Packages changed: apache2-mod_php8 (8.5.11 -> 8.5.12) ca-certificates-mozilla (2.90 -> 2.92) ffmpegthumbnailer (2.2.3 -> 2.3.1) kf6-baloo libmad (0.16.4 -> 0.16.5) lvm2 (2.03.38 -> 2.03.43) lvm2-device-mapper (2.03.38_1.02.212 -> 2.03.43_1.02.217) mozc (3.33.6133.102 -> 3.34.6239) myrlyn (1.0.0 -> 1.1.0) openSUSE-release (20261020 -> 20261021) patterns-xfce perl-Cpanel-JSON-XS (4.520.0 -> 4.800.0) php8 (8.5.11 -> 8.5.12) spice sqlite3 (3.53.2 -> 3.54.1) === Details === ==== apache2-mod_php8 ==== Version update (8.5.11 -> 8.5.12) - version update to 8.5.12 [bsc#1286027] CVE-2026-109618: memory corruption leading to RCE CVE-2026-109619: memory corruption leading to RCE - modified patches * php-build-reproducible-phar.patch (refreshed) ==== ca-certificates-mozilla ==== Version update (2.90 -> 2.92) - Updated to 2.92 state (bsc#1286261) - Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1 ==== ffmpegthumbnailer ==== Version update (2.2.3 -> 2.3.1) Subpackages: libffmpegthumbnailer4 - Update to version 2.3.1: * Add audio file thumbnails (new ENABLE_AUDIO_THUMBNAILER option) * Add additional Matroska MIME types * Build against newest ffmpeg, require C++14 * Fix mingw and static builds - Drop ffmpegthumbnailer-update-for-newest-ffmpeg.patch: fixed upstream (PR#240) ==== kf6-baloo ==== Subpackages: kf6-baloo-file kf6-baloo-imports kf6-baloo-kioslaves kf6-baloo-tools libKF6Baloo6 libKF6Baloo6-lang libKF6BalooEngine6 - Add patch to fix occasional crashes on login: * 0001-service-do-not-start-too-early.patch ==== libmad ==== Version update (0.16.4 -> 0.16.5) - Update to version 0.16.5: * New: + Add mad_version_get_string() as an ABI-stable alternative for getting the version string. + Add -DPAD_VERSION_STRING (disabled by default) to pad the global version string for improved ABI compatibility with 0.15.1b. + Miscellaneous stuff: - Add CONTRIBUTING.md and BUILDING.md for contribution guidelines and how to build the library, respectively. - Fix typos in README. * Changed: + Deprecated global version and build type strings. The latter is deprecated with no replacement, while mad_version_get_string() should be used in place of the former. + CMake 3.10+ is now required. This allows for supporting CMake 4.0+ without warnings. + Disabled architecture-specific optimizations for 32-bit ARM for now. These optimizations have unfortunately bitrotted and can cause a segfault. + Reorganize the source tree to be cleaner. + Remove nonexistent -DMADD{16}_ASM options from build documentation. These options have been long gone and haven't worked since we dropped GCC 4.4 support. + Static and shared library versions of libmad are now built at the same time by default. You can also build only a static version with - DBUILD_SHARED_LIBS=OFF. * Fixed: + Fixed anonymous struct for C++ compatibility. + Fix some clang-tidy warnings. + Fix a Clang warning. + minimad: Fix format under 32-bit. + Fixed missing MAD_DEPRECATED declarations for MSVC. + Fixed x86 CPU detection. + Fixed build on ARM v7. - Drop libmad-x86.patch: Applied upstream. - Add 9dd96b40c5caf76fd1c6ef9dcc80ba330eb57a79.patch: Really fix build on arm - Delete the now build static lib. ==== lvm2 ==== Version update (2.03.38 -> 2.03.43) Subpackages: liblvm2cmd2_03 - Update to version 2.03.43: * Wipe stale signatures before formatting a VDO data LV on thin storage; allow 4K stripe size smaller than page size. * dmeventd fixes: raid repair after partial replacement, snapshot extension backoff, snapshot threshold and unmount handling. * pvmove in shared VGs with lvmlockd, cluster lock lifecycle for the pvmove LV, lock probes for holder availability. * lvmpersist hardening: reject non-block devices, validate options, require PR tools, clean up keys on interruption. * Add lvmconfig --edit to set or remove an lvm.conf setting and backup/file-limit handling for config edits. * Remove cmirrord and clustered mirror log daemon support; drop the legacy vgimportclone.sh script. * Increase the default value of global/lvmlockd_lock_retries from 3 to 6. * Respect /run/mdadm/creating- in 69-dm-lvm.rules. * Many dmeventd, lvmlockd, vgmerge/vgcreate/vgimportclone lock-leak and raid/pvmove polling fixes. - Sync lvm.conf with upstream 2.03.43 defaults (adds allocation/vdo_use_kernel_format and backup/config_file_backup_limit options). - Package the new dmvdostats symlink and man page in device-mapper. - Drop patches adopted upstream or obsolete: * cmirrord_remove_date_time_from_compilation.patch (cmirrord removed upstream) * bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch (upstream uses /usr/bin/mountpoint now) - Rebase bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch onto the reworked MD section, keeping the new creating-guard. - Rework bug-1184124-link-tests-as-PIE.patch to pass -pie in the two generic test link recipes, and bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch to its configure hunk (the Makefile.in part is upstream now). - Sonames unchanged (libdevmapper.so.1.03, liblvm2cmd.so.2.03); device-mapper package version moves to 2.03.43_1.02.217. - Spec cleanup: drop Group tags, https sources, pkgconfig deps. ==== lvm2-device-mapper ==== Version update (2.03.38_1.02.212 -> 2.03.43_1.02.217) Subpackages: device-mapper libdevmapper-event1_03 libdevmapper1_03 - Update to version 2.03.43: * Wipe stale signatures before formatting a VDO data LV on thin storage; allow 4K stripe size smaller than page size. * dmeventd fixes: raid repair after partial replacement, snapshot extension backoff, snapshot threshold and unmount handling. * pvmove in shared VGs with lvmlockd, cluster lock lifecycle for the pvmove LV, lock probes for holder availability. * lvmpersist hardening: reject non-block devices, validate options, require PR tools, clean up keys on interruption. * Add lvmconfig --edit to set or remove an lvm.conf setting and backup/file-limit handling for config edits. * Remove cmirrord and clustered mirror log daemon support; drop the legacy vgimportclone.sh script. * Increase the default value of global/lvmlockd_lock_retries from 3 to 6. * Respect /run/mdadm/creating- in 69-dm-lvm.rules. * Many dmeventd, lvmlockd, vgmerge/vgcreate/vgimportclone lock-leak and raid/pvmove polling fixes. - Sync lvm.conf with upstream 2.03.43 defaults (adds allocation/vdo_use_kernel_format and backup/config_file_backup_limit options). - Package the new dmvdostats symlink and man page in device-mapper. - Drop patches adopted upstream or obsolete: * cmirrord_remove_date_time_from_compilation.patch (cmirrord removed upstream) * bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch (upstream uses /usr/bin/mountpoint now) - Rebase bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch onto the reworked MD section, keeping the new creating-guard. - Rework bug-1184124-link-tests-as-PIE.patch to pass -pie in the two generic test link recipes, and bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch to its configure hunk (the Makefile.in part is upstream now). - Sonames unchanged (libdevmapper.so.1.03, liblvm2cmd.so.2.03); device-mapper package version moves to 2.03.43_1.02.217. - Spec cleanup: drop Group tags, https sources, pkgconfig deps. ==== mozc ==== Version update (3.33.6133.102 -> 3.34.6239) Subpackages: ibus-mozc ibus-mozc-candidate-window mozc-gui-tools - Update to version 3.34.6239: * Updated OSS dictionary and zip code data as of 2026-04-03 * Added the circled zero to number conversion candidates * Enabled partial matches in user history prediction and improved prediction performance * Sanitize user dictionary entries and IBus config strings * IBus engines moved to ibus_config.textproto, engine XML is no longer generated (ibus-provide-layout-variations.patch rebased to the new file to keep the JP/US/Dvorak layout variants) * Refreshed use-system-python.patch for the new MODULE.bazel * Adapt the fcitx modules to mozc-3.34 (base:singleton is gone; backported from fcitx/mozc): fcitx-mozc-3.34-compat.patch - Regenerated dependencies.tar and bcr.tar.xz for the new Bazel module pins (abseil-cpp 20260107.1, protobuf 34.1, rules_python 1.9.0, rules_go/gazelle/rules_android and others) - Shut the Bazel server down without the project .bazelrc: its common:linux_env chain pulls in the build-only compiler_gcc_like config, failing an otherwise successful build at the last step - Drop Group and BuildRoot tags; spec-cleaner pass (macro-ified install paths) - Fix build with Qt 6.12 uic, which rejects the leading "::" in the dictionary_tool custom widget class name (upstream commit 29c082a): qt-6.12-uic-class-name.patch ==== myrlyn ==== Version update (1.0.0 -> 1.1.0) - Update to version 1.1.0: * Updated screenshots * Version bump to 1.1.0 * Fixed OBS home project URLs * Updated screenshot * No red versions in versions details view * Color-coding in versions details view * Unified text color handling * Unify special fonts handling * Moved dark theme detection from YQIconPool to MyrlynApp * Use the new icon name in icons.qrc (Closes #156) * No crazy all-caps spelling for vendors * Fixed missing pkg versions view update for "dup" and "up" * Versions details view: Use a grid (table) instead of prose text * White, not yellow foreground color in dark theme (Closes #154) * Fixed icon name (Closes #152) * Updated screenshots * Larger pattern icons (22x22 instead of 16x16) * Updated screenshots with well-defined list icon size * Updated screenshots with well-defined list icon size * Force icon size for list items (#145) * Pre-release version bump to 1.0.99 * Icon size fine tuning * Updated screenshots * Updated screenshots * Markdown layout * Markdown layout * Markdown layout * New screenshots * Keep the emojis * Keep the emojis * Obsolete icons * Removed old YaST icons * Imported new icons by @byDMA * Use official API to detect dark theme if available * Detect Xfce theme if running on Xfce * More debug logging * Consistent naming * Removed obsolete icons * Fix download icons for certain themes (#145) * Removed unused (since 20+ years!) icon * Use dedicated icons for dark widget themes * More contrast for download done icon for dark themes * Yellow faces for sad/sick emoji for dark themes * Silence Qt SVG renderer * Added the new icons to YQIconPool * YQIconPool migration from QPixmap to QIcon * Load dark theme built-in icons if available * Added icons for dark widget themes * Updated screenshots with new logo * Updated logo on project home page * Added new contributors * Revamped Myrlyn logo by @Arthurium-On-Linux and @byDMA * New Myrlyn logo (Fixes #138) * Auto-detect dark or light widget theme * Dropped obsolete icons * Dropped obsolete icons * Fixed icon name in .ui preview * More neatly aligned buttons in repo filter view * First "Protect All" / "Un-Protect All" buttons in repo filter view * Added secondary filters "Installed", "Not Installed" * Renamed "Installation Summary" secondary filter to "Status" * Typo * Make sure the required gettext tools are installed * Translations: No msgctx, merge duplicate msgids * Don't translate an empty msgid with gettext auto-generated gibberish * Add reboot notification if /run/reboot-needed exists * Set app icon in window title (Closes #140) * Exit if X11 connection lost regardless of Qt log level * Prevent endless loop if X server crashed / terminated * Highlight package version changes * Removed 15.6 OBS targets that may or may not work * New home project 'home:/huha:' * Reset patterns after commit (Closes #130); thanks to @bjornmp * Keep current pattern and scroll position when switching back to patterns view * Typos * Removed unneeded .png extension for icon in .desktop files (Closes #129) * Fixed typo (thanks to @sakves) * Skip additional warning for dist-upgraded / pkg-updated packages * Safeguard against idiotic behavior (issue #128) * Typo * Log date extension only when appropriate * Reduce log verbosity * Handle cut-off zypp history files correctly * Replaced outdated project header * Use /run/user/0, not /run/user/1000 in myrlyn-sudo * Make usage of theme icons configurable * Simplified myrlyn-sudo a little bit * Use the user theme in myrlyn-sudo (inspired by @cbravo) * Clarify official vs. private project status * Coding style * Fixed screenshot target URLs * Added new screenshots to home page * Updated screenshots ==== openSUSE-release ==== Version update (20261020 -> 20261021) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== patterns-xfce ==== Subpackages: patterns-xfce-xfce patterns-xfce-xfce_basis patterns-xfce-xfce_extra patterns-xfce-xfce_laptop - Stop pulling YaST into default Tumbleweed installations: drop the Recommends on yast2-control-center-qt from the xfce_basis pattern. Drop YaST from the pattern recommendations. The YaST patterns and packages stay in the repository for anyone who has them or wants them; new installations simply come without YaST. ==== perl-Cpanel-JSON-XS ==== Version update (4.520.0 -> 4.800.0) - updated to 4.800.0 (4.80) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes 4.80 2026-09-?? (rurban) - Security fixes, reported by Stig Palmquist (CPANSec): * CVE-2026-110672 decode: free the hash key on "Duplicate keys not allowed" and on a missing ':' (leak). bsc#1286166 * CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth (stack overflow). bsc#1286167 * CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168 * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted keys (malformed keys). bsc#1286169 * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with huge exponents (30MB from 12 bytes). bsc#1286170 * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts (leaked every array). bsc#1286173 * CVE-2026-110678 incr_parse: apply max_size to the buffered text in every context. bsc#1286174 * CVE-2026-110680 encode: bound the canonical key snapshot for growing tied or shared hashes (overflow). bsc#1286175 * CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone instead of sharing the parent's pointers. bsc#1286176 * CVE-2026-110682 incr_parse: reject a top-level number, true, false or null unless allow_nonref was set explicitly, as chunking changes their value. Strings, arrays and objects are unchanged. bsc#1286177 * CVE-2026-110684 encode: release the temporary references when stringifying overloaded objects (leak). bsc#1286179 * CVE-2026-110685 decode_tag: free the tag and its arguments when THAW dies (leak). bsc#1286180 * CVE-2026-110686 decode: keep the filter callbacks alive while they run (use-after-free when a filter removes itself). bsc#1286181 * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182 * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the decoded text (quadratic CPU). bsc#1286183 - Add version markers to all module files. (PR #260 demerphq) - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq) - Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as "just a hash of keys and types", as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity. - json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with "no type was specified for hash key '...'" for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/bench_large.pl: old encode: 20.5–22.9/s decode: 16.2–16.5/s for 4.53 new encode: 21.1–22.5/s decode: 15.7–16.3/s for 4.80 4.53 2026-09-28 (rurban) - Fix C90 violations with arm neon (GH #258 rjbs) - Added a native arm64 test runner. ==== php8 ==== Version update (8.5.11 -> 8.5.12) Subpackages: php8-ctype php8-dom php8-iconv php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter - version update to 8.5.12 [bsc#1286027] CVE-2026-109618: memory corruption leading to RCE CVE-2026-109619: memory corruption leading to RCE - modified patches * php-build-reproducible-phar.patch (refreshed) ==== spice ==== - bsc#1285876 - VUL-0: CVE-2026-105958: spice: heap corruption due to insufficient bounds validation of client-supplied offsets in multiple migration data handlers 000-smartcard-fix-NULL-dereference-of-scc-in-on_message_from_device.patch 001-CVE-2026-105958-migration-dont-abort-on-invalid-migration-data.patch 002-CVE-2026-105958-reds-fix-wrong-struct-size-in-agent-migration-data-restore.patch 003-CVE-2026-105958-display-validate-surface_id-bounds-in-migration-restore.patch 004-CVE-2026-105958-display-validate-surfaces_at_client_ptr-in-display-migration-data.patch 005-CVE-2026-105958-reds-validate-agent-migration-data-fields-before-use.patch 006-CVE-2026-105958-char-device-validate-write_data_ptr-bounds-in-migration-restore.patch 007-CVE-2026-105958-smartcard-validate-migration-read-bounds-and-buffer-sizing.patch 008-CVE-2026-105958-smartcard-remove-spice_assert-on-attacker-controlled-read_size.patch 009-CVE-2026-105958-smartcard-dont-allocate-based-on-attacker-controlled-message-length.patch - bsc#1285875 - VUL-0: CVE-2026-105959: spice: heap buffer overflow due to incorrect truncation of `size_t` allocation in the GLZ encoder dictionary restore path 010-CVE-2026-105959-glz-fix-integer-truncation-in-encoder-malloc-callback.patch 011-CVE-2026-105959-glz-validate-max_encoders-from-migration-data.patch ==== sqlite3 ==== Version update (3.53.2 -> 3.54.1) Subpackages: libsqlite3-0 libsqlite3-0-x86-64-v3 sqlite3-tcl - Update to version 3.54.1: * https://sqlite.org/releaselog/3_54_1.html * Fix a possible heap-buffer overflow on 32-bit builds (64-bit builds are not affected). * Fix other problems in 3.54.0 reported by users. - Update to version 3.54.0: * https://sqlite.org/releaselog/3_54_0.html * CLI enhancements: prompt strings may contain escape sequences that expand to show state information, and the initial prompt is taken from the SQLITE_PS1 and SQLITE_PS2 environment variables if set. The default prompt honors NO_COLOR. * CLI: columnar output modes now show the column name header by default even if the query returns no rows. * CLI: the new ".diskused" dot-command (based on the new diskused() extension) replaces the separate sqlite3_analyzer utility, which is now deprecated upstream. * CLI: the .mode command gained the --rowcount, --titles, - -ifmt and --fpfmt options. * CLI: ending an SQL command with a line containing just "go" or "/" is discontinued unless compiled with - DSQLITE_SHELL_LEGACY_COMMAND_TERMINATOR. * Query planner improvements, including better optimization of "expr OR TRUE" / "expr OR FALSE", skipping needless updates of expression indexes, ignoring DISTINCT on the right-hand side of IN, and faster UNION queries with a LIMIT of exactly 1. * ALTER TABLE now raises an error on any attempt to add, drop, or rename columns named "ROWID", "_ROWID_" or "OID". * New %J and %j conversions to render JSON string literals in the built-in printf() and the format() SQL function. * New C-language interfaces: sqlite3_result_str() and sqlite3_incomplete(). * Date/time functions: added the "weekday -N" form of the weekday modifier and the "end of" modifier. * The authorizer callback is now invoked for SQL functions found in the DEFAULT clauses of CREATE TABLE statements. * Added SQLITE_LIMIT_SCHEMA and SQLITE_LIMIT_TRIGGER_STEPS to the sqlite3_limit() interface. * Use O_TMPFILE when generating temporary files on systems that support it. * About 4% faster as measured by counting CPU cycles in the speedtest1 benchmark. - Raise RLIMIT_DATA in %check so that the ASAN based tests can reserve their shadow memory region.