather than a partially populated Principal. For CLIENT-CERT and SPNEGO authentication, the user must exist in the database for authentication to succeed. (markt) + Fix: Improve the handling of AsyncContext.dispatch() when the Context attribute dispatchersUseEncodedPaths is set to false since the application has no control over the path used for the AsyncContext.dispatch(). Prior to this fix, paths containing literal '?' characters were truncated. (markt) + Fix: Ensure that capture groups from a RewriteCond always reflect the result of the current request. (markt) + Fix: async path building. (markt) * Coyote + Update: Add utility AutoCloseable URLConnection wrapper, and use it to cleanup existing code patterns. (remm/markt) + Fix: When processing an HTTP upgrade from HTTP/1.1 to HTTP/2, ensure that all the HTTP/1.1 data has been processed before switching protocols. (markt) + Fix: Require every HTTP/2 request to provide an authority (either an :authority pseudo header or a Host header). (markt) + Fix: Register the use of an HTTP/2 stream identifier earlier so that there is no possibility of a re-used stream identifier being accepted, regardless of how early in the HEADERS frame processing an error is detected. (markt) + Add: new attributes (unixDomainSocketParentPermissions and unixDomainSocketParentOwner) to the NIO connector to provide additional control over the security of Unix Domain Sockets. Additional checks (enabled by default) have also been added for the directory where the Unix Domain Socket will be created.(markt) + Fix: an allocation leak in the HTTP/2 backlog tracking when a stream is reset. (markt) + Fix: parsing of client certificates that specify more than one OCSP responder for configurations that use OpenSSL-FFM. (markt) * Jasper + Fix: Ensure internal state is reset before re-using ELParser. (markt) * WebSocket + Add: a limit (defaults to 8KB) on the size of the HTTP response headers accepted during a WebSocket HTTP upgrade. This is configured via the org.apache.tomcat.websocket.MAX_HTTP_RESPONSE_HEADER_BYTES user property. (markt) + Fix: Improve URI template matching for WebSocket end points. Trailing slashes are now significant both for template definitions and URIs considered for potential matches to those URIs. Note that this means if a URI template ends in a variable without a trailing slash, that variable might be expanded to the empty string. (markt) + Fix: Account for session ID changes when tracking WebSocket connections for closure because they were created under an authenticated HTTP session that has since ended. (markt) * Web applications + Fix: Documentation: Better sample httpd configuration for use with SSLValve and add a note that the exact configuration required will depend on the overall httpd configuration. (markt) + Fix: Examples: Limit the buffering of messages in the WebSocket chat example to prevent a malicious client triggering excessive memory usage that could lead to a DoS. (markt) + Fix: Documentation: Expand the description of the %S (session ID) access log pattern token. (markt) + Fix: Manager: Use reflection to load clustering classes in sessionsList.jsp so the sessions list page renders correctly when clustering JARs are not present. (csutherl) * Other + Update: Maven Resolver Ant Tasks to 1.6.1. (rjung) + Update: Objenesis to 3.6. (markt) + Update: JSign to 7.5. (markt) + Update: Bouncy Castle to 1.85. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji. (markt) * Cluster + Add: Change the default encryptionAlgorithm for the EncryptInterceptor to AES/GCM/NoPadding. This is a breaking change for the EncryptInterceptor. (markt) + Add: Expand the documentation for the EncryptInterceptor to be more explicit regarding the security weaknesses of some supported algorithms. Also explicitly state that the replay protection is only effective for non-malleable algorithms. (markt) + Add: Expand the Javadoc for the DNSMembershipProvider in particular explaining its behaviour and providing configuration advice if control more over cluster membership is required. (markt) * jdbc-pool + Fix: 70164: Correct the documentation for the testOnBorrow attribute. Pull request #1033 provided by Kohei Tamura. (markt) ++++ tomcat11: - Update to Tomcat 11.0.25 * Fixed CVEs: + CVE-2026-73180: If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. (bsc#1276902) + CVE-2026-68763: An allocation leak in the HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service. (bsc#1276901) + CVE-2026-68569: For some authentication methods (e.g. CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm. (bsc#1276900) + CVE-2026-68525: The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource POST but not GET. (bsc#1276899) + CVE-2026-66422: security-role-ref definitions were incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). (bsc#1276898) + CVE-2026-66299: The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process. (bsc#1273150) + CVE-2026-65927: An off-by-one error impacting the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first rule. (bsc#1276897) + CVE-2026-65905: If, before windowSize requests had been made, a client made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request was replayable once only while the associated nonceCount remained within the replay window. (bsc#1276896) + CVE-2026-65637: The fix for CVE-2026-32990 was incomplete. (bsc#1276895) + CVE-2026-65183: A race condition when creating a Unix Domain Socket allowed an unauthorised local user to access the Unix Domain Socket. (bsc#1276894) + CVE-2026-65182: The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path. (bsc#1276893) * Catalina + Fix: Ensure that a login-config conflict when merging web.xml fragments triggers a deployment failure. (markt) + Code: Remove unnecessary calls to String.intern() in the parsing of configuration files. (markt) + Fix: Extend sessionAttributeValueClassNameFilter to include filtering of dynamic proxy interface classes. (markt) + Fix: Attempt to use rollback when persisting user data to the DataSourceUserDatabase fails and improve error reporting. (remm) + Fix: 70143: Handle InvalidFileNameException when parsing parts to rethrow it as an IllegalStateException as mandated by the Servlet specification. (remm) + Fix: Add missing reason to the JsonErrorReportValve. (remm) + Fix: evaluation of the N and C flags for rewrite rules. (remm) + Fix: qsd flag should always discard the original query string when rewriting. (remm) + Fix: Add appropriate escaping for context path, current directory name and parent directory name for directory listings produced by the default servlet. Ensure XML escaping is used with XML output. (markt) + Fix: When processing certificate subject names and issuer names within RewriteValve rules, always use the RFC 2253 format name. (markt) + Fix: the incorrect rejection of requests using digest authentication when the client provided nonce count is at the upper boundary of the window (markt). + Update: Separate the Context role mapping from the Servlet specification security-role-ref. (remm) + Fix: Handle the case where the JNDIRealm is configured to perform role searches with userRoleAttribute but the attribute is not available or not configured for the current user. (markt) + Fix: Improve handling of session attribute addition concurrent with session expiration. An application will now either see a successful addition followed by expiration or the addition will not succeed. It is no longer possible for the session to expire and the addition to succeed. This is of particular not for attributes that implement HttpSessionBindingListener. (markt) + Fix: Add a new attribute to the Context, urlPatternsProvidedInDecodedForm. This attribute controls whether URLs and URL patterns provided in the deployment descriptor (web.xml), annotations and/or their programmatic equivalents are treated as being provided in URL-encoded form (i.e. using %nn encoding) or in decoded form. The Servlet specification requires that they are provided in decoded form. However, Tomcat has historically treated them as if they are provided in encoded form. In Tomcat 12, they will always be treated as if they are provided in decoded form. This setting enables migration from encoded form to decoded form on an application by application basis. This attribute will be removed in Tomcat 12 where it will effectively be hard-coded to true. (markt) + Fix: Ensure the security constraint with the longest matching path is selected when more than one constraint matches the request path. (markt) + Fix: If the request saved by FORM authentication uses a method other than GET, ensure that the security constraints are re-assessed after the saved request is restored and before it is processed. Custom Authenticator implementations that extend FormAuthenticator and override doAuthenticate() and/or restoreRequest() will require modification. (markt) + Fix: Various improvements to the DataSourceRealm. A failure to connect to the database or an exception during either user or role lookup will now result in an authentication failure rather than a partially populated Principal. For CLIENT-CERT and SPNEGO authentication, the user must exist in the database for authentication to succeed. (markt) * Coyote + Update: Add utility AutoCloseable URLConnection wrapper, and use it to cleanup existing code patterns. (remm/markt) + Fix: When processing an HTTP upgrade from HTTP/1.1 to HTTP/2, ensure that all the HTTP/1.1 data has been processed before switching protocols. (markt) + Fix: Require every HTTP/2 request to provide an authority (either an :authority pseudo header or a Host header). (markt) + Fix: Register the use of an HTTP/2 stream identifier earlier so that there is no possibility of a re-used stream identifier being accepted, regardless of how early in the HEADERS frame processing an error is detected. (markt) + Add: new attributes (unixDomainSocketParentPermissions and unixDomainSocketParentOwner) to the NIO connector to provide additional control over the security of Unix Domain Sockets. Additional checks (enabled by default) have also been added for the directory where the Unix Domain Socket will be created.(markt) + Fix: an allocation leak in the HTTP/2 backlog tracking when a stream is reset. (markt) * Jasper + Fix: Ensure internal state is reset before re-using ELParser. (markt) * WebSocket + Add: a limit (defaults to 8KB) on the size of the HTTP response headers accepted during a WebSocket HTTP upgrade. This is configured via the org.apache.tomcat.websocket.MAX_HTTP_RESPONSE_HEADER_BYTES user property. (markt) + Fix: Improve URI template matching for WebSocket end points. Trailing slashes are now significant both for template definitions and URIs considered for potential matches to those URIs. Note that this means if a URI template ends in a variable without a trailing slash, that variable might be expanded to the empty string. (markt) + Fix: Account for session ID changes when tracking WebSocket connections for closure because they were created under an authenticated HTTP session that has since ended. (markt) * Web applications + Fix: 70160: Correct various references to the Servlet specification to use version 6.1. (markt) + Fix: Documentation: Better sample httpd configuration for use with SSLValve and add a note that the exact configuration required will depend on the overall httpd configuration. (markt) + Fix: Examples: Limit the buffering of messages in the WebSocket chat example to prevent a malicious client triggering excessive memory usage that could lead to a DoS. (markt) + Fix: Documentation: Expand the description of the %S (session ID) access log pattern token. (markt) + Fix: Manager: Use reflection to load clustering classes in sessionsList.jsp so the sessions list page renders correctly when clustering JARs are not present. (csutherl) * Other + Update: Maven Resolver Ant Tasks to 1.6.1. (rjung) + Update: Objenesis to 3.6. (markt) + Update: JSign to 7.5. (markt) + Update: Bouncy Castle to 1.85. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji. (markt) * Cluster + Add: Change the default encryptionAlgorithm for the EncryptInterceptor to AES/GCM/NoPadding. This is a breaking change for the EncryptInterceptor. (markt) + Add: Expand the documentation for the EncryptInterceptor to be more explicit regarding the security weaknesses of some supported algorithms. Also explicitly state that the replay protection is only effective for non-malleable algorithms. (markt) + Add: Expand the Javadoc for the DNSMembershipProvider in particular explaining its behaviour and providing configuration advice if control more over cluster membership is required. (markt) * jdbc-pool + Fix: 70164: Correct the documentation for the testOnBorrow attribute. Pull request #1033 provided by Kohei Tamura. (markt) ------------------------------------------------------------------ ------------------ 2026-9-6 - Sep 6 2026 ------------------- ------------------------------------------------------------------ ++++ trivy: - update vendor to address: * bsc#1279395, CVE-2026-84304: trivy: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame * bsc#1279392, CVE-2026-84445: trivy: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers * bsc#1279390, CVE-2026-84303: trivy: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization ------------------------------------------------------------------ ------------------ 2026-9-4 - Sep 4 2026 ------------------- ------------------------------------------------------------------ ++++ clamav: - Put libclamunrar into an optional subpackage, because it has a NonFree license. - Improve macro usage for the library subpackages. - Add clamav-libcheck-workarounds.patch to work around missing macros in libcheck-0.10.0 on SLE-12-SP5. ++++ transactional-update: - Version 5.0.9 - libtukit: Fix --drop-if-no-change after apply [bsc#1276847] ++++ freeciv: - freeciv 3.2.6: * Fix Heap Buffer Overflow in worklist_load() via Crafted Save File (boo#1278695) * Fix Out-of-Bounds Read in activities.order[] via Crafted Save File (boo#1278696) * Fix some unit move legality checks and path finding issues * Improve logging about player authentication * Fix infinite audio loop in the client exit with the SDL3 audio * Fix issue with displayed "turns to grow" for the city to be wrong after city shrank * Made tech tree not to show buildings or governments which tech actually makes unavailable * Bug fixes, translation updates, docummentation updates - drop reproducible.patch, merged upstream ++++ libzypp: - Prevent libgpgme from launching gpg-agents; we don't need them. - defaultLoadSystem: Hand out the ZYpp::Ptr as return value. - Log all solver problem rules (bsc#1277790) The log contains the most relevant problem rule, but sometimes it helps to know all rules associated with this problem. zypper shows them on demand as 'detail'. The log now remembers them as well. - Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749) - repoGpgCheck: Strictly follow the repo_gpgcheck setting (bsc#1274625) There's been a legacy exception for unsigned repositories which were explicitly accepted in the past. After switching the repo_gpgcheck from off to on, they were allowed to stay unsigned until a first signed version was retrieved. From there on the handling was strict. Now the handling is strict as soon as the repo_gpgcheck turned on. The next set of metadata retrieved must be signed. - Iniparser: each new file starts in the unnamed section (bsc#1272534) - Fix hasCredentials() to require both username AND password to be non-empty (bsc#1273242) This avoids an unnecessary 2nd 401 response sending just the username in case the username but no password is known. Now it immediately fetches the credentials from disk if no password is known. - GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730) The short Id (32bit/8byte) is not considered to be a safe identifier for a gpg key. A long id (64bit/16byte) or even better the full fingerprint is needed to identify the key. - zypp: Improve Testcase Loading for MCP Tools. - spec: Remove useless %bcond visibility_hidden (is always ON in cmake) - version 17.38.15 (35) ++++ opensc: - CVE-2026-40510 opensc: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory corruption bsc#1266964 * Add opensc-CVE-2026-40510.patch ++++ python-jwcrypto: - CVE-2026-84185: General JSON JWS kid binding bypass during JWKSet verification (bsc#1278707) * added CVE-2026-84185.patch ++++ qemu: - Fix bsc#1274579: * target/i386: add compatibility property for pdcm feature (bsc#1274579) - Update to version 10.0.13 Full backport list here: https://lore.kernel.org/qemu-devel/20260827155547.639034-1-mjt@tls.msk.ru/ A selection of them is reported here below: target/riscv/tcg: sret in virtual user mode raises virtual instruction exception target/riscv: enforce even register constraints for Zdinx fcvt pairs target/riscv: reject FMV.X.W/FMV.W.X under Zfinx target/riscv: honor zicbo* envcfg gating in linux-user mode disas/riscv: Fix typo in th.lbib format disas/riscv: Fix isa decoding of rev8 disas/riscv: Fix rv32 encoding of zext.h target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs disas/riscv: Decode unsigned vector immediates as unsigned disas/riscv: Use signed type for vector immediates disas/riscv: Fix 6-bit immediate extraction disas/riscv: Fix th.srri decoding target/riscv: use SXL instead of MXL for read_sstatus target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling hw/watchdog: Add lower bound check for watchdogNumber tcg: Export tcg_gen_ussub_i{32,64,tl} tcg: Defer tb_flush when initial thread region alloc fails tcg: Return success from tcg_region_alloc tcg: Return success from tcg_region_alloc__locked target/loongarch: check FPE before reading fcc in bceqz/bcnez meson: make linker warnings non-fatal on Linux serial: clear transmit retry callback on unrealize target/i386: decode opcode extensions group 3 /1 as TEST target/i386: allow transition to virtual-8086 mode only if CPL == 0 and CPU is not in long mode target/i386: fix long mode segment override prefix decoding target/i386: fix incorrect decoding of EXTRQ_i target/i386: Clear OF, SF, and AF for fcomi/fucomi target/i386: Use correct type for get_float_exception_flags() values tcg/optimize: Fix s_mask computation for shifts tcg/optimize: INDEX_op_mul is commutative hw/elf_ops: defend against weird elf headers hw/nvme: add SPDM_SOCKET Kconfig dependency hw/block/pflash_cfi01: Restore ROMD mode after migration hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets tests/qtest/ahci: regression test for ATAPI read vs. drain hw/ide/atapi: read the whole elementary transfer asynchronously tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads tests/qtest/libqos/ahci: support raw (2352-byte) READ CD tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads tests/qtest/ide-test: add a multi-sector ATAPI DMA read test tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test ++++ qemu-linux-user: - Fix bsc#1274579: * target/i386: add compatibility property for pdcm feature (bsc#1274579) - Update to version 10.0.13 Full backport list here: https://lore.kernel.org/qemu-devel/20260827155547.639034-1-mjt@tls.msk.ru/ A selection of them is reported here below: target/riscv/tcg: sret in virtual user mode raises virtual instruction exception target/riscv: enforce even register constraints for Zdinx fcvt pairs target/riscv: reject FMV.X.W/FMV.W.X under Zfinx target/riscv: honor zicbo* envcfg gating in linux-user mode disas/riscv: Fix typo in th.lbib format disas/riscv: Fix isa decoding of rev8 disas/riscv: Fix rv32 encoding of zext.h target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs disas/riscv: Decode unsigned vector immediates as unsigned disas/riscv: Use signed type for vector immediates disas/riscv: Fix 6-bit immediate extraction disas/riscv: Fix th.srri decoding target/riscv: use SXL instead of MXL for read_sstatus target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling hw/watchdog: Add lower bound check for watchdogNumber tcg: Export tcg_gen_ussub_i{32,64,tl} tcg: Defer tb_flush when initial thread region alloc fails tcg: Return success from tcg_region_alloc tcg: Return success from tcg_region_alloc__locked target/loongarch: check FPE before reading fcc in bceqz/bcnez meson: make linker warnings non-fatal on Linux serial: clear transmit retry callback on unrealize target/i386: decode opcode extensions group 3 /1 as TEST target/i386: allow transition to virtual-8086 mode only if CPL == 0 and CPU is not in long mode target/i386: fix long mode segment override prefix decoding target/i386: fix incorrect decoding of EXTRQ_i target/i386: Clear OF, SF, and AF for fcomi/fucomi target/i386: Use correct type for get_float_exception_flags() values tcg/optimize: Fix s_mask computation for shifts tcg/optimize: INDEX_op_mul is commutative hw/elf_ops: defend against weird elf headers hw/nvme: add SPDM_SOCKET Kconfig dependency hw/block/pflash_cfi01: Restore ROMD mode after migration hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets tests/qtest/ahci: regression test for ATAPI read vs. drain hw/ide/atapi: read the whole elementary transfer asynchronously tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads tests/qtest/libqos/ahci: support raw (2352-byte) READ CD tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads tests/qtest/ide-test: add a multi-sector ATAPI DMA read test tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test ++++ zk: - Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447): * Upgrade golang.org/x/crypto to v0.56.0 to fix security vulnerabilities in the embedded x/crypto/ssh package: - CVE-2026-56854: authentication bypass - CVE-2026-56855: deadlock vulnerability - CVE-2026-78662: deadlock vulnerability ++++ zypper: - Show solver problem details per default in not-interactive mode (bsc#1277790) This way they see all details when capturing zypper's output because the (d)etail button can't be pressed in not-interactive mode. - version 1.14.101 ------------------------------------------------------------------ ------------------ 2026-9-3 - Sep 3 2026 ------------------- ------------------------------------------------------------------ ++++ certification-sles-eal4: - reimported new EAL 4 certification package ++++ chromium: - Chromium 152.0.7977.82 (boo#1278683): * CVE-2026-85046: Type confusion in V8 * CVE-2026-85052: Out of bounds read in CrashReporting * CVE-2026-85043: Incomplete cleanup in Network * CVE-2026-85048: Use after free in Compositing * CVE-2026-85045: Race condition in V8 * CVE-2026-85050: Out of bounds write in WebGL * CVE-2026-85053: Improper resource exposure in CacheStorage * CVE-2026-85042: Use after free in DevTools * CVE-2026-85049: Use after free in Skia * CVE-2026-85051: Type confusion in Compositing * CVE-2026-85047: Improper input validation in Transactions Platform * CVE-2026-85044: Use of released resource in Mobile ++++ libcupsfilters: - libcupsfilters-2.1.1-CVE-2026-64611.patch is based on https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217 backported to libcupsfilters 2.1.1 to fix CVE-2026-64611 "Infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field" https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4 "user who controls an IEEE-1284 device ID consumed by `cfIEEE1284GetMakeModel` can drive `cfIEEE1284NormalizeMakeModel` into an infinite loop" (bsc#1273145) - libcupsfilters-2.1.1-CVE-2026-64612.patch is based on https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419 backported to libcupsfilters 2.1.1 to fix CVE-2026-64612 "Malformed PNG aborts CUPS image filter process (missing libpng setjmp recovery)" https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch "authenticated client that can submit an image print job can abort the CUPS filter process by supplying a malformed PNG" (bsc#1273146) ++++ php-composer2: - added patches CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL [bsc#1278257] * php-composer2-CVE-2026-84361.patch ++++ python-sqlparse: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097) * added CVE-2026-84305.patch ++++ rsyslog: - gtls: guard early debug-level lookup (bsc#1274610) * add 0001-gtls-guard-early-debug-level-lookup.patch ++++ rtk: - Update to 0.47.0: * grep: incompatible flag change, -t, -l and -m under "rtk grep" are now the native grep flags and the never-wired --file-type is gone; use "rtk rg -t " for type filtering * ctest: new compact output filter * phpt: new filter for php-src run-tests.php * mvn: recognise the Maven Daemon via "rtk mvnd" * ls: cap long listings with a tee tail hint and follow the standard dotfile semantics * diff, git-diff: render a real diff instead of dumping both files, keep the +/- markers at column 0, end hunks at their declared length and pass word diffs through untouched * hooks: honour CLAUDE_CONFIG_DIR and exclude_commands under wrapped commands, and tolerate a UTF-8 BOM on hook stdin and JSON input * tsc: handle pretty diagnostics and bound the failure dump - Refresh rtk-unbundle-sqlite.patch and rtk-no-deny-warnings.patch against the 0.47.0 manifest (context only, both still needed -- upstream PRs 3446 and 3447 are open) - No licence change: the re-vendored set still resolves to the existing License tag; refreshed the crate counts in the Legal-Review-Notice comment (194 vendored, 134 linked) ------------------------------------------------------------------ ------------------ 2026-9-2 - Sep 2 2026 ------------------- ------------------------------------------------------------------ ++++ NetworkManager: - Add NetworkManager-CVE-2026-10805.patch: dhclient: reject unsafe characters in URLs and hostnames (bsc#1267696, CVE-2026-10805, glfd#NetworkManager/NetworkManager!2426). - Add NetworkManager-CVE-2026-19685.patch: core: 802.1x: reject ca-path for private connections (bsc#1276764, CVE-2026-19685, glfd#NetworkManager/NetworkManager!2513). ++++ aws-cli-cmd: - Allow to skip missing host volume sharing paths This Fixes bsc#1274855 ++++ az-cli-cmd: - Allow to skip missing host volume sharing paths This Fixes bsc#1274855 ++++ chromium: - Chromium 152.0.7977.75 (boo#1278072): * CVE-2026-84353: Use after free in Shared Tab Groups * CVE-2026-84352: Use after free in WebGL * CVE-2026-84354: Incorrect authorization in FileSystem * CVE-2026-84359: Information leak in Skia * CVE-2026-84357: Improper input validation in Omnibox * CVE-2026-84324: Use after free in Proxy * CVE-2026-84349: Use after free in Browser * CVE-2026-84326: Uninitialized resource in V8 * CVE-2026-84333: Use after free in Dawn * CVE-2026-84351: Buffer overflow in GPU * CVE-2026-84325: Improper input validation in DataTransfer * CVE-2026-84328: Missing authorization in FileSystem * CVE-2026-84347: Use after free in WebRTC * CVE-2026-84323: Missing authorization in FileSystem * CVE-2026-84355: Incorrect authorization in Navigation * CVE-2026-84358: Improper privilege management in Downloads * CVE-2026-84332: Incorrect authorization in SiteSettings * CVE-2026-84330: UI misrepresentation in FullScreen * CVE-2026-84334: Incorrect authorization in Chromoting * CVE-2026-84348: Information leak in MediaCapture * CVE-2026-84335: Incorrect authorization in TabStrip * CVE-2026-84327: Incorrect authorization in Autofill * CVE-2026-84329: Confused deputy in CredentialProvider * CVE-2026-84356: UI misrepresentation in FullScreen * CVE-2026-84350: Use after free in TabStrip * CVE-2026-84331: Incorrect authorization in Actor ++++ flake-pilot: - Bump version: 3.1.50 → 3.1.51 - Fix UDS socket setup Check if there is an old UDS socket file still present prior creating a new firecracker process. It must be deleted to allow the new firecracker process to create and connect to it - Fix firecracker network setup Make sure a host route is added when assigning an IP address to a firecracker instance (tap device) - Update appstore Make sure nfs-client exists in the firecracker images - Bump version: 3.1.49 → 3.1.50 - Fix evaluation of %ignore_missing_volume_path The argument parser splits option name and argument name into single words which requires a different matching logic in the loop iterating through the argument values ++++ govulncheck-vulndb: - Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4 * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4 * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8 * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2 * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4 * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3 * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899 * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8 * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v * GO-2026-6354 CVE-2026-78662 * GO-2026-6355 CVE-2026-56855 ++++ helm: - update vendor.tar to fix * bsc#1278270, CVE-2026-84303 * bsc#1278273, CVE-2026-84304 * bsc#1278688, CVE-2026-84445 ++++ mcphost: - Update github.com/mark3labs/mcp-go/server to v0.56.0 to fix CVE-2026-81092: Missing Host Header Validation Enables DNS Rebinding (bsc#1278013). Above change removes a dependency on github.com/buger/jsonparser=github.com/buger/jsonparser. ++++ perl-URI: - added patches CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in `nameprep` [bsc#1277886] * perl-URI-CVE-2026-19953.patch ++++ python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests (bsc#1275231) * added CVE-2026-41479.patch ++++ python-jwcrypto: - CVE-2026-80179: Denial of Service via malformed JWE tokens (bsc#1277639) * added CVE-2026-80179.patch ------------------------------------------------------------------ ------------------ 2026-9-1 - Sep 1 2026 ------------------- ------------------------------------------------------------------ ++++ apptainer: - Update go.opentelemetry.io/otel to 1.44.0 to fix CVE-2026-41178 (bsc#1276731). It caused `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. ++++ chromium: - build with llvm22 on openSUSE Tumbleweed ++++ curl: - Security fixes: * CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476) * CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479) * CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480) * Add patches: - curl-CVE-2026-13608.patch - curl-CVE-2026-80229.patch - curl-CVE-2026-80230.patch ++++ flake-pilot: - Add new pilot_options section to the flake config Allow to specify pilot options (that are options beginning with a %) like %ignore_missing_volume_path in the flake yaml registration file. A new registration argument named --pilot-option can be used to permanently add a pilot option as part of the registration such that it does not have to be passed at the commandline. This is related to bsc#1274855 Assisted-by: Claude:claude-opus-4-6 - Bump version: 3.1.48 → 3.1.49 - Fixed Makefile ghpages target missing the setup - Bump version: 3.1.47 → 3.1.48 - Fix bumpversion config Invalid path setup - Refactor documentation Create a user guide rather than a README. The information in the README has grown a lot and the document became less clear. This commit turns the information into a user guide style documentation and pushes it to gh-pages. The former README just lists a link to the documentation page ++++ go1.26: - go1.26.8 (released 2026-09-01) includes fixes to cgo, the compiler, the runtime, and the debug/elf and os packages. Refs boo#1255111 go1.26 release tracking * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075 * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26 * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64 ++++ go1.27: - go1.27.1 (released 2026-09-01) includes fixes to cgo, the compiler, the runtime, the go fix command, and the database/sql, debug/elf, encoding/json, net/http, os, simd, and simd/archsimd packages. Refs boo#1272545 go1.27 release tracking * go#81195 cmd/compile: malformed linker symbol for generic method with a receiver that is an alias to a pointer * go#81151 database/sql: closingMutex lost wakeup deadlocks Rows.Next against concurrent Rows.Close * go#81114 debug/elf: applyRelocationsPPC was broken by CL 705075 * go#81110 simd/archsimd/internal/simd_test: SIGILL on RK3588 and possibly other arm64 processors * go#81109 cmd/compile: GOEXPERIMENT=simd stub method parameter enforced inconsistently Int16s.ShiftAllLeft rejects both uint8 and uint64 arguments depending on context * go#81101 cmd/fix, x/tools/go/analysis/passes/modernize: embedlit: comma in a comment produces invalid code * go#81096 cmd/compile: SIGILL due to new dependency on z14 s390x instruction set version on z13 and earlier CPUs * go#81083 encoding/json: quoted null rejected for string fields with the ,string option in Go 1.27 * go#81059 cmd/fix, x/tools/go/analysis/passes/modernize: embedlit: moving field assignments produces duplicate field name in struct literal * go#81027 net/http: Request.Body.Close returns io.EOF when a handler leaves part of the body unread * go#81016 database/sql: support for uuid.UUID undocumented * go#81012 encoding/json/v2: missing io.ErrUnexpectedEOF from v1 Decoder.Token * go#81011 encoding/json/v2: definition of "JSON-representable fields" looks incorrect * go#81006 cmd/go: go fix embedded literal produces non-compiling program * go#80981 cmd/compile: malformed relocation target for generic method when type argument name contains the method name * go#80935 crypto/tls: client handshake tests hardcode TLSv1.0 ++++ hauler: - update to 2.1.0 (bsc#1265425, CVE-2026-41888): * `v2.1.0` is a **minor** release built on the containerd- native foundation laid down in `v2.0.0`. The headline is that `hauler store sync` and `hauler store add` are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling. * **Notable dependency bumps:** Go → **1.26.6**; `containerd/v2` → 2.3.4; `sigstore/cosign/v3` → 3.1.3; `sigstore/sigstore` → 1.10.9; `go-containerregistry` → 0.22.0; `helm/v4` → 4.2.4; `k8s.io` libs (apimachinery, api, client-go) → 0.37.0; `logrus` → 1.10.2; `docker/go-metrics` → 0.1.0; `sigstore/rekor` → 1.5.4 (CVE resolution); plus `x/mod` and `go-isatty`. ++++ hauler: - update to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662): * `v2.1.0` is a **minor** release built on the containerd- native foundation laid down in `v2.0.0`. The headline is that `hauler store sync` and `hauler store add` are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling. * **Notable dependency bumps:** Go → **1.26.6**; `containerd/v2` → 2.3.4; `sigstore/cosign/v3` → 3.1.3; `sigstore/sigstore` → 1.10.9; `go-containerregistry` → 0.22.0; `helm/v4` → 4.2.4; `k8s.io` libs (apimachinery, api, client-go) → 0.37.0; `logrus` → 1.10.2; `docker/go-metrics` → 0.1.0; `sigstore/rekor` → 1.5.4 (CVE resolution); plus `x/mod` and `go-isatty`. ++++ helm: - update vendor.tar to fix * bsc#1277949, CVE-2026-37236 ++++ libnvidia-egl-gbm: - 0001-fix-parameter-validation.patch * Add missing validation for EGL_NATIVE_RENDERABLE to eglChooseConfig. Fixes dEQP-EGL.functional.negative_api.* ++++ libnvidia-egl-wayland: - 0004-egl-wayland-fix-fd-and-mapping-leaks-in-dmabuf-feedb.patch * egl-wayland: fix fd and mapping leaks in dmabuf feedback handlers: dmabuf_feedback_check_format_table() ignored the format-table fd without closing it, leaking one fd per EGL display initialization. dmabuf_feedback_format_table() overwrote the previous mapping when a compositor resends feedback, leaking the old table mapping. Unmap it before replacing. - 0005-egl-wayland-destroy-the-default-feedback-proxy-after.patch * egl-wayland: destroy the default feedback proxy after initialization: The default dmabuf feedback is bound on the display's internal event queue, which is never dispatched again once initialization completes. When a compositor resends feedback (e.g. mutter < 50 resends the format table on every scanout-candidacy change), each resent format_table event carries an fd that sits in the undispatched queue forever. Long-lived clients accumulate fds until they hit RLIMIT_NOFILE, at which point the kernel drops the next SCM_RIGHTS message, libwayland fails demarshalling with "file descriptor expected, object (N), message format_table(hu)" and the client dies with a fatal display error. Observed in the wild with kitty on GNOME 46 / NVIDIA 580: hundreds of leaked 4032-byte /memfd:mutter-shared fds and a crash roughly every 40 minutes under frequent feedback resends. The proxy's parsed data (format table and tranches) lives in defaultFeedback and remains valid; resent updates were never being processed anyway since the queue is not dispatched. Destroy the proxy once the initial burst has been handled. Per-surface feedback still tracks dynamic changes on the surface queues, which are dispatched at swap time. - 0006-egl-wayland-destroy-the-display-registry-after-initi.patch * egl-wayland: destroy the display registry after initialization: The registry is only used to discover globals during initialization, but it was kept alive for the display's lifetime while its events are delivered to a queue that is never dispatched again on the dmabuf path, so runtime global announcements (e.g. output hotplug) accumulate on that queue indefinitely. Destroy the registry once initialization completes, as suggested in review, to better match egl-wayland2, which keeps neither the registry nor the event queue after eglInitialize. The queue itself is retained here since wlDmaBuf and other long-lived proxies remain attached to it and the EGLStream path still performs swap-interval roundtrips on it. - 0007-egl-wayland-make-the-registry-a-local-variable.patch * The wl_registry no longer outlasts wlEglInitializeHook, so it does not need to be stored in WlEglDisplay. Destroy it on the failure path as well, since terminateDisplay() no longer does. - 0008-egl-wayland-unmap-the-format-table-with-the-proxy.patch * The default feedback's format table is only read while parsing tranche events, which can no longer arrive once the proxy is destroyed, so unmap it there instead of holding the mapping for the display's lifetime. Move the unmap into a helper so the resend and teardown paths share its guards. - 0009-egl-wayland-clear-the-feedback-prfixes - Refresh package-lock.json (six @earendil-works sibling integrity hashes filled in) and the vendored node_modules archive to match; the dependency set shrinks from 139 to 135 modules and the license union is unchanged - Declare the second verbatim copy embedded by "pi export" as Provides: bundled(marked) - Add pi-use-modular-runtime.patch: 0.84.3 also introduced dist/bundle, a pre-bundled copy of the same application, and pointed package.json's bin and the ./rpc-entry export at it. The bundle inlines its own detectInstallMethod(), which pi-disable-self-update.patch cannot reach, and its chunk names are content-hashed and change every release. Point both entry points back at the modular tree upstream still ships, so what the package declares, what /usr/bin/pi runs and what the self-update patch covers are the same code - Drop dist/bundle in %prep: nothing references it after the patch above, and it is 7.1 MB of duplicate runtime ++++ python-humanfriendly: - Use %python_fix_shebang_path instead of fiddling with sed. ++++ rsyslog: - fix RainerScript replace() heap buffer overflow (bsc#1275926) * add 0001-fix-RainerScript-replace-heap-buffer-overflow.patch ++++ ucode-intel: - Intel CPU Microcode was updated to the 20260812 release (bsc#1274785) - Removed MTL/06-aa-04/c0 due to functional issues observed when loading the MCU in some platforms. - Intel CPU Microcode was updated to the 20260811 release (bsc#1274785) - Security updates for INTEL-SA-01379 / CVE-2025-31936 - Security updates for INTEL-SA-01404 / CVE-2025-31938 - Security updates for INTEL-SA-01423 / CVE-2026-20917 - Security updates for INTEL-SA-01428 / CVE-2025-35973 - Security updates for INTEL-SA-01435 / CVE-2026-20716 - Security updates for INTEL-SA-01441 / CVE-2026-20760 - Security updates for INTEL-SA-01442 / CVE-2026-20713 / CVE-2026-20901 - Security updates for INTEL-SA-01443 / CVE-2026-20707 - Update for functional issues. ------------------------------------------------------------------ ------------------ 2026-8-23 - Aug 23 2026 ------------------- ------------------------------------------------------------------ ++++ aws-nitro-enclaves-cli: - Update to version 1.5.0 (bsc#1274300, CVE-2026-25541, bsc#1270202, CVE-2026-41676, bsc#1257933, CVE-2026-25727) ++++ flake-pilot: - Drop extra rootfs image checksum test The image is verified against the checksum record fetched from its origin. This Fixes #103 - Update appstore Also add checksum files for kis images - Refactor firecracker checksum validation So far the --kis-image pull method downloaded a tar file and only verified the checksum of the root filesystem image inside the tarball. However the tarball also contains initrd and kernel files and the kiwi kis build also provides an overall checksum file for the entire archive. This commit refactors the code such that the entire tar file is matched against its checksum. The appstore has been already updated to provide these checksum files along with the actual kis tar files. This Fixes #103 ++++ v2ray-core: - Update version to 5.53.0 * Add X-Forwarded-For support to gRPC transport * Add Stream based Packet Addr for UDP Connections * rrpit: compact session, async send, session recovery * Add socks5ify engineering command * Fix bugs * Update modules (boo#1276119 and CVE-2026-72817, CVE-2026-72815, CVE-2026-72816) - Drop update-net.patch ++++ grok-build: - Update to git snapshot 0+git20260819.19d42e3: * Add a persistent "Never allow" permission answer for MCP tools and web-fetch domains, default remember_tool_approvals to on and report granular prompt outcomes plus the remember-gate state * Block a session behind a consent notice until it is accepted, carry the notice in remote settings, record the answer locally and verify acceptances server-side against what was served * Restrict login to a single team with the new GROK_FORCE_LOGIN_TEAM_ID environment override * Adopt sibling auth tokens before taking the auth lock and bound startup-path token refreshes; the earlier authentication straddle hardening was reverted * Add automatic worktree garbage collection behind a fail-closed safety gate, clone straight into a projected worktree and stop dropping a sibling worktree registration when removing a worktree * Let sandbox sessions delete loops, remove a scheduled loop from the background-tasks tray and keep paused workflows visible * Interrupt identical tool-call loops earlier, in two tiers, and keep the ask-user tool out of subagents * Gate /goal verification on objective-named CI oracles and require in-repo tests for planner and verifier changes * Compact on a model family switch, add an optional model_family to the model catalog schema and cap parallel media-generation tool calls at eight images and four videos * Unblock queued messages and allow queue edits during goal mode, preserve agent message anchors and typed input provenance and add a typed input queue policy * Add a status line, re-run a command status line on a timer via refresh_interval, keep the page-flip prompt pin through scroll and render e-mail addresses as mailto links in the pager * Use browser-style shift-extended selection in the textarea, expand command output when unfolding a folded section and deflake the bash full-output double-click fold in the PTY pager * Load a single session summary for the /session-info title row instead of scanning every session, and drop the yanked prompt on a Ctrl+C rewind * Resolve session HEAD metadata from refs only, never from the object database * Fix still-streaming replies freezing when thinking interleaves, and TTS decode window span export under concurrent decode * Fix zero-data-retention storage errors in the video API and the matching Imagine messaging * Forward MCP protocol icons on MCP list responses, add the GROK_CONNECT_UI_TIMEOUT_SECS override for the startup connect budget and deny unwrap, expect and panic on session resource-release paths - Rebase 0002-disable-telemetry-by-default.patch onto the moved resolve_telemetry_mode context - Refresh the vendored Rust crate dependencies - Document in the spec why the licence tag carries GPL-2.0 WITH Linking-exception and LGPL-2.1-or-later: libgit2-sys statically links the bundled libgit2 C sources, whose deps/xdiff is LGPL-2.1-or-later, and refresh the audited crate counts ++++ orthanc-dicomweb: - version 1.24 * Allow searching DICOM resources by "Study ID" in the DICOMweb client Web user interface. * New configuration option "OtherBinaryMode" to control how OB, OD, OF, OL, OV, or OW value representations are encoded in WADO-RS responses. Possible values: "BulkDataURI" (new default), "InlineBinary", "ArrayOfValues". Previous releases used the "ArrayOfValues" mode, which was valid but could be problematic for large datasets. (contribution by Yusuf Sayita, Philips) * Clarified error message when trying to access a single frame from a video in WADO-RS. * Fixed rendering of multiframe RGB48 images. * Fix: If the metadata cache attachment is missing from disk for a series, it is now generated again. ++++ orthanc-postgresql: - version 10.3 * Wait until Orthanc has finalized its startup before executing the DB HOUSEKEEPING task to avoid "Plugin trying to call the database during its initialization" errors. ++++ tor: - Update to 0.4.9.11 * Major bugfixes + onion services: Prevent a race condition (boo#1275918, CVE-2026-77638) + client: no longer assert and exit if an onion service encodes an all-zero public key for one of its introduction points + directory authorities: Stop allowing 0 as a port in exit policy lines + security, conflux: Fix a use-after-free (and potential double free) (boo#1275919, CVE-2026-77587, TROVE-2026-026) - Update to 0.4.9.10 * Major bugfixes + conflux, security: Reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. (boo#1275920, CVE-2026-77584, TROVE-2026-025) + client: Resume warning about unsafe socks protocols when SafeSocks is not set. Also resume warning every time when TestSocks is set. + Make clients more consistently expire entry guards 48 to 60 days after they are first used. ------------------------------------------------------------------ ------------------ 2026-8-22 - Aug 22 2026 ------------------- ------------------------------------------------------------------ ++++ go1.27: - Add go1.27-use-Objdir-relative-paths-in-cgo-compile-action-IDs.patch to fix esbuild reproducible builds (boo#1234374) ++++ goose: - Update to version 1.47.0: * recipes: the documented minijinja filters work again, and recipe parameter values are validated before a run starts * the computercontroller extension no longer offers the automation_script, web_scrape and cache tools * ACP: authentication errors are reported by the goose acp server, large sessions no longer drop the connection, and the handoff context is retried after a failed prompt * providers: context-length-exceeded is recognised from byte-size request limits as well, one-shot fast-model calls no longer pay the prompt-cache write premium, and the Gemini OAuth provider is deprecated * extensions over streamable HTTP can use pre-registered OAuth clients, and OAuth token transport must now be secure * hardening: bounded XLSX range reads, local image reads, action-required stream admission and partial thinking tags; goose review no longer follows untracked symlinks * the bundled SQLite is 3.51.3 - Re-derive the License tag from the new vendored crate graph: the set of 13 SPDX identifiers is unchanged, but BSD-2-Clause is now carried only by the bundled leaflet.min.js because arrayref left the crate graph - Drop the pkgconfig(sqlite3) BuildRequires: sqlx requests libsqlite3-sys with the "bundled" feature, so SQLite is compiled from the crate-bundled amalgamation and the system library is never linked - Declare the C libraries that are statically compiled into the binary as bundled() provides, so their CVE surface is visible: aws-lc 5.5.0, libzstd 1.5.7, oniguruma 6.9.10 and sqlite3 3.51.3 ++++ goose: - Update to version 1.47.0: * recipes: the documented minijinja filters work again, and recipe parameter values are validated before a run starts * the computercontroller extension no longer offers the automation_script, web_scrape and cache tools * ACP: authentication errors are reported by the goose acp server, large sessions no longer drop the connection, and the handoff context is retried after a failed prompt * providers: context-length-exceeded is recognised from byte-size request limits as well, one-shot fast-model calls no longer pay the prompt-cache write premium, and the Gemini OAuth provider is deprecated * extensions over streamable HTTP can use pre-registered OAuth clients, and OAuth token transport must now be secure * hardening: bounded XLSX range reads, local image reads, action-required stream admission and partial thinking tags; goose review no longer follows untracked symlinks * the bundled SQLite is 3.51.3 - Re-derive the License tag from the new vendored crate graph: the set of 13 SPDX identifiers is unchanged, but BSD-2-Clause is now carried only by the bundled leaflet.min.js because arrayref left the crate graph - Drop the pkgconfig(sqlite3) BuildRequires: sqlx requests libsqlite3-sys with the "bundled" feature, so SQLite is compiled from the crate-bundled amalgamation and the system library is never linked - Declare the C libraries that are statically compiled into the binary as bundled() provides, so their CVE surface is visible: aws-lc 5.5.0, libzstd 1.5.7, oniguruma 6.9.10 and sqlite3 3.51.3 ++++ lxd: - update to 5.21.6 ( bsc#1274937, CVE-2026-63293, bsc#1274936, CVE-2026-62420, bsc#1274954, CVE-2026-63295, bsc#1274963, CVE-2026-63297, bsc#1274961, CVE-2026-63296, bsc#1275085, CVE-2026-63299, bsc#1275084, CVE-2026-63298, bsc#1275090, CVE-2026-66898): * https://canonical.com/lxd/docs/latest/reference/release- notes/5.21/release-notes-5.21.6/ * https://canonical.com/lxd/docs/latest/reference/release- notes/5.21/release-notes-5.21.5/ * https://discourse.ubuntu.com/t/lxd-5-21-4-lts-has-been- released/66602 * https://discourse.ubuntu.com/t/lxd-5-21-3-lts-has-been- released/53768 * https://discourse.ubuntu.com/t/lxd-5-21-2-has-been- released/46443 ------------------------------------------------------------------ ------------------ 2026-8-21 - Aug 21 2026 ------------------- ------------------------------------------------------------------ ++++ rust: - Update to version 1.98.0 - for details see the rust1.98 package ++++ rust1.98: - Update to rust1.98.0 - Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.98.0 ++++ chromium: - Chromium 151.0.7922.173 (boo#1275913): * CVE-2026-76017: Use after free in Chromoting * CVE-2026-76018: Privilege elevation in Import * CVE-2026-76019: Incorrect authorization in Workers * CVE-2026-76020: Race condition in V8 * CVE-2026-76021: Use after free in DOM. * CVE-2026-76022: Buffer overflow in Network * CVE-2026-76023: Improper resource control in Linux Toolkit Theming ++++ chromium: - Chromium 151.0.7922.173 (boo#1275913): * CVE-2026-76017: Use after free in Chromoting * CVE-2026-76018: Privilege elevation in Import * CVE-2026-76019: Incorrect authorization in Workers * CVE-2026-76020: Race condition in V8 * CVE-2026-76021: Use after free in DOM. * CVE-2026-76022: Buffer overflow in Network * CVE-2026-76023: Improper resource control in Linux Toolkit Theming ++++ chromium: - Chromium 151.0.7922.173 (boo#1275913): * CVE-2026-76017: Use after free in Chromoting * CVE-2026-76018: Privilege elevation in Import * CVE-2026-76019: Incorrect authorization in Workers * CVE-2026-76020: Race condition in V8 * CVE-2026-76021: Use after free in DOM. * CVE-2026-76022: Buffer overflow in Network * CVE-2026-76023: Improper resource control in Linux Toolkit Theming ++++ samba: - Build and install pycache files; (bsc#1274812) ++++ emacs: - Add patch 04_all_shorthands.patch and 03_all_ruby-flymake.patch * First patch fixes bsc#1275941 with VUL-0: emacs: code execution upon opening arbitrary file * Second patch makes ruby support work with ruby 3.4.5 - Add patch emacs-30.2-bsc1275927.patch to fix bsc#1275927 (CVE-2026-79992): VUL-0: emacs: zero-click local command execution via TRAMP ++++ hauler: - update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816): * Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport [#688]) * Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691) * fix for homebrew macOS binary quarantine (backport #690) * fix: process Helm deps before --add-images discovery (backport #703) * update hauler store remove to handle registry reference as part of string (backport #705) * fixed vuln for golang grpc ++++ hauler: - update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816): * Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport [#688]) * Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691) * fix for homebrew macOS binary quarantine (backport #690) * fix: process Helm deps before --add-images discovery (backport #703) * update hauler store remove to handle registry reference as part of string (backport #705) * fixed vuln for golang grpc ++++ helm: - bump vendor to address various security issues: * golang.org/x/mod@v0.40.0 * oras.land/oras-go/v2@v2.6.2 * google.golang.org/grpc@v1.82.1 (bsc#1276514) * go.opentelemetry.io/otel@v1.44.0 (bsc#1276644, CVE-2026-41178) ++++ libnsl1-stub: - Provide libnsl1-stub on s390x (jsc#PED-16397) * Add patch add-s390x-symbol-map.patch ++++ openai-codex: - Update to 0.149.0: * Interactive `codex agents` dashboard for searching, starting, opening, renaming and stopping tasks * `/cd`, `/pwd` and `/cwd` TUI commands for the working directory * `codex queue` sends a message to an existing local or remote session * Expanded Vim change motions (`cw`, `c$`, `cc`) and character replacement * `codex doctor` now diagnoses endpoint protection, network/proxy failures and update connectivity * Resumed and forked threads restore their permission profile * Linux sandbox drops extra capabilities and isolates IPC in bubblewrap * `apply_patch` no longer widens write permissions; git commands are no longer treated as inherently safe - Rebase codex-drop-v8-code-mode.patch and codex-no-startup-update-check.patch ++++ python-rpm-macros: - Update to version 20260821.08c5ec8: * Use the primary interpreter for generic python3 macros * Add python315 macros, remove python39 ++++ salt: - Fix test failures with pytest>=8 - Fix unit tests that fail due to async Tornado usage - Stabilize testsuite tests and fix AllEventsHandler - Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286) - Support attrlist in ldap.managed (bsc#1257151) - Fix the tests failing after switching to non-vendored tornado - Fix the default group in tests for new users in SLE 15.6 - Use AsyncHTTPClient in salt.utils.http (bsc#1268325) - Fix file fetching with cp module on non-vendored tornado - Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822) - Fix ImportError during reentrant SIGTERM shutdown - Fix broken "pkg.info_installed" after migration to salt.utils.timeutil - Fix deprecation warnings when running on Python 3.13 - Calculate UUID grain for Xen PV guests (bsc#1255418) - Add missing python-rpm-macros BR (#129) - Add 'show_changes' arg to 'file.append/file.prepend" states - Added: * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch * stabilize-testsuite-773.patch * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch * support-attrlist-in-ldap.managed-746.patch * fix-the-tests-failing-after-switching-to-non-vendore.patch * fix-the-default-group-in-tests-for-new-users-in-sle-.patch * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch * fix-file-fetching-with-non-vendored-tornado.patch * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch * fix-importerror-during-reentrant-sigterm-shutdown.patch * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch * fix-deprecation-warnings-when-running-on-python-3.13.patch * calculate-uuid-grain-for-xen-pv-guests-759.patch * add-show_changes-to-file.append-and-file.prepend-sta.patch ++++ salt-test: - Fix test failures with pytest>=8 - Fix unit tests that fail due to async Tornado usage - Stabilize testsuite tests and fix AllEventsHandler - Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286) - Support attrlist in ldap.managed (bsc#1257151) - Fix the tests failing after switching to non-vendored tornado - Fix the default group in tests for new users in SLE 15.6 - Use AsyncHTTPClient in salt.utils.http (bsc#1268325) - Fix file fetching with cp module on non-vendored tornado - Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822) - Fix ImportError during reentrant SIGTERM shutdown - Fix broken "pkg.info_installed" after migration to salt.utils.timeutil - Fix deprecation warnings when running on Python 3.13 - Calculate UUID grain for Xen PV guests (bsc#1255418) - Add missing python-rpm-macros BR (#129) - Add 'show_changes' arg to 'file.append/file.prepend" states - Added: * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch * stabilize-testsuite-773.patch * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch * support-attrlist-in-ldap.managed-746.patch * fix-the-tests-failing-after-switching-to-non-vendore.patch * fix-the-default-group-in-tests-for-new-users-in-sle-.patch * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch * fix-file-fetching-with-non-vendored-tornado.patch * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch * fix-importerror-during-reentrant-sigterm-shutdown.patch * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch * fix-deprecation-warnings-when-running-on-python-3.13.patch * calculate-uuid-grain-for-xen-pv-guests-759.patch * add-show_changes-to-file.append-and-file.prepend-sta.patch ++++ trivy: - Update to version 0.74.0: * release: v0.74.0 [main] (#11037) * chore(deps): update golang.org/x modules (#11094) * chore(deps): bump the docker group with 2 updates (#11090) * docs: update release branch ruleset instructions (#11093) * chore(deps): bump the common group across 1 directory with 7 updates (#11086) * fix(misconf): unmark cty values outside the evaluation context (#11078) * chore(deps): bump the aws group across 1 directory with 6 updates (#11053) * fix(misconf): parse Azure flexible server parameters under their own names (#11072) * chore(deps): bump the docker group with 2 updates (#11054) * feat: add RapidFort curated image scanner (#10452) * feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom ) (#10948) * refactor(misconf): remove unused Azure expression-related code (#10637) * fix(server): preserve check aliases and query in uploaded blobs (#11080) * fix(java): read artifact properties only from the MANIFEST.MF main section (#11066) * fix(terraform): support OpenTofu language block (#10923) * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063) * ci: trigger Auto Ready for Review after Test docs (#11045) * docs: remove trivy-checks from AWS ECR locations (#11044) * refactor(ubuntu): move EOL version resolution out of loop (#11047) * fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050) * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042) * chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038) * fix(terraform): avoid panic when for_each local has unknown object values (#11019) * chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028) * ci(spdx): migrate to Slack notifications (#11032) * ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034) ++++ trivy: - Update to version 0.74.0 (bsc#1278702, CVE-2026-50163, bsc#1278002, CVE-2026-37236, bsc#1278624, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662): * release: v0.74.0 [main] (#11037) * chore(deps): update golang.org/x modules (#11094) * chore(deps): bump the docker group with 2 updates (#11090) * docs: update release branch ruleset instructions (#11093) * chore(deps): bump the common group across 1 directory with 7 updates (#11086) * fix(misconf): unmark cty values outside the evaluation context (#11078) * chore(deps): bump the aws group across 1 directory with 6 updates (#11053) * fix(misconf): parse Azure flexible server parameters under their own names (#11072) * chore(deps): bump the docker group with 2 updates (#11054) * feat: add RapidFort curated image scanner (#10452) * feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom ) (#10948) * refactor(misconf): remove unused Azure expression-related code (#10637) * fix(server): preserve check aliases and query in uploaded blobs (#11080) * fix(java): read artifact properties only from the MANIFEST.MF main section (#11066) * fix(terraform): support OpenTofu language block (#10923) * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063) * ci: trigger Auto Ready for Review after Test docs (#11045) * docs: remove trivy-checks from AWS ECR locations (#11044) * refactor(ubuntu): move EOL version resolution out of loop (#11047) * fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050) * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042) * chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038) * fix(terraform): avoid panic when for_each local has unknown object values (#11019) * chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028) * ci(spdx): migrate to Slack notifications (#11032) * ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034) ------------------------------------------------------------------ ------------------ 2026-8-20 - Aug 20 2026 ------------------- ------------------------------------------------------------------ ++++ flake-pilot: - Bump version: 3.1.43 → 3.1.44 - Update rsync options Do not set extended attributes and acls as they failed to transfer into the storage backend used by podman - Bump version: 3.1.42 → 3.1.43 - Add --force option to remove command Add --force option to flake-ctl firecracker remove and fix the tab completion ++++ go1.25-openssl: - Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Refs jsc#SLE-18320 * Rebase to 1.25.14 ++++ go1.26-openssl: - Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips. Refs jsc#SLE-18320 * Rebase to 1.26.7 * Support strictfipsruntime with no_openssl * Fix multiple no_openssl build tag issues ++++ kubevirt1.8: - Package the persistent-reservation helper's entrypoint script: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place and then execs qemu-pr-helper. Only multipath.conf was installed, so the container could not start and persistent reservation was unavailable. The script is upstream in cmd/pr-helper/entrypoint.sh. ++++ lcms2: - Enable threads support (bsc#1247985) * Drop lcms2-visibility.patch as it was causing linker errors when enabling threads ++++ postgresql18: - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer. - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7. ++++ sssd: - Add systemd-tmpfiles configuration file to populate /var/lib/sss with the correct permissions on transactional servers; (bsc#1274748); ++++ udisks2: - Local Privilege Escalation in udisks2 via as-user Option Spoofing in Filesystem.Mount() (CVE-2026-7867, bsc#1274430) + add 0001-udiskslinuxfilesystem-Separate-real-caller-identity-.patch + add 0002-udiskslinuxfilesystem-Rework-fstab-mount-authorizati.patch ++++ openai-codex: - Update to 0.148.0: * TUI /export writes a conversation to Markdown (clipboard or file) * Fork sessions with `codex exec fork`; archive and restore sessions from the resume picker * Show estimated thread credits or cost in /status * Amazon Bedrock Runtime as a built-in model provider * Hooks can run commands asynchronously and invoke MCP tools * Sandbox path denials now fail closed * Resumed sessions restore the persisted working directory and approval policy - Rebase codex-drop-v8-code-mode.patch and codex-no-startup-update-check.patch ++++ postgresql14: - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer. - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7. ++++ postgresql15: - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer. - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7. ++++ postgresql16: - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer. - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7. ++++ postgresql17: - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer. - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7. ++++ postgresql18-mini: - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer. - Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7. ++++ selinux-policy: - Update to version 20250627+git392.40ceb80be: * Label the postgresql executables correctly (bsc#1274861) ++++ selinux-policy: - Update to version 20250627+git392.40ceb80be: * Label the postgresql executables correctly (bsc#1274861) ++++ spotify-easyrpm: - Update to 4.0.2 * Use curl for the snap download instead of wget, so the script needs one HTTP client rather than two. Raised in the review of 4.0.1 - Drop the wget requirement ++++ wicked: - Fix two OOB reads in ni_capture_inspect_udp_header and improve: [+ 0001-capture-fix-two-OOB-reads-in-ni_capture_inspect_udp.patch] - Reject packets with ip_len < ihl to avoid a size_t underflow of the UDP length, which the checksum truncates to uint16_t (bsc#1274627, CVE-2026-71401). - Set payload_len to the remaining payload, not ip_len, which over-read the DHCP option walker by ihl + 8 bytes past the buffer (bsc#1274627, CVE-2026-71402). - Avoid checksumming packets that fail the length/protocol checks and tidy up the debug messages (bsc#1274627). - Fix underflow check in ni_dhcp4_option_next to handle option code and length separately as the END and PAD options don't have length (bsc#1274627). Thanks to Daniel Birtwhistle for discovering and reporting the issues. ------------------------------------------------------------------ ------------------ 2026-8-19 - Aug 19 2026 ------------------- ------------------------------------------------------------------ ++++ apptainer: - Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106: The tar extraction routines in moby/go-archive do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination (bsc#1275248). ++++ apptainer: - Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106: The tar extraction routines in moby/go-archive do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination (bsc#1275248). ++++ bugwarden: - Update to 0.5.0: * Let the environment set allowed hosts and the auth header * Require a bearer token on the HTTP transport * Export audit records and diagnostics to an OTLP collector * Handle SIGTERM so container stop is graceful * Refuse unparsable allowed-hosts at startup * Normalize tool schemas for Gemini/Vertex clients, and recurse portable_schema into all draft-2020-12 positions - Vendored h2 bumped to 0.4.16 for RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h (h2 unbounded empty DATA frames lead to denial of service) - Raise the rust BuildRequires floor from 1.85 to 1.88 to match the workspace rust-version - Refresh License: drop CDLA-Permissive-2.0, the LGPL-2.1-or-later option, the Zlib option and the LLVM-exception option, none of which remain in the linked crate set - Ship the worked OpenTelemetry collector example as documentation ++++ chromium: - Chromium 151.0.7922.169 (boo#1275706): * CVE-2026-76034: Buffer overflow in WebGL * CVE-2026-76036: Buffer overflow in Dawn * CVE-2026-76033: Inappropriate implementation in CORS * CVE-2026-76037: Link following in CredentialProvider * CVE-2026-76044: Race condition in USB * CVE-2026-76039: Incorrect reference resolution in Core * CVE-2026-76040: Use after free in Browser * CVE-2026-76035: Inappropriate implementation in Media * CVE-2026-76042: Use of uninitialized resource in GPU * CVE-2026-76046: Buffer overflow in ANGLE * CVE-2026-76043: Incorrect calculation in V8 * CVE-2026-76041: Information leak in Skia * CVE-2026-76047: Type confusion in V8 * CVE-2026-76038: Type confusion in V8 * CVE-2026-76045: Use after free in WebGL ++++ chromium: - Chromium 151.0.7922.169 (boo#1275706): * CVE-2026-76034: Buffer overflow in WebGL * CVE-2026-76036: Buffer overflow in Dawn * CVE-2026-76033: Inappropriate implementation in CORS * CVE-2026-76037: Link following in CredentialProvider * CVE-2026-76044: Race condition in USB * CVE-2026-76039: Incorrect reference resolution in Core * CVE-2026-76040: Use after free in Browser * CVE-2026-76035: Inappropriate implementation in Media * CVE-2026-76042: Use of uninitialized resource in GPU * CVE-2026-76046: Buffer overflow in ANGLE * CVE-2026-76043: Incorrect calculation in V8 * CVE-2026-76041: Information leak in Skia * CVE-2026-76047: Type confusion in V8 * CVE-2026-76038: Type confusion in V8 * CVE-2026-76045: Use after free in WebGL ++++ chromium: - Chromium 151.0.7922.169 (boo#1275706): * CVE-2026-76034: Buffer overflow in WebGL * CVE-2026-76036: Buffer overflow in Dawn * CVE-2026-76033: Inappropriate implementation in CORS * CVE-2026-76037: Link following in CredentialProvider * CVE-2026-76044: Race condition in USB * CVE-2026-76039: Incorrect reference resolution in Core * CVE-2026-76040: Use after free in Browser * CVE-2026-76035: Inappropriate implementation in Media * CVE-2026-76042: Use of uninitialized resource in GPU * CVE-2026-76046: Buffer overflow in ANGLE * CVE-2026-76043: Incorrect calculation in V8 * CVE-2026-76041: Information leak in Skia * CVE-2026-76047: Type confusion in V8 * CVE-2026-76038: Type confusion in V8 * CVE-2026-76045: Use after free in WebGL ++++ chromium: - Chromium 151.0.7922.169 (boo#1275706): * CVE-2026-76034: Buffer overflow in WebGL * CVE-2026-76036: Buffer overflow in Dawn * CVE-2026-76033: Inappropriate implementation in CORS * CVE-2026-76037: Link following in CredentialProvider * CVE-2026-76044: Race condition in USB * CVE-2026-76039: Incorrect reference resolution in Core * CVE-2026-76040: Use after free in Browser * CVE-2026-76035: Inappropriate implementation in Media * CVE-2026-76042: Use of uninitialized resource in GPU * CVE-2026-76046: Buffer overflow in ANGLE * CVE-2026-76043: Incorrect calculation in V8 * CVE-2026-76041: Information leak in Skia * CVE-2026-76047: Type confusion in V8 * CVE-2026-76038: Type confusion in V8 * CVE-2026-76045: Use after free in WebGL ++++ transactional-update: - Add explicit build dependency to /usr/bin/python3 ++++ transactional-update: - Add explicit build dependency to /usr/bin/python3 ++++ flake-pilot: - Bump version: 3.1.41 → 3.1.42 - Fixed firecracker pilot garbage collector Only remove firecracker pilot related metadata files ending with .vmid - Update appstore - Bump version: 3.1.40 → 3.1.41 - Fix commandline quoting for sci call_str is now parsed with shell_words::split(), the same shell-style parser sci already uses for the run= kernel cmdline variable. The trailing token is popped as the exec port, the remainder is kept as exec_cmd. This Fixes #37 - Increas scope of rsync transfer Make sure extended attributes and ACLs gets transfered - Bump version: 3.1.39 → 3.1.40 - Add support for init command So far the user mode setup requires a user to read the information from the flake-pilot man page and to create the respective directories and files in the home directory himself. This commit adds a new command to allow to perform this task. This Fixes #96 - Fix spec file man page files listed twice - Bump version: 3.1.38 → 3.1.39 - Add show command for podman and firecracker pilots Allow to show details about running containers or firecracker process. This Fixes #97 - Add user mode support for firecracker Similar to the podman-pilot now also the firecracker-pilot now supports a user mode. In this mode images gets downloaded into the calling user's home directory and flake registrations are stored there too. - Update flake-pilot man page Update the instructions to setup for rootless podman/firecracker ++++ go1.25-openssl: - go1.25.14 (released 2026-08-19) includes fixes to the net/http package. Refs boo#1244485 go1.25 release tracking * go#80926 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff ++++ go1.26: - go1.26.7 (released 2026-08-19) includes fixes to the net/http package. Refs boo#1255111 go1.26 release tracking * go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff ++++ go1.26-openssl: - go1.26.7 (released 2026-08-19) includes fixes to the net/http package. Refs boo#1255111 go1.26 release tracking * go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff ++++ go1.27: - go1.27.0 (released 2026-08-19) is a major release of Go. go1.27.x minor releases will be provided through August 2027. https://github.com/golang/go/wiki/Go-Release-Cycle go1.27 arrives six months after Go 1.26. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. Refs boo#1272545 go1.27 release tracking * Language change: Go 1.27 now supports generic methods: a method declaration may declare its own type parameters. This widely anticipated change allows adding generic functions within the namespace of a particular data type where before one had to declare such functions with a scope of the entire package. * Language change: A key in a struct literal may now be any valid field selector for the struct type, not just a (top-level) field name of the struct. * Language change: Function type inference has been generalized to apply in all contexts where a generic function is assigned to a variable of (or converted to) a matching function type. * Tools: Response file (@file) parsing is now supported for the compile, link, asm, cgo, cover, and pack tools. The response file contains whitespace-separated arguments with support for single-quoted and double-quoted strings, escape sequences, and backslash-newline line continuation. The format is compatible with GCC’s response file implementation to ensure interoperability with existing build systems. * go command: The go command no longer has support for the bzr version control system. It will no longer be able to directly fetch modules hosted on bzr servers. * godebug: Starting with Go 1.27, the go command now recognizes a GODEBUG setting for which support was removed (such as asynctimerchan, see below) if it appears in go.mod files (godebug entries) and .go source files (//go:debug comments). It accepts these settings if they are set to the final default value established before the setting was removed. If they are set to an old value, the go command will fail. This change is in the spirit of the Go 1 compatibility guarantee and allows existing programs that set supported GODEBUG settings to continue to build and run without changes even when the respective setting support has been removed. * go test: go test now invokes the stdversion vet check by default. This reports the use of standard library symbols that are too new for the Go version in force in the referring file, as determined by go directive in go.mod and build tags on the file. * go test: go test -json now annotates "Action":"output" lines with an optional new field "OutputType", specifying the type of output. Currently, the possible values include “error”, “error-continue”, and “frame”. See cmd/test2json help for details. * go doc: The go doc command now supports package@version syntax, such as go doc example.com/pkg@v1.2.3. * go doc: The go doc command now accepts the -ex command-line option to list executable examples of the given package or symbol. When an example name is passed on the command line (such as go doc bytes.ExampleBuffer), go doc now prints the example source code along with comments. * go fix: The go fix command contains several new modernizers (atomictypes, embedlit, slicesbackward, and unsafefuncs). * go fix: The existing fmtappendf analyzer was removed due to stylistic concerns. * go fix: The existing waitgroup analyzer was renamed to waitgroupgo to avoid ambiguity. * go mod tidy: For modules specifying go 1.27 or later in their go.mod file, go mod tidy now automatically merges duplicate require blocks. This ensures the file maintains a clean, standard structure containing at most two require blocks: one for direct dependencies and one for indirect dependencies. * go mod fix: Existing comment blocks attached to dependencies are preserved during this consolidation. If a comment block is associated with a mixed set of directives (containing both direct and indirect dependencies), the comment block is merged and attached to the new direct dependency block. * go mod fix: Previously, if a go.mod file accumulated multiple disjoint require blocks (often due to manual edits, unresolved Git merge conflicts, or legacy upgrades) go mod tidy would leave the extra blocksefresh package-lock.json (six @earendil-works sibling integrity hashes filled in) and the vendored node_modules archive to match ++++ pi-coding-agent: - Update to 0.84.2: * Fullscreen transcript search with incremental match highlighting, configurable match colors and next/previous navigation * New defaultTools setting to choose the startup built-in tools globally or per project, and a fullscreen exit output setting (full transcript or only a resume hint) * New --use-theme option for a per-run interactive theme * Experimental strict JSON-schema constrained sampling for the default read/bash/edit/write tools under PI_EXPERIMENTAL=1 * Mistral SDK transport replaced by a native Chat Completions HTTP stream; the vendored dependency tree shrinks from 143 to 139 modules (mistralai, opentelemetry-semantic-conventions, zod and zod-to-json-schema gone), licence union unchanged * Assorted TUI startup, model selector and rendering fixes - Refresh package-lock.json (six @earendil-works sibling integrity hashes filled in) and the vendored node_modules archive to match ++++ python-pytest-html: - Revendor updating browserslist: (CVE-2026-73088, CVE-2026-73089, bsc#1275374, bsc#1275437) ++++ python-sqlparse: - CVE-2026-54284: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (bsc#1275459) * Add upstream patch CVE-2026-54284.patch (gh#andialbrecht/sqlparse@939b129e24c0) - CVE-2026-59893: nefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) (bsc#1275461) * Add ustream patch CVE-2026-59893.patch (gh#andialbrecht/sqlparse@d1d80602741f) - CVE-2026-59894: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (bsc#1275460) * Add upstream patch CVE-2026-59894.patch (gh#andialbrecht/sqlparse@53ff44b53e27) - CVE-2026-71491: quadratic O(n²) DoS in group_comments (bsc#1275466) * Add upstream patch CVE-2026-71491.patch (gh#andialbrecht/sqlparse@ef2012a5eeb4) ++++ python-sqlparse: - CVE-2026-54284: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (bsc#1275459) * Add upstream patch CVE-2026-54284.patch (gh#andialbrecht/sqlparse@939b129e24c0) - CVE-2026-59893: nefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) (bsc#1275461) * Add ustream patch CVE-2026-59893.patch (gh#andialbrecht/sqlparse@d1d80602741f) - CVE-2026-59894: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (bsc#1275460) * Add upstream patch CVE-2026-59894.patch (gh#andialbrecht/sqlparse@53ff44b53e27) - CVE-2026-71491: quadratic O(n²) DoS in group_comments (bsc#1275466) * Add upstream patch CVE-2026-71491.patch (gh#andialbrecht/sqlparse@ef2012a5eeb4) ++++ python-unearth: - CVE-2026-73030: `is_within_directory` function fails to normalize paths before validation and allows `../` sequences to bypass directory containment checks (bsc#1275440) * CVE-2026-73030.patch ------------------------------------------------------------------ ------------------ 2026-8-17 - Aug 17 2026 ------------------- ------------------------------------------------------------------ ++++ flake-pilot: - Add support for terminfo to firecracker pilot Add terminfo support to sci such that cursor keys and other VTE(8003) features work - Permission fix up during package update As a follow up to #84 and #95 we need to fix up the permissions and file locations when the RPM package is updated. We handle the permission and location change in the pre scriptlet to ensure changes are applied before the new binaries are installed. On update this also ensures that the setup is in place in case flake-ctl is called during update of another package. This should avoid any error conditions. Co-authored-by: Gemini - Update appstore Add leap basesystem for firecracker. Update to latest sci for all firecracker images - Bump version: 3.1.35 → 3.1.36 - Followup fix for garbage collect on metadata Check if filetype is a normal file, avoid working on socket files or other special file types - Set custom PROMPT in sci Use a standard prompt in the sci caller - Fixed metadata garbage collector Only check for deleting garbage if the file in question actually exists - Appstore update Update claude for firecracker. Add google SDK and several other useful tools - Set default log level for firecracker to debug Instead of trace set debug as default log level - Fix terminal emulation in firecracker sessions Make sure to place the caller terminal in raw mode such that tab completion can work. Additionally make sure to setup window size and terminal type correctly ++++ forgejo-cli: - Update vendored bytes crate to 1.12.1, fixing an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529, CVE-2026-25541, fixed upstream in bytes 1.11.1). Refreshed Cargo.lock/vendor.tar.zst together via the package's cargo_vendor service so both stay consistent; also refreshed several other lockfile pins the service had drifted from since the last update. ++++ gh: - Update to version 2.97.0, fixing four security issues (CVE-2026-64654, CVE-2026-64653, CVE-2026-64652, CVE-2026-64655): * CVE-2026-64654: terminal escape sequence injection in gist view, api, pr diff, release download --output -, codespace logs, skills preview and agent-task view/create * CVE-2026-64653: unescaped variable path components in request URLs could redirect gh to a different resource than intended * CVE-2026-64652: gh auth status could print part of the auth token in plaintext for token types with an underscore after the prefix * CVE-2026-64655: gh attestation verify built its --signer-repo/ - -signer-workflow matcher without escaping regex metacharacters, allowing a lookalike signer to pass verification * Add named field columns to gh project item-list and item-edit - Verified gh-CVE-2026-39821-idna-punycode.patch is still required: gh 2.97.0 still vendors golang.org/x/net v0.56.0 (the unicode16 gate is only removed unconditionally in x/net >= v0.57.0), and Factory's go package is still 1.26, whose unicode.Version stays 15.0.0 (the gate only flips true at go1.27). Keep the patch until either lands. ++++ gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below (bsc#1253576): * CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing request, fixed by the vendored x/crypto bump to 0.54.0 (fix floor is 0.43.0 per GO-2025-4116) - Drop Use-git-command-instead-of-go-git-1005.patch, superseded by the same fix landing upstream (already dropped in Factory) ++++ glab: - Add glab-CVE-2026-39821-idna-punycode.patch: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version (boo#1266614, CVE-2026-39821). Bumping the vendored x/net version alone does not fix this, as the upstream check is gated behind unicode.Version >= 16.0.0, which our Go toolchain does not yet report. - The remaining open VUL bugs against glab are already fixed by the currently vendored dependency versions (x/net 0.56.0, x/crypto 0.54.0, go-retryablehttp 0.7.8), all above each CVE's fixed version per the Go vulnerability database: boo#1235353, boo#1241815, boo#1251467, boo#1251685, boo#1265775, boo#1265832, boo#1266172, boo#1267155, boo#1227037. ++++ gstreamer-devtools: - Update the vendored packages to newer versions. Among them: * actix-files 0.6.10 . Fixes information exposure issue (bsc#1275209, CVE-2026-72814) and possible denial of service (bsc#1275210, CVE-2026-72813). * bytes 1.12.1 . Fixes integer overflow in BytesMut:reserve (bsc#1274306, CVE-2026-25541) * time 0.3.55 . Fixes a stack exhaustion denial of service (bsc#1257914, CVE-2026-25727) ++++ helmfile: - Update to version 1.7.4: * build(deps): bump github.com/sashabaranov/go-openai from 1.41.2 to 1.42.0 by @dependabot[bot] in #2735 * build(deps): bump gitpython from 3.1.57 to 3.1.58 in /docs by @dependabot[bot] in #2737 * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.106.3 to 1.106.4 by @dependabot[bot] in #2736 * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.106.4 to 1.107.0 by @dependabot[bot] in #2740 * build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.34 to 1.32.35 by @dependabot[bot] in #2739 * fix(#2741): prefetch shared remote charts instead of serializing sync by @toms-place in #2743 * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.0 to 1.107.1 by @dependabot[bot] in #2744 * build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.35 to 1.32.36 by @dependabot[bot] in #2745 * Bumping Helm versions to 3.21.4 and 4.2.4 by @yxxhero with @Copilot in #2746 * refactor: drop empty-render workaround now that chartify handles it natively by @yxxhero in #2747 ++++ htop: - Update to version 3.5.3: * Improve the htoprc settings parser to avoid segfaults on tampered configuration files (sanitised sort keys, validated configuration invariants, NULL safety for header columns and screens) * Add zswap pool usage meters * Fix out-of-bounds access when parsing the power supply type (Linux) * Mark a CPU offline when it is unplugged from the middle and release its data on hot-unplug (Linux) * Fix a Clang MemorySanitizer-reported issue * Exit follow mode when a search or filter is cancelled * Fix blank STARTTIME and wrong ELAPSED for threads (Darwin) * Use strchr instead of strstr in XUtils * Document the CPU meter segments in the man page and add an External Libraries section covering libnl-3/libnl-genl-3 - CVE-2024-37676: out-of-bounds access in Header_populateFromSettings reachable from a tampered htoprc; the settings parser hardening above is what upstream lists as covering it. openSUSE is assessed not affected (boo#1226729) ++++ leancrypto: - Add to the devel subpackage leancrypto-devel also a requires on libleancrypto-fips. (bsc#1273211) ++++ leancrypto-kmp: - Add to the devel subpackage leancrypto-devel also a requires on libleancrypto-fips. (bsc#1273211) ++++ openssl-3: - Security fixes in August 2026 release: (bsc#1274774) * CVE-2026-14456: Unbounded Memory Growth in QUIC Server Incoming Channel Queue (bsc#1274791) * CVE-2026-14457: RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (bsc#1274792) * CVE-2026-18798: QUIC Server May Trigger Double Free When Processing INITIAL Packet (bsc#1274777) * CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343) * CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795) * CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping (bsc#1274788) * CVE-2026-63073: Untrusted Sender DN Used as Format String in CMP Response Validation (bsc#1274796) * CVE-2026-63074: CMP Indefinite Cache Growth of ExtraCerts (bsc#1274797) * CVE-2026-63075: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion (bsc#1274798) * CVE-2026-63076: Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (bsc#1274790) * Add patches: openssl-CVE-2026-14456.patch openssl-CVE-2026-14457.patch openssl-CVE-2026-18798.patch openssl-CVE-2026-34181.patch openssl-CVE-2026-54874.patch openssl-CVE-2026-63072.patch openssl-CVE-2026-63073.patch openssl-CVE-2026-63074.patch openssl-CVE-2026-63075.patch openssl-CVE-2026-63076.patch ++++ libvirt: - CVE-2026-63622: util: virFileChownFiles: do not follow symlinks bsc#1275264 - CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert bsc#1275265 - CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file bsc#1274946 ++++ lyx: - Update to 2.5.2: * Most important are security fixes, among which: + New consent authorization gate for unpatched external tools processing gate prompts before running a code-capable bib/index tools (biber/xindy/xindex) on an untrusted document, The real fixes are upstream (biber 2.22, xindex 1.07, xindy from up-to-date TL tree), while the gate is LyX's interim guard. For biber 2.22 the gate automatically relaxes to no-op. xindex version check relaxing the gate above. * Details about this and other fixes can be found in the included ANNOUNCE or https://www.lyx.org/announce/2_5_2.txt ++++ openQA: - Update to version 5.1786788019.aa348157: * refactor(ui): remove jQuery from core utility scripts * fix(layout): Avoid horizontal scrollbar on the whole page * chore(deps): Dependency cron 2026-08-14 * refactor: remove deprecated job templates table view * fix(storage): correct MD RAID0 setup and Agama schema validation * feat: Add experimental log view mode to test details * refactor(css): Use classes for preview containers ++++ redis: - Update to 8.10.1 Update urgency: SECURITY: There are security fixes in the release. - Security fixes - (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write - Out-of-bounds access in TopK heap cleanup path (MOD-15410) - Use-after-free in the TLS pending-data list when a command closes another pending connection - A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution - Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access - Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running - Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays - TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user - #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key ++++ redis-modules: - Update to 8.10.1 Update urgency: SECURITY: There are security fixes in the release. - Security fixes - (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write - Out-of-bounds access in TopK heap cleanup path (MOD-15410) - Use-after-free in the TLS pending-data list when a command closes another pending connection - A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution - Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access - Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running - Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays - TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user - #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key ++++ sequoia-sq: - Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only * LICENSE.txt confirms it * Correct Legal-Review-Notice usage ++++ spotify-easyrpm: - Update to 4.0.1 * Give the built spotify-client RPM a timestamped release, so rebuilding an unchanged Spotify version produces an installable package instead of colliding with the installed version-release * Verify the downloaded snap against the sha3-384 digest published by snapcraft.io, and query the API over https * Fail with an error when the snapcraft.io lookup fails, instead of reporting the installed version as up to date * Own the local repo as the invoking user at 755/644 rather than making it world writable, which combined with gpgcheck=0 let any local user stage a package for zypper to install as root * Exit the prompts on EOF instead of looping forever, and reject answers that are not understood * --clean-repo keeps the newest build instead of deleting every RPM, and clears out stale debuginfo / debugsource packages * Disable the debug package, so no empty debugsource RPMs reach the local repo and rpmbuild no longer warns * Show a progress bar while downloading, and extract the snap quietly * Validate the --set-channel argument * Do not force X11 in the desktop launcher. Spotify selects it by default again, and forcing it breaks startup on a session without Xwayland * Leave /usr/bin/spotify-easyrpm alone when a package owns it * Check dependencies on scheduled runs, where sudo cannot prompt * Drop the unmaintained Mageia support, the tool is openSUSE / SLE only * zypper ar: disable the package cache for the local repo @stanislav-brabec - Drop the obsolete update-desktop-files requirement - Require curl, wget and openssl, which the script calls at runtime ------------------------------------------------------------------ ------------------ 2026-8-16 - Aug 16 2026 ------------------- ------------------------------------------------------------------ ++++ clamav: - update to 1.5.4 ClamAV 1.5.4 is a patch release with the following fixes: * CVE-2026-20337, bsc#1274597: Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers. * CVE-2026-20345, bsc#1274600: Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. * CVE-2026-20339, bsc#1274599: Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. * CVE-2026-20338, bsc#1274598: Fixed ownership handling while merging ZIP catalogue records that could cause an invalid free while scanning a malformed archive. * CVE-2026-20346, bsc#1274601: Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string. * CVE-2026-20347, bsc#1274602: Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file. * CVE-2026-20348, bsc#1274603: Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents. * CVE-2025-8088: Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows. * Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses. * FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races. * Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment. * Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory. ++++ flake-pilot: - Allow to ignore volume setup Add new podman pilot option %ignore_missing_volume_path. When provisioning a container with a shared volume setup like --volume /host/path:/container/path or -v /host/path:/container/path, the default action is to stop with an error when the host path does not exist. This option allows to continue even if the host path is missing. This Fixes bsc#1274855 ++++ goose: - Update to version 1.46.0: * upstream moved the repository from block/goose to aaif-goose/goose * new /goal, /status and /model slash commands, and a "goose review" local code review command * hooks with PreToolUse denial, skills in the open plugins framework, per-message token and cost accounting, and shell output streamed while commands run - Build with --no-default-features and an explicit feature list, the portable build upstream documents in BUILDING_LINUX.md: the code-mode feature added in 1.24.0 pulls in a vendored v8 crate that downloads a prebuilt V8 at build time, which an offline build cannot do - Re-derive the License tag from the vendored crate graph: 13 SPDX identifiers instead of Apache-2.0 alone - Link the system libdbus instead of the copy bundled in libdbus-sys (goose-system-libdbus.patch) - Ship the upstream generated man pages, and install the fish completion as vendor_completions.d/goose.fish - Restrict the build to the tier 1 Rust architectures ++++ goose: - Update to version 1.46.0: * upstream moved the repository from block/goose to aaif-goose/goose * new /goal, /status and /model slash commands, and a "goose review" local code review command * hooks with PreToolUse denial, skills in the open plugins framework, per-message token and cost accounting, and shell output streamed while commands run - Build with --no-default-features and an explicit feature list, the portable build upstream documents in BUILDING_LINUX.md: the code-mode feature added in 1.24.0 pulls in a vendored v8 crate that downloads a prebuilt V8 at build time, which an offline build cannot do - Re-derive the License tag from the vendored crate graph: 13 SPDX identifiers instead of Apache-2.0 alone - Link the system libdbus instead of the copy bundled in libdbus-sys (goose-system-libdbus.patch) - Ship the upstream generated man pages, and install the fish completion as vendor_completions.d/goose.fish - Restrict the build to the tier 1 Rust architectures ++++ goose: - Update to version 1.46.0: * upstream moved the repository from block/goose to aaif-goose/goose * new /goal, /status and /model slash commands, and a "goose review" local code review command * hooks with PreToolUse denial, skills in the open plugins framework, per-message token and cost accounting, and shell output streamed while commands run - Build withe-id-non-fips-mode.patch: Add a notice to the module ID when it's in non-FIPS mode (bsc#1266263). ++++ texlive: - Add patch source-synctex-bsc1272432.dif for bsc#1272432 Fix CVE-2026-63729 with use-after-free in synctex_parser.c ++++ libssh: - Fix libssh ignores system wide crypto policies (bsc#1272547) * Add patch: libssh-cmake-Add-option-WITH_HERMETIC_USR.patch ++++ wget: - Fix segmentation fault in metalink4, bsc#1273449 * Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch ------------------------------------------------------------------ ------------------ 2026-8-11 - Aug 11 2026 ------------------- ------------------------------------------------------------------ ++++ rmt-server: - Version 3.1 * Set RMT version to 3.1 * Remove all errors and warnigs due to new Ruby and Ruby on Rails versions (bsc#1274715) ++++ dracut: - Update to version 059+suse.726.gde083b3a1: * fix(base): sanitize message written by die() to the emergency hook * feat(base): add escape function implementing printf %q - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency hook script in die() (bsc#1274432) ++++ dracut: - Update to version 059+suse.726.gde083b3a1: * fix(base): sanitize message written by die() to the emergency hook * feat(base): add escape function implementing printf %q - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency hook script in die() (bsc#1274432) ++++ fde-tools: - Update to 0.7.7 + Enforce standard locale when parsing external program outputs (bsc#1273502) ++++ govulncheck-vulndb: - Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2 * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66 * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7 * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5 * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77 * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4 * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5 * GO-2026-5970 CVE-2026-56852 ++++ govulncheck-vulndb: - Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2 * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66 * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7 * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5 * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77 * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4 * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5 * GO-2026-5970 CVE-2026-56852 ++++ resource-agents: - Update to version 4.18.0+git81.694408f0: * OCPBUGS-100303: podman-etcd: add test hooks for FNC race reproduction * OCPBUGS-100303: podman-etcd: resolve force_new_cluster race during simultaneous dual-start * mediationzone: new resource agent (#2191) * ibmmq: new resource agent for IBM MQ queue managers (#2192) * podman-etcd: scope sync to etcd filesystem only * spec: Remove EOL Fedora compatibility blocks from spec file * Route: restore unique="1" for destination and warn on "default" * Route: update destination parameter to non-unique * powervs-move-ip: introduce support for trusted profiles, refine handling of API return codes (bsc#1274582) - Remove use-python-311.patch. Use more flexible solution for handling the different python versions. ++++ mozilla-nss: - nss-fips-pct-pubkeys.patch: Fix two small memory leaks. - nss-fips-zeroization.patch: Fix bad free in the DH_NewKey() error path. - nss-3.118-ml-dsa-leancrypto.patch, nss-3.118-ml-dsa-tls.patch, nss-3.118-ml-dsa-unittests.patch, nss-3.123-fix-mldsa-import-regeneration.patch, nss-3.124-add-ml-kem-key-size-mech-info.patch, nss-3.124-ml-kem-alias-fix.patch, nss-3.124-ml-dsa-test-for-sign-verify-pkcs12.patch, nss-3.124-ml-dsa-tls-test.patch, nss-3.124-fix-pub-key-import-encapsulate.patch, nss-3.124-fips-key-import-fix.patch: Import ML-DSA implementation and related PQC fixes from upstream (bsc#1262698, bsc#1272772). - nss-fips-ml-post.patch: Add power-on self-tests (KATs) for ML-KEM and ML-DSA (bsc#1272773). - nss-fips-ml-kem-zeroization.patch: Add zeroization for ML-KEM, ported from upstream (bsc#1272774). - nss-fips-ml-dsa-zeroization.patch: Add zeroization for ML-DSA (bsc#1272774). - nss-ml-dsa-leancrypto-fixes.patch, nss-ml-dsa-test-fixes.patch: Add ML-DSA robustness and test fixes. ++++ openQA: - Update to version 5.1786454525.528632ee: * fix(SeleniumTest): Gracefully handle set_window_size fail on tiling WM * fix(job_group_overview): General improvements on #7729 * chore(deps): Dependency cron 2026-08-11 * feat: make privacy policy links configurable * feat(job_group_overview): Use