Packages changed: MicroOS-release (20261022 -> 20261023) apparmor brotli (1.2.0 -> 1.2.1) bubblewrap (0.12.0 -> 0.13.1) dracut (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef) ffado fwupd lame (3.100 -> 4.0) libapparmor libnotify (0.8.8 -> 0.8.9) libsndfile libtirpc (1.3.7 -> 1.3.8) makedumpfile python313 python313-core taglib (2.3 -> 2.3.2) ucode-intel (20260812 -> 20260925) util-linux util-linux-systemd vlc === Details === ==== MicroOS-release ==== Version update (20261022 -> 20261023) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== apparmor ==== - Pass the distribution build flags to the plain make builds of the parser and the binutils programs, so apparmor_parser, aa-exec, aa-load and aa-status are built with fortify and stack-protector hardening like the rest of the package - Drop the obsolete BuildRoot tag from both specs and use the pkgconfig spelling of the pkg-config BuildRequires ==== brotli ==== Version update (1.2.0 -> 1.2.1) Subpackages: libbrotlicommon1 libbrotlidec1 libbrotlienc1 - Update to release 1.2.1 * Fixed an out-of-bounds write write permitting remote code execution [CVE-2026-111497] ==== bubblewrap ==== Version update (0.12.0 -> 0.13.1) - update to 0.13.1: * bwrap now accepts multiple --sync-fd arguments and will handle all of the fds. * O_PATH is used when opening parent directories in the new root, fixing an error when read permission is missing. - update to 0.13.0: * Linux kernel headers with __NR_pivot_root (Linux 2.3.41+) are required at build-time on all architectures * If compiled with -Dassume_kernel=5.12.0 or newer, then a kernel with the mount_setattr syscall is required at runtime, and kernel headers with __NR_mount_setattr are required at build-time on most architectures. On the x86_64, i386 and aarch64 architectures, a fallback is provided to be able to compile with pre-5.12 kernel headers. * On kernels that support it (5.12+), use mount_setattr() to remount filesystems with ro, nodev and/or nosuid. * Arguments that expect a path argument (--bind, --overlay-src, etc.) now reject empty strings. Previously they would sometimes be treated as the root directory due to implementation details, but this was unintended. * A new build option -Ddebug_logging=true can be used to enable verbose debug logging (not recommended for distro builds). These debug messages don't appear unless environment variable DEBUG_INVOCATION is set at runtime. * Fix build failures with older gcc or older -std argument * Fix build failure with musl * Fix test failure on systems that lack hostname(1) * Fix test failure on systems with a mount point containing a backslash * Fix test failure on systems with older xdg-desktop-portal * Don't leave a temporary file behind after running the test suite * CI improvements ==== dracut ==== Version update (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef) Subpackages: dracut-ima - Update to version 112+suse.62.g1b64cef: * fix(bluetooth): always install HID drivers that can be needed * fix(bluetooth): mark installed hostonly files * fix(nvmf): prevent nvmf's installkernel failure when no nbft present * test(DRACUT-CPIO): fix unbound CPIO_TESTDIR variable * test(STORAGE): fix condition to add disk2 ==== ffado ==== - libffado-date_time.patch: avoid mismatched format string types and args ==== fwupd ==== Subpackages: libfwupd3 typelib-1_0-Fwupd-2_0 - rename Polkit rules to give it a 10- prefix, allowing them to gain priority over the SUSE-specific rules generated in /etc/polkit-1/rules.d/90-default-privs.rules (bsc#1279948). ==== lame ==== Version update (3.100 -> 4.0) - Update to version 4.0 (libmp3lame soname unchanged, still .so.0): * Major version bump: the 9-byte encoder version field in MP3s overflowed with 3.100 minor versions; 4.0 resets the scheme. * Security fixes: AIFF header parser integer-underflow DoS (CVSS 5.5, frontend); Blade DLL beInitStream stack overflow (Windows-only, CVSS 8.4). * Fix build with recent GCC/Clang (UTF-8 ID3 tag functions); export id3tag_set_textinfo/comment_utf8 from shared lib. * Add ID3v2.4 support and upstream pkg-config support. * mp3rtp gains IPv6 support (incompatible CLI change). - Use upstream lame.pc; keep libmp3lame.pc alias. - Use pkgconfig(ncurses); drop obsolete Group tags. - Add pkgconfig(libmpg123) BuildRequires: 4.0's --enable-decoder mandates external mpg123 (configure errors out without it). - Add lame-4.0-frontend-utf8.patch (backport of upstream post-4.0 fix): split the mistyped ID3v2 tag handler into typed UTF-16/UTF-8 variants and add id3tag_set_fieldvalue_utf8(); export hip_set_pinfo and hip_finish_pinfo for the frontend; unbreaks the build with GCC 14+ defaults. ==== libapparmor ==== - Pass the distribution build flags to the plain make builds of the parser and the binutils programs, so apparmor_parser, aa-exec, aa-load and aa-status are built with fortify and stack-protector hardening like the rest of the package - Drop the obsolete BuildRoot tag from both specs and use the pkgconfig spelling of the pkg-config BuildRequires ==== libnotify ==== Version update (0.8.8 -> 0.8.9) Subpackages: libnotify4 typelib-1_0-Notify-0_7 - Update to version 0.8.9: * This is a maintenance release, mostly with bug fixes around notify-send behaviors and portal notifications, together with more tests coverage for hints edge cases, and some library cleanups: + Notify-send: - Start action ID from 1 as docs states - Fix the activation token FD validity check - Don't write the notification ID and action to stdin - Don't cache the hint conversion error + Notify: Free the application name and icon on uninit + Notification: - Do not send the default action as a button in portal notifications - Read the icon contents using g_file_load_contents() - Use g_clear_handle_id() for the portal timeout + Tests/notify-send: - Add tests for the default action button - Verify behavior on invalid hints + Launch-context: Don't omit parameter names in vfunc implementation + Bugs fixed: - portal: "default" action adds additional button - Omitted parameter names in a vfunc implementation ==== libsndfile ==== - Fix integer overflow vulnerability in mat4_read_header() (bsc#1282671, CVE-2026-88372): libsndfile-CVE-2026-88372.patch ==== libtirpc ==== Version update (1.3.7 -> 1.3.8) Subpackages: libtirpc-netconfig libtirpc3 - Update to version 1.3.8 (bsc#1285882, CVE-2026-85977, bsc#1285881, CVE-2026-85231): * Security hardening against malicious-data memory exhaustion: cap decoded pmap/rpcb XDR list lengths to 1024 nodes (CVE-2026-85977) and RPCSEC_GSS wrapped payload decoding at 16 MB (CVE-2026-85231, authenticated remote DoS). * Fix off-by-one allocation when building the GSS caller name. * Export authdes_getucred and rpc_gss_getcred under a versioned symbol node (backward compatible, soname stays libtirpc.so.3). - Spec cleanup: drop obsolete Group tags. ==== makedumpfile ==== - support kernel 7.1 -- add: * makedumpfile-Fix-wrong-exclusion-of-compound-tail-pages-on-.patch ==== python313 ==== - Require libexpat1 >= 2.8.5 for python313-base and raise the Expat build requirement accordingly. pyexpat uses XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the automatic SONAME dependency permits older libraries, breaking imports and venv/ensurepip (bsc#1285433). ==== python313-core ==== Subpackages: libpython3_13-1_0 python313-base - Require libexpat1 >= 2.8.5 for python313-base and raise the Expat build requirement accordingly. pyexpat uses XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the automatic SONAME dependency permits older libraries, breaking imports and venv/ensurepip (bsc#1285433). ==== taglib ==== Version update (2.3 -> 2.3.2) - Add fix-32bit-overflow.patch * Fix 32-bit overflows and i586 test suite - Update to version 2.3.2 (soname unchanged, libtag.so.2): * 2.3.1: Matroska crash and element-length fixes, MP4 cnID 64-bit/chapter fixes, QT stsc allocation guard, XM save fix. * 2.3.2: MP3 unsync/iTunes ID3 fixes, MP4 covr tolerance and new codecs, Ogg muxed Vorbis comments, ASF property improvements, RF64/BW64 support, Matroska scan/attachment fixes, crafted-input hardening (DoS/resource exhaustion). * Build: use Requires.private for zlib. - Modernize spec (pkgconfig zlib, drop Group tags). ==== ucode-intel ==== Version update (20260812 -> 20260925) - Update to version 20260925: * Meteor Lake (MTL) C0 stepping microcode 0x28 -> 0x2b (functional update) ==== util-linux ==== Subpackages: libblkid1 libfdisk1 libmount1 libsmartcols1 libuuid1 - Wrap the lastlog2 and liblastlog2-2 package descriptions within the line length limit - Ship /var/lib/lastlog in the lastlog2 package; the directory is created by the tmpfiles entry but was missing from the file list - Drop the no-op %tmpfiles_create calls from the lastlog2 and uuidd scriptlets; both packages ship their tmpfiles.d entries, which the systemd file trigger processes at install time - Use the find -regextype name posix-extended instead of its posix-egrep alias in %install - List the header directories excluded from the systemd package explicitly instead of globbing the shared include directory ==== util-linux-systemd ==== Subpackages: lastlog2 liblastlog2-2 - Wrap the lastlog2 and liblastlog2-2 package descriptions within the line length limit - Ship /var/lib/lastlog in the lastlog2 package; the directory is created by the tmpfiles entry but was missing from the file list - Drop the no-op %tmpfiles_create calls from the lastlog2 and uuidd scriptlets; both packages ship their tmpfiles.d entries, which the systemd file trigger processes at install time - Use the find -regextype name posix-extended instead of its posix-egrep alias in %install - List the header directories excluded from the systemd package explicitly instead of globbing the shared include directory ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-noX vlc-plugins-desktop - Update version dependencies according to configure.ac. - Migrate to xz compression and manual service run - Use legacy '#' instead of '%dnl' to comment: VLC is still being built for CODE15 branches outside of OBS, where %dnl is not supported.