auto-created for python-matplotlib

This commit was autocreated by AutoGits PR Review Bot

referencing PRs:
 PR: pool/python-matplotlib!2

.gitmodules

@@ -17350,6 +17350,10 @@
 	path = rasqal
 	url = ../../pool/rasqal
 	branch = leap-16.0
+[submodule "rawtherapee"]
+	path = rawtherapee
+	url = ../../pool/rawtherapee
+	branch = leap-16.0
 [submodule "raw-thumbnailer"]
 	path = raw-thumbnailer
 	url = ../../pool/raw-thumbnailer
@@ -26010,6 +26014,10 @@
 	path = python-libnacl
 	url = ../../pool/python-libnacl
 	branch = leap-16.0
+[submodule "python-matplotlib"]
+	path = python-matplotlib
+	url = ../../pool/python-matplotlib/
+	branch = leap-16.0
 [submodule "blueman"]
 	path = blueman
 	url = ../../pool/blueman

0Backports/Backports.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Jan  5 10:38:32 UTC 2026 - Wolfgang Engel <wolfgang.engel@suse.com>
+
+- Backports.productcompose:
+  + add to backports_unneeded, remove xen related packages (bsc#1253226)
+      xen-tools-xendomains-wait-disk
+
 -------------------------------------------------------------------
 Fri Oct 10 07:19:41 UTC 2025 - Wolfgang Engel <wolfgang.engel@suse.com>
 

0Backports/Backports.productcompose

@@ -281,6 +281,7 @@ packagesets:
   - xen-doc-html
   - xen-tools
   - xen-tools-domU
+  - xen-tools-xendomains-wait-disk
   - yum-utils
 
 # TODO: unneeded Leap package per architecture
@@ -701,6 +702,9 @@ packagesets:
   - cargo-packaging
   - cargo1.87
   - cargo1.88
+  - cargo1.89
+  - cargo1.90
+  - cargo1.91
   - catatonit
   - cblas-devel
   - cblas-devel-static
@@ -6795,6 +6799,9 @@ packagesets:
   - rhino-engine
   - rhino-javadoc
   - rhino-runtime
+  - rmt-server
+  - rmt-server-config
+  - rmt-server-pubcloud
   - rollback-helper
   - rootlesskit
   - rp-pppoe
@@ -6851,6 +6858,9 @@ packagesets:
   - rust-keylime
   - rust1.87
   - rust1.88
+  - rust1.89
+  - rust1.90
+  - rust1.91
   - samba
   - samba-ad-dc
   - samba-ad-dc-libs

_config

@@ -168,7 +168,7 @@ Macros:
 
 # Leap specific package list, the same list with excludebuild must add to Backports project
 # Most of package should be built in Backports
-%if "%_project" == "openSUSE:Backports:SLE-16.0"
+%if 0%{?_is_in_project}
 # we build ffado:ffado-mixer for openSUSE, the main one is built in SLFO
 BuildFlags: excludebuild:ffado
 # build gpgme:qt flavor for qt5 support

patchinfo.20251201094954024941.93181000773252/_patchinfo

@@ -0,0 +1,209 @@
+<patchinfo incident="packagehub-54">
+  <issue tracker="bnc" id="1251651">VUL-0: CVE-2025-58190: hauler: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input</issue>
+  <issue tracker="cve" id="2025-22872">cve#2025-22872 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-22872</issue>
+  <issue tracker="cve" id="2025-58058">cve#2025-58058 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-58058</issue>
+  <issue tracker="cve" id="2024-45338">cve#2024-45338 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2024-45338</issue>
+  <issue tracker="bnc" id="1241184">VUL-0: CVE-2024-0406: hauler: mholt/archiver: access to restricted files or directories when unpacking specially crafted tar file</issue>
+  <issue tracker="bnc" id="1235332">VUL-0: CVE-2024-45338: hauler: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content</issue>
+  <issue tracker="cve" id="2025-11579">cve#2025-11579 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-11579</issue>
+  <issue tracker="cve" id="2024-0406">cve#2024-0406 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2024-0406</issue>
+  <issue tracker="cve" id="2025-47911">cve#2025-47911 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-47911</issue>
+  <issue tracker="cve" id="2025-46569">cve#2025-46569 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-46569</issue>
+  <issue tracker="bnc" id="1246722">VUL-0: CVE-2025-46569: hauler: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API</issue>
+  <issue tracker="bnc" id="1248937">VUL-0: CVE-2025-58058: hauler: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory</issue>
+  <issue tracker="bnc" id="1241804">VUL-0: CVE-2025-22872: hauler: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction</issue>
+  <issue tracker="bnc" id="1251516">VUL-0: CVE-2025-47911: hauler: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
+  <issue tracker="cve" id="2025-58190">cve#2025-58190 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-58190</issue>
+  <issue tracker="bnc" id="1251891">VUL-0: CVE-2025-11579: hauler: github.com/nwaples/rardecode: failure to restrict the dictionary size when processing RAR files allows for excessive memory consumpti</issue>
+  <packager>dirkmueller</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for hauler</summary>
+  <description>This update for hauler fixes the following issues:
+
+- Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,
+  bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,
+  bsc#1248937, CVE-2025-58058):
+  * bump github.com/containerd/containerd (#474)
+  * another fix to tests for new tests (#472)
+  * fixed typo in testdata (#471)
+  * fixed/cleaned new tests (#470)
+  * trying a new way for hauler testing (#467)
+  * update for cosign v3 verify (#469)
+  * added digests view to info (#465)
+  * bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457)
+  * update oras-go to v1.2.7 for security patches (#464)
+  * update cosign to v3.0.2+hauler.1 (#463)
+  * fixed homebrew directory deprecation (#462)
+  * add registry logout command (#460)
+
+- Update to version 1.3.0:
+  * bump the go_modules group across 1 directory with 2 updates (#455)
+  * upgraded versions/dependencies/deprecations (#454)
+  * allow loading of docker tarballs (#452)
+  * bump the go_modules group across 1 directory with 2 updates (#449)
+
+- update to 1.2.5 (bsc#1246722, CVE-2025-46569):
+  * Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in
+    the go_modules group across 1 directory (CVE-2025-46569)
+  * deprecate auth from hauler store copy
+  * Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the
+    go_modules group across 1 directory
+  * Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
+    in the go_modules group across 1 directory
+  * upgraded go and dependencies versions
+
+- Update to version 1.2.5:
+  * upgraded go and dependencies versions (#444)
+  * Bump github.com/go-viper/mapstructure/v2 (#442)
+  * bump github.com/cloudflare/circl (#441)
+  * deprecate auth from hauler store copy (#440)
+  * Bump github.com/open-policy-agent/opa (#438)
+
+- update to 1.2.4 (CVE-2025-22872, bsc#1241804):
+  * Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules
+    group across 1 directory
+  * minor tests updates
+
+- Update to version 1.2.3:
+  * formatting and flag text updates
+  * add keyless signature verification (#434)
+  * bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
+  * add --only flag to hauler store copy (for images) (#429)
+  * fix tlog verification error/warning output (#428)
+
+- Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):
+  * cleanup new tlog flag typos and add shorthand (#426)
+  * default public transparency log verification to false to be airgap friendly but allow override (#425)
+  * bump github.com/golang-jwt/jwt/v4 (#423)
+  * bump the go_modules group across 1 directory with 2 updates (#422)
+  * bump github.com/go-jose/go-jose/v3 (#417)
+  * bump github.com/go-jose/go-jose/v4 (#415)
+  * clear default manifest name if product flag used with sync (#412)
+  * updates for v1.2.0 (#408)
+  * fixed remote code (#407)
+  * added remote file fetch to load (#406)
+  * added remote and multiple file fetch to sync (#405)
+  * updated save flag and related logs (#404)
+  * updated load flag and related logs [breaking change] (#403)
+  * updated sync flag and related logs [breaking change] (#402)
+  * upgraded api update to v1/updated dependencies (#400)
+  * fixed consts for oci declarations (#398)
+  * fix for correctly grabbing platform post cosign 2.4 updates (#393)
+  * use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
+  * Bump the go_modules group across 1 directory with 2 updates (#385)
+  * replace mholt/archiver with mholt/archives (#384)
+  * forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
+  * cleaned up registry and improved logging (#378)
+  * Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)
+- bump net/html dependencies (bsc#1235332, CVE-2024-45338)
+
+- Update to version 1.1.1:
+  * fixed cli desc for store env var (#374)
+  * updated versions for go/k8s/helm (#373)
+  * updated version flag to internal/flags (#369)
+  * renamed incorrectly named consts (#371)
+  * added store env var (#370)
+  * adding ignore errors and retries for continue on error/fail on error (#368)
+  * updated/fixed hauler directory (#354)
+  * standardize consts (#353)
+  * removed cachedir code (#355)
+  * removed k3s code (#352)
+  * updated dependencies for go, helm, and k8s (#351)
+  * [feature] build with boring crypto where available (#344)
+  * updated workflow to goreleaser builds (#341)
+  * added timeout to goreleaser workflow (#340)
+  * trying new workflow build processes (#337)
+  * improved workflow performance (#336)
+  * have extract use proper ref (#335)
+  * yet another workflow goreleaser fix (#334)
+  * even more workflow fixes (#333)
+  * added more fixes to github workflow (#332)
+  * fixed typo in hauler store save (#331)
+  * updates to fix build processes (#330)
+  * added integration tests for non hauler tarballs (#325)
+  * bump: golang &gt;= 1.23.1 (#328)
+  * add platform flag to store save (#329)
+  * Update feature_request.md
+  * updated/standardize command descriptions (#313)
+  * use new annotation for 'store save' manifest.json (#324)
+  * enable docker load for hauler tarballs (#320)
+  * bump to cosign v2.2.3-carbide.3 for new annotation (#322)
+  * continue on error when adding images to store (#317)
+  * Update README.md (#318)
+  * fixed completion commands (#312)
+  * github.com/rancherfederal/hauler =&gt; hauler.dev/go/hauler (#311)
+  * pages: enable go install hauler.dev/go/hauler (#310)
+  * Create CNAME
+  * pages: initial workflow (#309)
+  * testing and linting updates (#305)
+  * feat-273: TLS Flags (#303)
+  * added list-repos flag (#298)
+  * fixed hauler login typo (#299)
+  * updated cobra function for shell completion (#304)
+  * updated install.sh to remove github api (#293)
+  * fix image ref keys getting squashed when containing sigs/atts (#291)
+  * fix missing versin info in release build (#283)
+  * bump github.com/docker/docker in the go_modules group across 1 directory (#281)
+  * updated install script (`install.sh`) (#280)
+  * fix digest images being lost on load of hauls (Signed). (#259)
+  * feat: add readonly flag (#277)
+  * fixed makefile for goreleaser v2 changes (#278)
+  * updated goreleaser versioning defaults (#279)
+  * update feature_request.md (#274)
+  * updated old references
+  * updated actions workflow user
+  * added dockerhub to github actions workflow
+  * removed helm chart
+  * added debug container and workflow
+  * updated products flag description
+  * updated chart for release
+  * fixed workflow errors/warnings
+  * fixed permissions on testdata
+  * updated chart versions (will need to update again)
+  * last bit of fixes to workflow
+  * updated unit test workflow
+  * updated goreleaser deprecations
+  * added helm chart release job
+  * updated github template names
+  * updated imports (and go fmt)
+  * formatted gitignore to match dockerignore
+  * formatted all code (go fmt)
+  * updated chart tests for new features
+  * Adding the timeout flag for fileserver command
+  * Configure chart commands to use helm clients for OCI and private registry support
+  * Added some documentation text to sync command
+  * Bump golang.org/x/net from 0.17.0 to 0.23.0
+  * fix for dup digest smashing in cosign
+  * removed vagrant scripts
+  * last bit of updates and formatting of chart
+  * updated hauler testdata
+  * adding functionality and cleaning up
+  * added initial helm chart
+  * removed tag in release workflow
+  * updated/fixed image ref in release workflow
+  * updated/fixed platforms in release workflow
+  * updated/cleaned github actions (#222)
+  * Make Product Registry configurable (#194)
+  * updated fileserver directory name (#219)
+  * fix logging for files
+  * add extra info for the tempdir override flag
+  * tempdir override flag for load
+  * deprecate the cache flag instead of remove
+  * switch to using bci-golang as builder image
+  * fix: ensure /tmp for hauler store load
+  * added the copy back for now
+  * remove copy at the image sync not needed with cosign update
+  * removed misleading cache flag
+  * better logging when adding to store
+  * update to v2.2.3 of our cosign fork
+  * add: dockerignore
+  * add: Dockerfile
+  * Bump google.golang.org/protobuf from 1.31.0 to 1.33.0
+  * Bump github.com/docker/docker
+  * updated and added new logos
+  * updated github files
+</description>
+  <package>hauler</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251208143300643166.187004354831441/_patchinfo

@@ -0,0 +1,63 @@
+<patchinfo incident="packagehub-61">
+  <packager>bigironman</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for icinga-php-thirdparty, icinga-php-library, icingaweb2</summary>
+  <description>This update for icinga-php-thirdparty, icinga-php-library, icingaweb2 fixes the following issues:
+
+Changes in icinga-php-thirdparty:
+
+- Update to 0.13.1
+
+  - No changelog from upstream.
+
+- Update to 0.12.1
+
+  - No changelog from upstream.
+
+Changes in icinga-php-library:
+
+- Update to 1.17.0
+
+  - No changelog from upstream.
+
+Changes in icingaweb2:
+
+- Update to 2.12.6
+
+  - Search box shows many magnifying glasses for some community themes #5395
+  - Authentication hooks are not called with external backends #5415
+  - Improve Minimal layout #5386
+
+- Update to 2.12.5
+
+  * PHP 8.4 Support
+    We're again a little behind schedule, but now we support PHP 8.4!
+    This means that installations on Ubuntu 25.04 and Fedora 42+ can
+    now install Icinga Web without worrying about PHP related
+    incompatibilities. Icinga packages will be available in the
+    next few days.
+  * Good Things Take Time
+    There's only a single (notable) recent issue that is fixed
+    with this release. All the others are a bit older.
+    - External URLs set up as dashlets are not embedded the same
+      as navigation items #5346
+  * But the team sat together a few weeks ago and fixed a bug here
+    and there. And of course, also in Icinga Web!
+    - Users who are not allowed to change the theme, cannot change
+      the theme mode either #5385
+    - Improved compatibility with several SSO authentication
+      providers #5000, #5227
+    - Filtering for older-than events with relative time does not
+      work #5263
+    - Empty values are NULL in CSV exports #5350
+  * Breaking, Somewhat
+    This is mainly for developers.
+    With the support of PHP 8.4, we introduced a new environment
+    variable, ICINGAWEB_ENVIRONMENT. Unless set to dev, Icinga Web
+    will not show nor log deprecation notices anymore.
+</description>
+  <package>icinga-php-thirdparty</package>
+  <package>icinga-php-library</package>
+  <package>icingaweb2</package>
+</patchinfo>

patchinfo.20251210101443200408.93181000773252/_patchinfo

@@ -0,0 +1,18 @@
+<patchinfo incident="packagehub-53">
+  <packager>michals</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for virtme</summary>
+  <description>This update for virtme fixes the following issues:
+
+- Update to 1.40:
+  * No significant change, this is just a very small hotfix release
+    to solve a packaging problem introduced by a conflict with the
+    new vng-mcp tool.
+  * While at it, there're also some small improved hints in the MCP
+    server, so that AI agents can better understand how to build
+    the kernel using vng --build.
+</description>
+  <package>virtme</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251210102155991569.93181000773252/_patchinfo

@@ -0,0 +1,20 @@
+<patchinfo incident="packagehub-57">
+  <issue tracker="bnc" id="1254531">cmake-extras: Could not locate qmlplugindump</issue>
+  <issue tracker="bnc" id="1239788">cmake4: build failure tracker bug.</issue>
+  <packager>hillwood</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for cmake-extras</summary>
+  <description>This update for cmake-extras fixes the following issues:
+
+- Support both qmlplugindump-qt5 and qmlplugindump-qt6 (boo#1254531)
+- Fix filename and path of qmlplugindump-qt5 for openSUSE
+- Update to 1.9
+  * add support for CMake 4.0
+- Update to 1.8
+  * GMock: wire dependencies between GMock step and library files
+  * QmlPlugins: Crude support for qt6
+</description>
+  <package>cmake-extras</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251210175743200408.93181000773252/_patchinfo

@@ -0,0 +1,11 @@
+<patchinfo incident="packagehub-58">
+  <packager>pgajdos</packager>
+  <rating>moderate</rating>
+  <category>optional</category>
+  <summary>Optional update for rawtherapee</summary>
+  <description>This update for rawtherapee fixes the following issues:
+
+Ship rawtherapee image editor.
+</description>
+  <package>rawtherapee</package>
+</patchinfo>

patchinfo.20251211092111744764.93181000773252/_patchinfo

@@ -0,0 +1,17 @@
+<patchinfo incident="packagehub-55">
+  <issue tracker="cve" id="2025-14372">cve#2025-14372 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-14372</issue>
+  <issue tracker="bnc" id="1254776">VUL-0: chromium: release 143.0.7499.109</issue>
+  <issue tracker="cve" id="2025-14373">cve#2025-14373 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-14373</issue>
+  <packager>AndreasStieger</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+- Chromium 143.0.7499.109 (boo#1254776):
+  * CVE-2025-14372: Use after free in Password Manager
+  * CVE-2025-14373: Inappropriate implementation in Toolbar
+  * third issue with an exploit is known to exist in the wild
+</description>
+  <package>chromium</package>
+</patchinfo>

patchinfo.20251214181248399975.93181000773252/_patchinfo

@@ -0,0 +1,15 @@
+<patchinfo incident="packagehub-56">
+  <issue tracker="bnc" id="1254386">labwc crashes when turning display off with wlr-randr (fixed in upstream and Factory)</issue>
+  <packager>lucsansag</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for labwc</summary>
+  <description>This update for labwc fixes the following issues:
+
+Changes in labwc:
+
+- Fixed layershell unmap segfault when no outputs left (boo#1254386)
+</description>
+  <package>labwc</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251217091639760898.93181000773252/_patchinfo

@@ -0,0 +1,65 @@
+<patchinfo incident="packagehub-59">
+  <issue tracker="cve" id="2025-21614">CVE-2025-21614 go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies</issue>
+  <issue tracker="bnc" id="1247629">VUL-0: CVE-2025-21613: cheat: github.com/go-git/go-git/v5: argument injection via the URL field</issue>
+  <issue tracker="cve" id="2025-58181">VUL-0: CVE-2025-58181: TRACKERBUG: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption</issue>
+  <issue tracker="cve" id="2025-21613">VUL-0: CVE-2025-21613: TRACKERBUG: github.com/go-git/go-git/v5: argument injection via the URL field</issue>
+  <issue tracker="cve" id="2025-47913">VUL-0: CVE-2025-47913: TRACKERBUG: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or</issue>
+  <issue tracker="bnc" id="1253922">VUL-0: CVE-2025-58181: cheat: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption</issue>
+  <issue tracker="cve" id="2025-47914">VUL-0: CVE-2025-47914: TRACKERBUG: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read</issue>
+  <issue tracker="cve" id="2025-22870">VUL-0: CVE-2025-22870: TRACKERBUG: golang.org/net/http, golang.org/x/net/proxy, golang.org/x/net/http/httpproxy: proxy bypass using IPv6 zone IDs</issue>
+  <issue tracker="cve" id="2023-48795">VUL-0: CVE-2023-48795: openssh: prefix truncation breaking ssh channel integrity aka Terrapin Attack</issue>
+  <issue tracker="bnc" id="1254051">VUL-0: CVE-2025-47914: cheat: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read</issue>
+  <issue tracker="bnc" id="1253593">VUL-0: CVE-2025-47913: cheat: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request</issue>
+  <issue tracker="cve" id="2025-22869">VUL-0: CVE-2025-22869: TRACKERBUG: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh</issue>
+  <packager>witekbedyk</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for cheat</summary>
+  <description>This update for cheat fixes the following issues:
+
+- Security:
+  * CVE-2025-47913: Fix client process termination (bsc#1253593)
+  * CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)
+  * CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)
+  * Replace golang.org/x/crypto=golang.org/x/crypto@v0.45.0
+  * Replace golang.org/x/net=golang.org/x/net@v0.47.0
+  * Replace golang.org/x/sys=golang.org/x/sys@v0.38.0
+
+- Packaging improvements:
+  * Drop Requires: golang-packaging. The recommended Go toolchain
+    dependency expression is BuildRequires: golang(API) &gt;= 1.x or
+    optionally the metapackage BuildRequires: go
+  * Use BuildRequires: golang(API) &gt;= 1.19 matching go.mod
+  * Build PIE with pattern that may become recommended procedure:
+    %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build
+    A go toolchain buildmode default config would be preferable
+    but none exist at this time.
+  * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
+  * Remove go build -o output binary location and name. Default
+    binary has the same name as package of func main() and is
+    placed in the top level of the build directory.
+  * Add basic %check to execute binary --help
+
+- Packaging improvements:
+  * Service go_modules replace dependencies with CVEs
+  * Replace github.com/cloudflare/circl=github.com/cloudflare/circl@v1.6.1
+    Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm
+  * Replace golang.org/x/net=golang.org/x/net@v0.36.0
+    Fixes GO-2025-3503 CVE-2025-22870
+  * Replace golang.org/x/crypto=golang.org/x/crypto@v0.35.0
+    Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8
+    Fixes GO-2025-3487 CVE-2025-22869
+  * Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/v5@v5.13.0
+    Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4
+    Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
+  * Service tar_scm set mode manual from disabled
+  * Service tar_scm create archive from git so we can exclude
+    vendor directory upstream committed to git. Committed vendor
+    directory contents have build issues even after go mod tidy.
+  * Service tar_scm exclude dir vendor
+  * Service set_version set mode manual from disabled
+  * Service set_version remove param basename not needed
+</description>
+  <package>cheat</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251218074156387460.187004354831441/_patchinfo

@@ -0,0 +1,21 @@
+<patchinfo incident="packagehub-60">
+  <issue tracker="cve" id="2025-14766">VUL-0: chromium: release 143.0.7499.146</issue>
+  <issue tracker="cve" id="2025-14174">Google Chrome: chromium: Out of bounds memory access via crafted HTML page</issue>
+  <issue tracker="bnc" id="1255115">VUL-0: chromium: release 143.0.7499.146</issue>
+  <issue tracker="cve" id="2025-14765">VUL-0: chromium: release 143.0.7499.146</issue>
+  <packager>oertel</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+Changes in chromium:
+
+Chromium 143.0.7499.146 (boo#1255115):
+
+  * CVE-2025-14765: Use after free in WebGPU
+  * CVE-2025-14766: Out of bounds read and write in V8
+  * CVE-2025-14174: Out of bounds memory access in ANGLE
+</description>
+  <package>chromium</package>
+</patchinfo>

patchinfo.20260106094954024941.93181000773252/_patchinfo

@@ -0,0 +1,11 @@
+<patchinfo>
+  <packager>mcalabkova</packager>
+  <rating>moderate</rating>
+  <category>optional</category>
+  <summary>Optional update for python-matplotlib</summary>
+  <description>This update for python-matplotlib fixes the following issues:
+
+Ships python-matplotlib to PackageHub.
+</description>
+  <package>python-matplotlib</package>
+</patchinfo>

workflow.config

@@ -65,6 +65,7 @@
         "mschnitzer",
         "msmeissn",
         "openqa-maintenance",
+        "rfrohl",
         "foursixnine-openqa",
         "szarate"
         ],