1
0

Compare commits

..

1 Commits

113 changed files with 48 additions and 2086 deletions

112
.gitmodules vendored
View File

@@ -290,10 +290,6 @@
path = PrusaSlicer
url = ../../pool/PrusaSlicer
branch = leap-16.0
[submodule "dehydrated"]
path = dehydrated
url = ../../pool/dehydrated
branch = leap-16.0
[submodule "QR-Code-generator"]
path = QR-Code-generator
url = ../../pool/QR-Code-generator
@@ -2290,14 +2286,6 @@
path = cmus
url = ../../pool/cmus
branch = leap-16.0
[submodule "cni"]
path = cni
url = ../../pool/cni
branch = leap-16.0
[submodule "cni-plugins"]
path = cni-plugins
url = ../../pool/cni-plugins
branch = leap-16.0
[submodule "cntlm"]
path = cntlm
url = ../../pool/cntlm
@@ -26146,106 +26134,6 @@
path = python-pyRFC3339
url = ../../pool/python-pyRFC3339
branch = leap-16.0
[submodule "certbot-systemd-timer"]
path = certbot-systemd-timer
url = ../../pool/certbot-systemd-timer
branch = leap-16.0
[submodule "python-augeas"]
path = python-augeas
url = ../../pool/python-augeas
branch = leap-16.0
[submodule "python-bson"]
path = python-bson
url = ../../pool/python-bson
branch = leap-16.0
[submodule "python-certbot-apache"]
path = python-certbot-apache
url = ../../pool/python-certbot-apache
branch = leap-16.0
[submodule "python-certbot-dns-cloudflare"]
path = python-certbot-dns-cloudflare
url = ../../pool/python-certbot-dns-cloudflare
branch = leap-16.0
[submodule "python-certbot-dns-digitalocean"]
path = python-certbot-dns-digitalocean
url = ../../pool/python-certbot-dns-digitalocean
branch = leap-16.0
[submodule "python-certbot-dns-dnsimple"]
path = python-certbot-dns-dnsimple
url = ../../pool/python-certbot-dns-dnsimple
branch = leap-16.0
[submodule "python-certbot-dns-dnsmadeeasy"]
path = python-certbot-dns-dnsmadeeasy
url = ../../pool/python-certbot-dns-dnsmadeeasy
branch = leap-16.0
[submodule "python-certbot-dns-linode"]
path = python-certbot-dns-linode
url = ../../pool/python-certbot-dns-linode
branch = leap-16.0
[submodule "python-certbot-dns-luadns"]
path = python-certbot-dns-luadns
url = ../../pool/python-certbot-dns-luadns
branch = leap-16.0
[submodule "python-certbot-dns-nsone"]
path = python-certbot-dns-nsone
url = ../../pool/python-certbot-dns-nsone
branch = leap-16.0
[submodule "python-certbot-dns-ovh"]
path = python-certbot-dns-ovh
url = ../../pool/python-certbot-dns-ovh
branch = leap-16.0
[submodule "python-certbot-dns-rfc2136"]
path = python-certbot-dns-rfc2136
url = ../../pool/python-certbot-dns-rfc2136
branch = leap-16.0
[submodule "python-certbot-dns-route53"]
path = python-certbot-dns-route53
url = ../../pool/python-certbot-dns-route53
branch = leap-16.0
[submodule "python-cloudflare"]
path = python-cloudflare
url = ../../pool/python-cloudflare
branch = leap-16.0
[submodule "python-digitalocean"]
path = python-digitalocean
url = ../../pool/python-digitalocean
branch = leap-16.0
[submodule "python-dns-lexicon"]
path = python-dns-lexicon
url = ../../pool/python-dns-lexicon
branch = leap-16.0
[submodule "python-jsonlines"]
path = python-jsonlines
url = ../../pool/python-jsonlines
branch = leap-16.0
[submodule "python-jsonpickle"]
path = python-jsonpickle
url = ../../pool/python-jsonpickle
branch = leap-16.0
[submodule "python-localzone"]
path = python-localzone
url = ../../pool/python-localzone
branch = leap-16.0
[submodule "python-pytest-httpx"]
path = python-pytest-httpx
url = ../../pool/python-pytest-httpx
branch = leap-16.0
[submodule "python-requests-file"]
path = python-requests-file
url = ../../pool/python-requests-file
branch = leap-16.0
[submodule "python-softlayer"]
path = python-softlayer
url = ../../pool/python-softlayer
branch = leap-16.0
[submodule "python-softlayer-zeep"]
path = python-softlayer-zeep
url = ../../pool/python-softlayer-zeep
branch = leap-16.0
[submodule "python-tldextract"]
path = python-tldextract
url = ../../pool/python-tldextract
branch = leap-16.0
[submodule "openQA-devel-container"]
path = openQA-devel-container
url = ../../pool/openQA-devel-container

2
cddlib

Submodule cddlib updated: 20da620429...f0f0c4f64c

1
cni

Submodule cni deleted from 44ad00e51b

Submodule cni-plugins deleted from fe94e351ce

Submodule coredns updated: 8273aa64e4...c75b9e7492

Submodule dehydrated deleted from 67698c18b1

2
fcitx5

Submodule fcitx5 updated: 7957ae0538...5ca142210a

2
flint

Submodule flint updated: 47c6375582...71e720ca64

2
gimp

Submodule gimp updated: 539373922d...aab3634bba

2
hauler

Submodule hauler updated: 69ca5e4eea...4061841edd

2
knot

Submodule knot updated: d98a3c5e64...41bb945764

2
matio

Submodule matio updated: cab79b5274...a301162ce9

2
niri

Submodule niri updated: d66708d6ef...de5c060c81

2
openQA

Submodule openQA updated: 6e8fa2da1d...e091086774

View File

@@ -1,14 +0,0 @@
<patchinfo incident="packagehub-67">
<packager>lkocman</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for grub2-compat-ia32</summary>
<description>This update for grub2-compat-ia32 fixes the following issues:
- Drop update-bootloader --get as it returns 0
even if the variable is unset
- Add update-bootloader also into post and postun Requires
</description>
<package>grub2-compat-ia32</package>
<seperate_build_arch/>
</patchinfo>

View File

@@ -1,236 +0,0 @@
<patchinfo incident="packagehub-81">
<issue tracker="bnc" id="1250499">VUL-0: CVE-2025-10924: gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="bnc" id="1250497">VUL-0: CVE-2025-10922: gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-10922">VUL-0: CVE-2025-10922: gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-2760">VUL-0: CVE-2025-2760: gimp: integer overflow may lead to remote code execution</issue>
<issue tracker="bnc" id="1250501">VUL-0: CVE-2025-10925: gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="bnc" id="1241690">VUL-0: CVE-2025-2760: gimp: integer overflow may lead to remote code execution</issue>
<issue tracker="bnc" id="1250495">VUL-0: CVE-2025-10920: gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-10920">VUL-0: CVE-2025-10920: gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-10924">VUL-0: CVE-2025-10924: gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-10925">VUL-0: CVE-2025-10925: gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability</issue>
<packager>mgorse</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for gimp</summary>
<description>This update for gimp fixes the following issues:
Changes in gimp:
Update to 3.0.6:
- Security:
- During development, we received reports from the Zero Day
Initiative of potential security issues with some of our file
import plug-ins. While these issues are very unlikely to
occur with real files, developers like Jacob Boerema and Alx
Sa proactively improved security for those imports.
The resolved reports are:
- ZDI-CAN-27793
- ZDI-CAN-27823
- ZDI-CAN-27836
- ZDI-CAN-27878
- ZDI-CAN-27863
- ZDI-CAN-27684
- Core:
- Many false-positive build warnings have been cleaned out (and
proper issues fixed).
- Various crashes fixed.
- When creating a layer mask from the layer's alpha, but the
layer has no alpha, simply fill the mask with complete
opacity instead of a completely transparent layer.
- Various core infrastructure code reviewed, cleaned up,
refactored and improved, in drawable, layer and filter
handling code, tree view code, and more.
- GIMP_ICONS_LIKE_A_BOSS environment variable is not working
anymore (because "gtk-menu-images" and "gtk-button-images"
have been deprecated in GTK3 and removed in GTK4) and was
therefore removed.
- Lock Content now shows as an undo step.
- Add alpha channel for certain transforms.
- Add alpha channel on filter merge, when necessary.
- Filters can now be applied non-destructively on channels.
- Improved Photoshop brush support.
- After deleting a palette entry, the next entry is
automatically selected. This allows easily deleting several
entries in a row, among other usage.
- Resize image to layers irrespective to selections.
- Improved in-GUI release notes' demo script language:
- We can now set a button value to click it: "toolbox:text,
tool-options:outline=1, tool-options:outline-direction"
- Color selector's module names can be used as identifiers:
"color-editor,color-editor:CMYK=1,color-editor:total-ink-coverage"
- Fixed Alpha to Selection on single layers with no
transparency.
- Various code is slowly ported to newer code, preparing for
GTK4 port (in an unplanned future step):
- Using g_set_str() (optionally redefining it in our core
code to avoid bumping the GLib minimum requirement).
- Start using GListModel in various pieces of code, in
particular getting rid of more and more usage of
GtkTreeView when possible (as it will be deprecated with
GTK4).
- New GimpRow class for all future row widgets.
- Use more of G_DECLARE_DERIVABLE_TYPE and
G_DECLARE_FINAL_TYPE where relevant.
- New GimpContainerListView using a GtkListBox.
- New GimpRowSeparator, GimpRowSettings, GimpRowFilter and
GimpRowDrawableFilter widgets.
- (Experimental) GEX Format was updated.
- Palette import:
- Set alpha value for image palette imports.
- Fix Lab &amp; CMYK ACB palette import.
- Add palette format filters to import dialog, making it more
apparent what palette formats are supported, and giving the
ability to hide irrelevant files.
- Improved filter actions' sensitivity to make sure they are
set insensitive when relevant. In particular filters which
cannot be run non-destructively (e.g. filters with aux
inputs, non-interactive filters and GEGL Graph) must be
insensitive when trying to run them on group layers.
- Fix bad axis centering on zoom out.
- Export better SVG when exporting paths.
- Tools:
- Text tool: make sure the default color is only changed when
the user confirms the color change.
- Foreground Selection tool: do not create a selection when no
strokes has been made. In particular this removes the
unnecessary delay which happened when switching to another
tool without actually stroking anything.
- All Transform tools: transform boundaries for preview is now
multi-layers aware.
- (Experimental) Seamless Clone tool: made to work again,
though it is still too slow to get out of Playground.
- Graphical User Interface:
- Various improvements to window management:
- Keep-Above windows are set with the Utility hint.
- Utility windows are not made transient to a parent.
- Transient factory dialogs follow the active display,
ensuring that new image windows would not hide your toolbox
and dock windows.
- Various CSS improvements for styling of the interface. Some
theme leaks were also fixed.
- New toggle button in Brushes and Fonts dockable, allowing
brush and font previews to optionally follow the color theme.
For instance, when using a dark theme, the brush and font
previews could be drawn on the theme background, using the
theme foreground colors. By default, these data previews are
still drawn as black on white.
- Palette grid is now drawn with the theme's background color.
- Consistent naming patterns on human-facing options (first
word only capitalized).
- About dialog:
- We will now display the date and time of the last check in
a "Up to date as of &lt;date&gt; at &lt;time&gt;" string, differing
from the "Last checked on &lt;date&gt; at &lt;time&gt;" string. The
former will be used to indicate that GIMP is indeed
up-to-date whereas the latter when a new version was
released and that you should update.
- We now respect the system time/date format on macOS and
Windows.
- The search popup won't pop up without an image.
- Better zoom step algorithm for data previews in container
popup (e.g. the brush popup in paint Tool Options).
- Disable animation in the Input Controller, Preferences and
Welcome dialogs for stack transition when animation are
disabled in system settings.
- Fixed crosshair hotspot on Windows (crosshair cursor for
brushes was offset with a non-100% display scale factor).
- Debug/CRITICAL dialog:
- Make sure it is non-modal.
- Follow the theme mode under Windows.
- While loading images, all widgets in the file dialog are made
insensitive, except for the Cancel button and the progress
bar.
- Both grid and list views can now zoom via scroll and zoom
gestures (it used to only work in list views).
- Pop an error message up on startup when GIO modules to read
HTTPS links are not found and that we therefore fail to load
the remote gimp_versions.json file. With the AppImage package
in particular, we depend on an environment daemon which
cannot be shipped in the package. So the next best thing is
to warn people and tell them what they should install to get
version checks.
- Welcome dialog:
- The "Community Tutorials" link is now shown after the
"Documentation" link.
- The "Learn more" link in Release Notes tab leads to the
actual release news for this version.
- Plug-ins:
- PDF export: do not draw disabled layer masks.
- Jigsaw: the plug-in can now draw on transparent layers.
- Various file format fixes and improvements: JPEG 2000 import,
TIFF import, DDS import, SVG import, PSP import, FITS export,
ICNS import, Dicom import, WBMP import, Farbfeld import, XWD
import, ILBM import.
- Sphere Designer: use spin scale instead of spin entries (the
latter is unusable with little horizontal space).
- Animation Play: frames are shown again in the playback
progress bar.
- Vala Goat Exercise: ignoring C warning in this Vala plug-in
as it is generated code and we cannot control it.
- file-gih: brush pipe selection modes now have nice,
translatable names.
- Metadata viewer: port from GtkTreeView to GtkListBox.
- File Raw Data: reduce Raw Data load dialogue height by moving
to a 2-column layout.
- SVG import: it is now possible to break aspect ratio with
specific width/height arguments, when calling the PDB
procedure non-interactively (from other plug-ins).
- Print: when run through a portal print dialog, the "Image
Settings" will be exposed as a secondary dialog, outputted
after the portal dialog, instead of a tab on the main print
dialog (because it is not possible to tweak the print dialog
when it is created by a portal). This will bring back usable
workflow of printing with GIMP when run in a sandbox (e.g.
Flatpak or Snap).
- Recompose: fixed for YCbCr decomposed images.
- Fixed vulnerabilities: ZDI-CAN-27684, ZDI-CAN-27863,
ZDI-CAN-27878, ZDI-CAN-27836, ZDI-CAN-27823, ZDI-CAN-27793.
- C Source and HTML export can now be run non-interactively too
(e.g. from other plug-ins).
- Map Object: fix missing spin boxes.
- Small Tiles: fix display lag.
- CVE-2025-10925: Fix GIMP ILBM file parsing stack-based buffer overflow remote code
execution vulnerability. (ZDI-25-914, ZDI-CAN-27793, bsc#1250501)
- CVE-2025-10922: Fix GIMP DCM file parsing heap-based buffer overflow remote code
execution vulnerability. (ZDI-25-911, ZDI-CAN-27863, bsc#1250497)
- CVE-2025-10920: Prevent overflow attack by checking if output &gt;= max, not just
output &gt; max. (ZDI-25-909, ZDI-CAN-27684, bsc#1250495)
- CVE-2025-10924: Fix integer overflow while parsing FF files. (bsc#1250499)
- CVE-2025-2760: A vulnerability allows remote attackers to execute arbitrary
code on affected installations of GIMP. The specific flaw exists
within parsing of XWD files. An integer overflow happens before
allocating a buffer. This fixed in GIMP 3.0.0.
https://www.gimp.org/news/2025/03/16/gimp-3-0-released
(bsc#1241690)
</description>
<package>gimp</package>
</patchinfo>

View File

@@ -1,123 +0,0 @@
<patchinfo incident="packagehub-62">
<packager>os-autoinst-obs-workflow</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for openQA, os-autoinst, openQA-devel-container</summary>
<description>This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:
Changes in openQA:
Thu Dec 18 03:54:10 UTC 2025 - okurz@suse.com
- Update to version 5.1766014013.377e64fe:
* feat(Needle::Save): Adapt to new error handling
* feat(OpenQA::Git): Make error handling more flexible with exceptions
- Update to version 5.1765887110.8fc02990:
* Avoid partial deletion of a screenshot if Minion job is aborted
* Add `SignalBlocker` to delay signal handling during critical sections
- Update to version 5.1765805960.2112d43d:
* fix(codecov): Fix wrong casing for 'fully_covered' entries
- Update to version 5.1765535865.b566a24c:
* fix(codecov): Be strict about coverage thresholds
* Show jobs that have been cloned when `t` parameter is used on overview
- Update to version 5.1765469360.5c0525b5:
* worker: Add coverage for OVS DBus checks
* Fix overview when filtering by test and module result at the same time
* Return signal as part of run_cmd result
* Add scanner for untracked screenshots
* KTAP: Properly hide details of a skipped subtest
* docs: Restory logic of the sentence about NFT vs firewalld
* docs: Clarify DHCP/RA availability on MM networks
* feat: Allow to configure key+secret with env variables
- Update to version 5.1765286149.3debb8ea:
* KTAP: Don't increment parsed_lines_count in "SKIP" lines
* KTAP: Define unparsed_lines and parsed_lines_count
- Update to version 5.1765217707.d6e697fd:
* Test commenting on overview page together with TODO filter
* Fix job IDs that are considered for mass-commenting on overview page
- Update to version 5.1765009312.be30f6e0:
* README: Remove left-over empty badge reference
Changes in os-autoinst:
- Update to version 5.1767623406.688dd0e:
* os-autoinst-generate-needle-preview: Embed PNG
* Tweak curl call not to hang
* Fix opencv dependency due to upstream changes
* Restore package builds on older openSUSE versions
* Remove `ShellCheck` from devel dependencies on s390x
- Update to version 5.1766037062.44c7d2a:
* Tweak curl call not to hang
* Fix opencv dependency due to upstream changes
* Restore package builds on older openSUSE versions
* Remove `ShellCheck` from devel dependencies on s390x
* Remove obsolete 'bin/' folder
- Update to version 5.1765976654.0026f92:
* Fix opencv dependency due to upstream changes
* Restore package builds on older openSUSE versions
* Remove `ShellCheck` from devel dependencies on s390x
* Remove obsolete 'bin/' folder
* Improve documentation strings for get/check_var
- Update to version 5.1765808557.b89e9b4:
* Restore package builds on older openSUSE versions
* Remove `ShellCheck` from devel dependencies on s390x
* Remove obsolete 'bin/' folder
* Simplify the code to increment the counter
* audio: Allow for multiple audio recordings per test
- Update to version 5.1765804109.1e7c99a:
* Remove `ShellCheck` from devel dependencies on s390x
* Remove obsolete 'bin/' folder
* Simplify the code to increment the counter
* audio: Allow for multiple audio recordings per test
* Improve documentation strings for get/check_var
- Update to version 5.1765533145.a82864c:
* Remove obsolete 'bin/' folder
* Simplify the code to increment the counter
* audio: Allow for multiple audio recordings per test
* Improve documentation strings for get/check_var
* Add port forwarding example for NICTYPE_USER_OPTIONS
- Update to version 5.1765450253.f16e6ac:
* Simplify the code to increment the counter
* audio: Allow for multiple audio recordings per test
* Improve documentation strings for get/check_var
* Add port forwarding example for NICTYPE_USER_OPTIONS
* Fix regression from abcaa66b by disabling virtio-keyboard by default
* distribution: Add "disable_key_repeat"
* Use 'virtio-keyboard' by default to allow fixing key repetition errors
- Update to version 5.1765311639.7e3a762:
* Simplify the code to increment the counter
* audio: Allow for multiple audio recordings per test
* Add port forwarding example for NICTYPE_USER_OPTIONS
* Fix regression from abcaa66b by disabling virtio-keyboard by default
* Add IPv6 support for multi machine tests
Changes in openQA-devel-container:
- Update to version 5.1766014013.377e64fe9:
* Update to latest openQA version
</description>
<package>openQA</package>
<package>openQA:openQA-devel-test</package>
<package>openQA:openQA-test</package>
<package>openQA:openQA-worker-test</package>
<package>openQA:openQA-client-test</package>
<package>os-autoinst</package>
<package>os-autoinst:os-autoinst-test</package>
<package>os-autoinst:os-autoinst-devel-test</package>
<package>os-autoinst:os-autoinst-openvswitch-test</package>
<package>openQA-devel-container</package>
</patchinfo>

View File

@@ -1,33 +0,0 @@
<patchinfo incident="packagehub-73">
<packager>pgajdos</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for apache2-mod_wsgi</summary>
<description>This update for apache2-mod_wsgi fixes the following issues:
Changes in apache2-mod_wsgi:
- Don't enable the module by default. Instead, include instructions in the
description, consistent with other comparable modules, such as
apache2-mod_fcgid, apache2-mod_jk and apache2-mod_mono. If a reverse
dependency of this module requires it, that package may execute
`a2enmod wsgi`.
Update to 5.0.2 includes changes from 5.0.1:
* Eliminate noise in logs under Python 3.13 when Python garbage collection
decides to delay destruction of objects until a second phase, resulting in
the wsgi.errors log object being accessed after the request had been
completed and the log object marked as invalid. This resulted due to changes
in garbage collection behaviour in Python 3.13.
* Internally, when using Python 3.8 or newer, the PyConfig API will now be
used due to deprecation and future removal of older C API alternatives.
This was required to support Python 3.13.
* Fix issue which could result in process crashing when values were supplied
for user/password/realm of HTTP basic authentication which werent
compliant with UTF-8 encoding format.
* Fix memory leak in check_password() authentication hook handler.
* Change use of deprecated thread.setDaemon to thread.daemon.
</description>
<package>apache2-mod_wsgi</package>
</patchinfo>

View File

@@ -1,24 +0,0 @@
<patchinfo incident="packagehub-63">
<issue tracker="cve" id="2025-58181"/>
<issue tracker="cve" id="2025-47913"/>
<issue tracker="cve" id="2025-58190"/>
<issue tracker="cve" id="2025-47914"/>
<issue tracker="cve" id="2025-47911"/>
<issue tracker="bnc" id="1253512">VUL-0: CVE-2025-47913: trivy: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request</issue>
<issue tracker="bnc" id="1253977">VUL-0: CVE-2025-47914: trivy: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read</issue>
<issue tracker="bnc" id="1251547">VUL-0: CVE-2025-58190: trivy: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input</issue>
<issue tracker="bnc" id="1251363">VUL-0: CVE-2025-47911: trivy: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
<issue tracker="bnc" id="1253786">VUL-0: CVE-2025-58181: trivy: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption</issue>
<packager>dirkmueller</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for trivy</summary>
<description>This update for trivy fixes the following issues:
- Update to version 0.68.2:
* release: v0.68.2 [release/v0.68] (#9950)
* fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)
* ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)
</description>
<package>trivy</package>
</patchinfo>

View File

@@ -1,33 +0,0 @@
<patchinfo incident="packagehub-66">
<issue tracker="bnc" id="1239678">VUL-0: CVE-2025-2337: matio: heap buffer overflow in function Mat_VarPrint of file src/mat.c</issue>
<issue tracker="cve" id="2025-2337">VUL-0: CVE-2025-2337: matio: heap buffer overflow in function Mat_VarPrint of file src/mat.c</issue>
<issue tracker="cve" id="2025-2338">VUL-0: CVE-2025-2338: matio: heap buffer overflow in function strdup_vprintf of file src/io.c</issue>
<issue tracker="bnc" id="1239677">VUL-0: CVE-2025-2338: matio: heap buffer overflow in function strdup_vprintf of file src/io.c</issue>
<packager>AndreasStieger</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for matio</summary>
<description>This update for matio fixes the following issues:
- update to version 1.5.29:
* Fix printing rank-1-variable in Mat_VarPrint
* Fix array index out of bounds in Mat_VarPrint when printing
UTF-8 character data (boo#1239678, CVE-2025-2337)
* Fix heap-based buffer overflow in strdup_vprintf
(boo#1239677, CVE-2025-2338)
* Changed Mat_VarPrint to print all values of rank-2-variable
* Several other fixes, for example for access violations in
Mat_VarPrint
- Update to version 1.5.28:
* Fixed bug writing MAT_T_INT8/MAT_T_UINT8 encoded character
array to compressed v5 MAT file (regression of v1.5.12).
* Fixed bug reading all-zero sparse array of v4 MAT file
(regression of v1.5.18).
* Updated C99 snprintf.c.
* CMake: Enabled testing.
* Several other fixes, for example for access violations in
Mat_VarPrint.
</description>
<package>matio</package>
</patchinfo>

View File

@@ -1,12 +0,0 @@
<patchinfo incident="packagehub-71">
<packager>miska</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for knot</summary>
<description>This update for knot fixes the following issues:
- update to version 3.5.2, see
https://www.knot-dns.cz/2025-11-28-version-352.html
</description>
<package>knot</package>
</patchinfo>

View File

@@ -1,12 +0,0 @@
<patchinfo incident="packagehub-85">
<issue tracker="bnc" id="1254975">niri doesn't set the right portal notification proxy</issue>
<packager>mantarimay</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for niri</summary>
<description>This update for niri fixes the following issues:
- Fixed portal notification proxy (boo#1254975)
</description>
<package>niri</package>
</patchinfo>

View File

@@ -1,4 +1,4 @@
<patchinfo incident="packagehub-65">
<patchinfo>
<packager>sbradnick</packager>
<rating>moderate</rating>
<category>recommended</category>
@@ -73,4 +73,5 @@
* Mention viewmode key binding in man
</description>
<package>ranger</package>
</patchinfo>
<seperate_build_arch/>
</patchinfo>

View File

@@ -1,19 +0,0 @@
<patchinfo incident="packagehub-64">
<issue tracker="cve" id="2026-0628">VUL-0: CVE-2026-0628: chromium: Insufficient policy enforcement in WebView tag fixed in 143.0.7499.192</issue>
<issue tracker="bnc" id="1256067">VUL-0: CVE-2026-0628: chromium: Insufficient policy enforcement in WebView tag fixed in 143.0.7499.192</issue>
<packager>AndreasStieger</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for chromium</summary>
<description>This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 143.0.7499.192 (boo#1256067):
* CVE-2026-0628: Insufficient policy enforcement in WebView tag
- Chromium 143.0.7499.169 (stable released 2025-12-18)
* no cve listed yet
</description>
<package>chromium</package>
</patchinfo>

View File

@@ -1,35 +0,0 @@
<patchinfo incident="packagehub-68">
<packager>mcalabkova</packager>
<rating>moderate</rating>
<category>optional</category>
<summary>Optional update for certbot</summary>
<description>This update for certbot fixes the following issues:
Various certbot packages and dependencies are being added.
</description>
<package>certbot-systemd-timer</package>
<package>python-augeas</package>
<package>python-bson</package>
<package>python-certbot-apache</package>
<package>python-certbot-dns-cloudflare</package>
<package>python-certbot-dns-digitalocean</package>
<package>python-certbot-dns-dnsimple</package>
<package>python-certbot-dns-dnsmadeeasy</package>
<package>python-certbot-dns-linode</package>
<package>python-certbot-dns-luadns</package>
<package>python-certbot-dns-nsone</package>
<package>python-certbot-dns-ovh</package>
<package>python-certbot-dns-rfc2136</package>
<package>python-certbot-dns-route53</package>
<package>python-cloudflare</package>
<package>python-digitalocean</package>
<package>python-dns-lexicon</package>
<package>python-jsonlines</package>
<package>python-jsonpickle</package>
<package>python-localzone</package>
<package>python-pytest-httpx</package>
<package>python-requests-file</package>
<package>python-softlayer</package>
<package>python-softlayer-zeep</package>
<package>python-tldextract</package>
</patchinfo>

View File

@@ -1,47 +0,0 @@
<patchinfo incident="packagehub-72">
<issue tracker="cve" id="2025-14325">firefox: JIT miscompilation in the JavaScript Engine: JIT component</issue>
<issue tracker="cve" id="2025-14321">firefox: Use-after-free in the WebRTC: Signaling component</issue>
<issue tracker="cve" id="2025-14328">firefox: Privilege escalation in the Netmonitor component</issue>
<issue tracker="cve" id="2025-14323">firefox: Privilege escalation in the DOM: Notifications component</issue>
<issue tracker="cve" id="2025-14322">firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component</issue>
<issue tracker="bnc" id="1254551">VUL-0: MozillaFirefox / MozillaThunderbird: update to 146.0 and 140.6esr</issue>
<issue tracker="cve" id="2025-14324">firefox: JIT miscompilation in the JavaScript Engine: JIT component</issue>
<issue tracker="cve" id="2025-14330">firefox: JIT miscompilation in the JavaScript Engine: JIT component</issue>
<issue tracker="cve" id="2025-14329">firefox: Privilege escalation in the Netmonitor component</issue>
<issue tracker="cve" id="2025-14331">firefox: Same-origin policy bypass in the Request Handling component</issue>
<issue tracker="cve" id="2025-14333">firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146</issue>
<packager>Yoshio_Sato</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for MozillaThunderbird</summary>
<description>This update for MozillaThunderbird fixes the following issues:
Changes in MozillaThunderbird:
- Mozilla Thunderbird 140.6.0 ESR
MFSA 2025-96 (bsc#1254551)
* CVE-2025-14321 (bmo#1992760)
Use-after-free in the WebRTC: Signaling component
* CVE-2025-14322 (bmo#1996473)
Sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component
* CVE-2025-14323 (bmo#1996555)
Privilege escalation in the DOM: Notifications component
* CVE-2025-14324 (bmo#1996840)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-14325 (bmo#1998050)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-14328 (bmo#1996761)
Privilege escalation in the Netmonitor component
* CVE-2025-14329 (bmo#1997018)
Privilege escalation in the Netmonitor component
* CVE-2025-14330 (bmo#1997503)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-14331 (bmo#2000218)
Same-origin policy bypass in the Request Handling component
* CVE-2025-14333 (bmo#1966501, bmo#1997639)
Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
ESR 140.6, Firefox 146 and Thunderbird 146
</description>
<package>MozillaThunderbird</package>
</patchinfo>

View File

@@ -1,45 +0,0 @@
<patchinfo incident="packagehub-70">
<issue tracker="cve" id="2025-69195"/>
<issue tracker="bnc" id="1255729">VUL-0: CVE-2025-69195: wget2: memory corruption and crash via filename sanitization logic with attacker-controlled URLs</issue>
<issue tracker="cve" id="2025-69194"/>
<issue tracker="bnc" id="1255728">VUL-0: CVE-2025-69194: wget2: arbitrary file write via Metalink path traversal</issue>
<packager>jengelh</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for wget2</summary>
<description>This update for wget2 fixes the following issues:
Changes in wget2:
- Update to release 2.2.1
* Fix file overwrite issue with metalink [CVE-2025-69194 bsc#1255728]
* Fix remote buffer overflow in get_local_filename_real()
[CVE-2025-69195 bsc#1255729]
* Fix a redirect/mirror regression from 400713ca
* Use the local system timestamp when requested via
--no-use-server-timestamps
* Prevent file truncation with --no-clobber
* Improve messages about why URLs are not being followed
* Fix metalink with -O/--output-document
* Fix sorting of metalink mirrors by priority
* Add --show-progress to improve backwards compatibility to wget
* Fix buffer overflow in wget_iri_clone() after
wget_iri_set_scheme()
* Allow 'no_' prefix in config options
* Use libnghttp2 for HTTP/2 testing
* Set exit status to 8 on 403 response code
* Fix convert-links
* Fix --server-response for HTTP/1.1
- Update to release 2.2.0
* Don't truncate file when -c and -O are combined
* Don't log URI userinfo to logs
* Fix downloading multiple files via HTTP/2
* Support connecting with HTTP/1.0 proxies
* Ignore 1xx HTTP responses for HTTP/1.1
* Disable TCP Fast Open by default
* Fix segfault when OCSP response is missing
* Add libproxy support
</description>
<package>wget2</package>
</patchinfo>

View File

@@ -1,45 +0,0 @@
<patchinfo incident="packagehub-69">
<packager>os-autoinst-obs-workflow</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for openQA, os-autoinst, openQA-devel-container</summary>
<description>This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:
Changes in openQA:
Thu Jan 08 10:09:35 UTC 2026 - okurz@suse.com
- Update to version 5.1767864265.63cd20df:
* Skip caching for KERNEL and INITRD variables
- Update to version 5.1766150951.2799046e:
* Coverage of openQA: add folder Client/ in codecov.yaml
* Improve openQA coverage of _download_handler in Archive.pm
- Update to version 5.1766053374.57cdeee3:
* fix(docs): Fix indentation in job template examples
Changes in os-autoinst:
- Update to version 5.1767893100.fd5003c:
* Add documentation of APPEND variable
* Add undocumented KERNEL/INITRD to the supported variables
* os-autoinst-generate-needle-preview: Embed PNG
* Tweak curl call not to hang
* Fix opencv dependency due to upstream changes
Changes in openQA-devel-container:
- Update to version 5.1767864265.63cd20dfc:
* Update to latest openQA version
</description>
<package>openQA</package>
<package>openQA:openQA-devel-test</package>
<package>openQA:openQA-test</package>
<package>openQA:openQA-worker-test</package>
<package>openQA:openQA-client-test</package>
<package>os-autoinst</package>
<package>os-autoinst:os-autoinst-test</package>
<package>os-autoinst:os-autoinst-devel-test</package>
<package>os-autoinst:os-autoinst-openvswitch-test</package>
<package>openQA-devel-container</package>
</patchinfo>

View File

@@ -1,14 +0,0 @@
<patchinfo incident="packagehub-74">
<issue tracker="bnc" id="1255237">scripts it $XDG_CONFIG_DIRS/plasma-workspace/env stop working after ibus update</issue>
<packager>ftake</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for fcitx5</summary>
<description>This update for fcitx5 fixes the following issues:
- Use return instead of exit in 20-fcitx-plasma-setup.sh (boo#1255237)
- Replace "IBus" with "Fcitx" in a log message
</description>
<package>fcitx5</package>
</patchinfo>

View File

@@ -1,35 +0,0 @@
<patchinfo incident="packagehub-80">
<issue tracker="cve" id="2026-0907">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0908">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0901">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0902">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0906">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0903">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0905">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0900">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0904">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="cve" id="2026-0899">VUL-0: chromium: release 144.0.7559.59</issue>
<issue tracker="bnc" id="1256614">VUL-0: chromium: release 144.0.7559.59</issue>
<packager>oertel</packager>
<rating>moderate</rating>
<category>security</category>
<summary>Security update for chromium</summary>
<description>This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 144.0.7559.59 (boo#1256614)
* CVE-2026-0899: Out of bounds memory access in V8
* CVE-2026-0900: Inappropriate implementation in V8
* CVE-2026-0901: Inappropriate implementation in Blink
* CVE-2026-0902: Inappropriate implementation in V8
* CVE-2026-0903: Insufficient validation of untrusted input in Downloads
* CVE-2026-0904: Incorrect security UI in Digital Credentials
* CVE-2026-0905: Insufficient policy enforcement in Network
* CVE-2026-0906: Incorrect security UI
* CVE-2026-0907: Incorrect security UI in Split View
* CVE-2026-0908: Use after free in ANGLE
- use noopenh264 where available
</description>
<package>chromium</package>
</patchinfo>

View File

@@ -1,55 +0,0 @@
<patchinfo incident="packagehub-79">
<packager>os-autoinst-obs-workflow</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for openQA, os-autoinst, openQA-devel-container</summary>
<description>This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:
Changes in openQA:
- Update to version 5.1768323619.9a70ab91:
* refactor: Extend tests of df-based cleanup
* fix: Avoid wrong deletion of archived jobs in df-based cleanup
* refactor: Move logic for validating percentage into helper
* refactor: Clarify wording in comment regarding job cleanup
* Use template literals in certain JavaScript code
* Retry delete_needles job on server restart
* Add test for _delete_needles
* feat(OpenQA::Git): Cleanup git dir in commit() on shutdown
* feat: Improve rendering results on the scheduled product page
- Update to version 5.1768209690.f34c2973:
* feat(scheduled-products): Allow adding note to result data
* docs: Use node_modules target
* docs: Mention minimum PostgreSQL version
* ci: Update PostgreSQL in CI/packaging to at least 14
* Revert "Add MCP tool annotations for Claude connector compliance"
- Update to version 5.1767868268.dacbd3f7:
* Add MCP tool annotations for Claude connector compliance
Changes in os-autoinst:
- Update to version 5.1768317525.86a9a7f:
* fix(dist): exclude unstable t/28-signalblocker.t in OBS checks
* Remove deprecated BIOS and UEFI_PFLASH variables
* Add documentation of APPEND variable
* Add undocumented KERNEL/INITRD to the supported variables
* os-autoinst-generate-needle-preview: Embed PNG
Changes in openQA-devel-container:
- Update to version 5.1768323619.9a70ab916:
* Update to latest openQA version
</description>
<package>openQA</package>
<package>openQA:openQA-devel-test</package>
<package>openQA:openQA-test</package>
<package>openQA:openQA-worker-test</package>
<package>openQA:openQA-client-test</package>
<package>os-autoinst</package>
<package>os-autoinst:os-autoinst-test</package>
<package>os-autoinst:os-autoinst-devel-test</package>
<package>os-autoinst:os-autoinst-openvswitch-test</package>
<package>openQA-devel-container</package>
</patchinfo>

View File

@@ -1,22 +0,0 @@
<patchinfo incident="packagehub-83">
<issue tracker="jsc" id="PED-1942">feature request for adding ipvlan support to wicked for SLES15</issue>
<packager>cfconrad</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for wicked</summary>
<description>This update for wicked fixes the following issues:
Changes in wicked:
- Update to version 0.6.78
- man: small fixes in wireless manpage (gh#opensuse/wicked#1053)
- rtnetlink: fix RTM_NEWLINK name resolution in debug (gh#opensuse/wicked#1052)
- Add support for IPVLAN/IPVTAP (jsc#PED-1942, gh#opensuse/wicked#1050, gh#opensuse/wicked#1051)
- fsm: remove children reference array from worker (gh#opensuse/wicked#1049)
- ifxml: migrate and generate lower configs/policies (gh#opensuse/wicked#1048)
- fsm: use refcount and array macros in worker and policy (gh#opensuse/wicked#1047)
- route: use refcounted array and fix error leaks (gh#opensuse/wicked#1046)
- utils: add support for refcounted objects in generic array (gh#openSUSE/wicked#1045)
</description>
<package>wicked</package>
</patchinfo>

View File

@@ -1,14 +0,0 @@
<patchinfo incident="packagehub-75">
<packager>jengelh</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for flint</summary>
<description>This update for flint fixes the following issues:
Changes in flint:
- Fixed a compile error for downstream users when using -std=c23 or
a newer GCC which defaults to such.
</description>
<package>flint</package>
</patchinfo>

View File

@@ -1,11 +0,0 @@
<patchinfo incident="packagehub-76">
<packager>pgajdos</packager>
<rating>moderate</rating>
<category>optional</category>
<summary>Optional update for dehydrated</summary>
<description>This update for dehydrated fixes the following issues:
Adds dehydrated to PackageHub / Leap 16.0.
</description>
<package>dehydrated</package>
</patchinfo>

View File

@@ -1,41 +0,0 @@
<patchinfo incident="packagehub-77">
<issue tracker="bnc" id="1256453">polymake-devel unusable</issue>
<packager>jengelh</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for polymake, cddlib</summary>
<description>This update for polymake, cddlib fixes the following issues:
Changes in polymake:
- Enable polydb for Tumbleweed / suse_version &gt;=1690
- Reenable callable library mode [boo#1256453]
- Update to release 4.15
* graph: graphviz: use PDF instead of PS
* polytope: MILP: allow non-rational coordinates
* Some bugfixes
- Update to release 4.14
* tropical: cone: refactoring and fixes for DOME, COVECTORs and
PSEUDOVERTICES
* tropical: polytope: fix vertices computation
* tropical: hypersurface: fixes for monomials and binomials
- Update to release 4.13
* Support for Perl 5.40 and -std=c++20 builds
Changes in cddlib:
- Update to release 0.94n
* Fixed a potential dd_MatrixCanonicalize segfault.
* cddlib.pc file now points to the non-GMP version, and
cddgmp.pc has been added for the GMP version.
* Copy certificate and handle errors correctly in dd_SRedundant
for the V-representation code path.
* cddlib is now thread-safe.
</description>
<package>polymake</package>
<package>cddlib</package>
</patchinfo>

View File

@@ -1,25 +0,0 @@
<patchinfo incident="packagehub-78">
<packager>mmamula</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for ansible-sap-launchpad</summary>
<description>This update for ansible-sap-launchpad fixes the following issues:
Changes in ansible-sap-launchpad:
- Refactor Ansible Modules and adjust for ansible-core 2.19.
- 1.3.1
- Bugfixes:
- collection: Add ansible-test sanity workflow and fix sanity errors
- 1.3.0
- Changes:
- collection: Refactor all Ansible Modules
- sap_software_download: Update for ansible-core 2.19
- Bugfixes:
- sap_software_download: Fix for failed checksums not correctly retrying
</description>
<package>ansible-sap-launchpad</package>
</patchinfo>

View File

@@ -1,95 +0,0 @@
<patchinfo incident="packagehub-82">
<issue tracker="cve" id="2025-58190"/>
<issue tracker="bnc" id="1241814">VUL-0: CVE-2025-22872: go-sendxmpp: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction</issue>
<issue tracker="cve" id="2025-22872">VUL-0: CVE-2025-22872: TRACKERBUG: golang.org/x/net/html: tags incorrectly interpreted by tokenizer can lead to content being placed in the wrong scope during</issue>
<issue tracker="bnc" id="1251677">VUL-0: CVE-2025-58190: go-sendxmpp: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input</issue>
<issue tracker="bnc" id="1251461">VUL-0: CVE-2025-47911: go-sendxmpp: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
<issue tracker="cve" id="2025-47911">VUL-0: CVE-2025-47911: TRACKERBUG: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
<packager>fstrba</packager>
<rating>moderate</rating>
<category>security</category>
<summary>Security update for go-sendxmpp</summary>
<description>This update for go-sendxmpp fixes the following issues:
Changes in go-sendxmpp:
- Update to 0.15.1:
Added
* Add XEP-0359 Origin-ID to messages (requires go-xmpp &gt;= v0.2.18).
Changed
* HTTP upload: Ignore timeouts on disco IQs as some components do
not reply.
- Upgrades the embedded golang.org/x/net to 0.46.0
* Fixes: bsc#1251461, CVE-2025-47911: various algorithms with
quadratic complexity when parsing HTML documents
* Fixes: bsc#1251677, CVE-2025-58190: excessive memory consumption
by 'html.ParseFragment' when processing specially crafted input
- Update to 0.15.0:
Added:
* Add flag --verbose to show debug information.
* Add flag --recipients to specify recipients by file.
* Add flag --retry-connect to try after a waiting time if the connection fails.
* Add flag --retry-connect-max to specify the amount of retry attempts.
* Add flag --legacy-pgp for using XEP-0027 PGP encryption with Ox keys.
* Add support for punycode domains.
Changed:
* Update gopenpgp library to v3.
* Improve error detection for MUC joins.
* Don't try to connect to other SRV record targets if error contains 'auth-failure'.
* Remove support for old SSDP version (via go-xmpp v0.2.15).
* Http-upload: Stop checking other disco items after finding upload component.
* Increase default TLS version to 1.3.
- bsc#1241814 (CVE-2025-22872): This update includes golang.org/x/net/html 0.43.0
- Update to 0.14.1:
* Use prettier date format for error messages.
* Update XEP-0474 to version 0.4.0 (requires go-xmpp &gt;= 0.2.10).
- Update to 0.14.0:
Added:
* Add --fast-invalidate to allow invalidating the FAST token.
Changed:
* Don't create legacy Ox private key directory in ~/.local/share/go-sendxmpp/oxprivkeys.
* Delete legacy Ox private key directory if it's empty.
* Show proper error if saved FAST mechanism isn't usable with current TLS version (requires go-xmpp &gt;= 0.2.9).
* Print debug output to stdout, not stderr (requires go-xmpp &gt;= 0.2.9).
* Show RECV: and SEND: prefix for debug output (requires go-xmpp &gt;= 0.2.9).
* Delete stored fast token if --fast-invalidate and --fast-off are set.
* Show error when FAST creds are stored but non-FAST mechanism is requested.
- Update to 0.13.0:
Added:
* Add --anonymous to support anonymous authentication (requires go-xmpp &gt;= 0.2.8).
* Add XEP-0480: SASL Upgrade Tasks support (requires go-xmpp &gt;= 0.2.8).
* Add support for see-other-host stream error (requires go-xmpp &gt;= 0.2.8).
Changed:
* Don't automatically try other auth mechanisms if FAST authentication fails.
- Update to 0.12.1:
Changed:
* Print error instead of quitting if a message of type error is received.
* Allow upload of multiple files.
Added:
* Add flag --suppress-root-warning to suppress the warning when go-sendxmpp is used by the root user.
- Update to 0.12.0:
Added:
* Add possibility to look up direct TLS connection endpoint via hostmeta2 (requires xmppsrv &gt;= 0.3.3).
* Add flag --allow-plain to allow PLAIN authentication (requires go-xmpp &gt;= 0.2.5).
Changed:
* Disable PLAIN authentication per default.
* Disable PLAIN authentication after first use of a SCRAM auth mechanism (overrides --allow-plain) (requires
go-xmpp &gt;= 0.2.5).
- Update to 0.11.4:
* Fix bug in SCRAM-SHA-256-PLUS (via go-xmpp &gt;= 0.2.4).
- Update to 0.11.3:
* Add go-xmpp library version to --version output (requires go-xmpp &gt;= 0.2.2).
* Fix XEP-0474: SASL SCRAM Downgrade Protection hash calculation bug (via go-xmpp &gt;= v0.2.3).
* [gocritic]: Improve code quality.
</description>
<package>go-sendxmpp</package>
<seperate_build_arch/>
</patchinfo>

View File

@@ -1,13 +0,0 @@
<patchinfo incident="packagehub-84">
<issue tracker="cve" id="2025-63757"/>
<issue tracker="bnc" id="1255392">VUL-0: CVE-2025-63757: ffmpeg,ffmpeg-4: ffmpeg: accumulation of filtered pixel values can lead to an integer overflow</issue>
<packager>jonathankang</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for ffmpeg-4</summary>
<description>This update for ffmpeg-4 fixes the following issues:
- CVE-2025-63757: Fixed swscale/output: Fix integer overflow in yuv2ya16_X_c_template() (bsc#1255392).
</description>
<package>ffmpeg-4</package>
</patchinfo>

View File

@@ -1,79 +0,0 @@
<patchinfo incident="packagehub-90">
<packager>gbazzotti</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for micro-editor</summary>
<description>This update for micro-editor fixes the following issues:
Changes in micro-editor:
- Update to version 2.0.15:
* truecolor (supersedes the MICRO_TRUECOLOR environment variable)
* showchars (deprecates indentchar)
* lockbindings for completely disallowing plugins to modify keybindings
* helpsplit for changing default split type for the help command
* pageoverlap for setting number of lines kept during page up/page down
* Added FirstTab, LastTab, FirstSplit and LastSplit commands
* SkipMultiCursorBack as a counterpart to SkipMultiCursor
* CursorToViewTop, CursorToViewCenter, CursorToViewBottom
* Duplicate for duplicating the selection only, not the whole line
* Plugins never write to settings.json or bindings.json anymore
* Add onBufferOptionChanged callback
* Add SpawnCursorAtLoc()
* Expose bufpane's DoubleClick and TripleClick to plugins
* Pass mouse info to {on,pre}MouseXXX callbacks
* Support goto statement from Lua 5.2
* Various Syntax Highlighting improvements
- Update to version 2.0.14:
* matchbracestyle to choose whether to underline or highlight matching braces
* matchbraceleft to choose whether to match brace to the left of the cursor
* hltrailingws to highlight trailing whitespace
* hltaberrors to highlight tab vs space inconsistencies
* Add jump command to perform a relative goto
* Add sub-word movement actions and improve word movements
* Add paragraph selection actions and improve paragraph movements
* Make Shift-PageUp/Down the default keybindings for SelectPageUp/Down
* Add signatures support to improve filetype detection in ambiguous cases
* Provide default.yaml for default syntax highlighting
* Improvements in syntax highlighting for various languages
* More generic support for mouse events handling
* Add mouse release and mouse drag events
* Make MouseMultiCursor toggle cursors
* Better support for handling mouse events in lua
* Better API for lua timers
* Add onAnyEvent callback
* Allow colorschemes to include other colorschemes
* Give user's files in ~/.config/micro/ precedence over micro's built-in
files
* Respect umask when creating files
* Smarter smartpaste
* Make default fileformat value suited to the OS
* Improve buffer view relocation after jumping to a far-away location
* Improve return values of some actions for better action chaining
* Autocomplete filetypes
* Allow raw escape sequence to be bound with bind
* Various small improvements
* Fix various crashes
* Fix micro killed by SIGINT sent to its shell job
* Various fixes for setting local options
* Various fixes for reloading settings via reload command
* Various fixes for updating settings after changing filetype
* Fix unneeded rewriting of settings.json
* Fix overwriting persistent non-default settings in settings.json with
temporary default settings
* Don't apply rmtrailingws on autosave
* Don't autosave unmodified buffer
* Properly update autosave timer when the autosave option value changes
* Fix opening filenames including colons with parsecursor
* Fix replace to be able to insert '$'
* Fix cursor moving to an unexpected location after a redo
* Make cursor movements after selection consistent
* Fix incorrect buffer view after reloading file
* Fix lost mouse release events in case the pane becomes inactive
* Add proper locking to LineArray to fix potential races
* Cleanup indentation and trailing whitespace
* Improve plugin documentation
</description>
<package>micro-editor</package>
</patchinfo>

View File

@@ -1,43 +0,0 @@
<patchinfo incident="packagehub-94">
<packager>os-autoinst-obs-workflow</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for openQA, os-autoinst, openQA-devel-container</summary>
<description>This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:
Changes in openQA:
Fri Jan 16 20:30:53 UTC 2026 - okurz@suse.com
- Update to version 5.1768564451.45d5d5b2:
* feat: optionally configure fake auth key+secret+expiration
* OpenSuseIssueReporter: Avoid multiple push calls
* unit_tests: Add unit tests for OpenSuseBugzillaUtils
* unit_tests: Adapt the UI tests to the new kernel bug button
* plugins: Introduce OpenSuseIssueReporter for external issue reporting
Changes in os-autoinst:
Fri Jan 16 20:43:12 UTC 2026 - okurz@suse.com
- Update to version 5.1768577300.b85e486:
* fix(dist): provide proper copyright headers in all spec-files
* fix(dist): try to fix os-autoinst-obs-auto-submit reverting content
Changes in openQA-devel-container:
Fri Jan 16 20:41:22 UTC 2026 - okurz@suse.de
- Update to version 5.1768564451.45d5d5b2e:
* Update to latest openQA version
</description>
<package>openQA</package>
<package>openQA:openQA-devel-test</package>
<package>openQA:openQA-test</package>
<package>openQA:openQA-worker-test</package>
<package>openQA:openQA-client-test</package>
<package>os-autoinst</package>
<package>os-autoinst:os-autoinst-test</package>
<package>os-autoinst:os-autoinst-devel-test</package>
<package>os-autoinst:os-autoinst-openvswitch-test</package>
<package>openQA-devel-container</package>
</patchinfo>

View File

@@ -1,15 +0,0 @@
<patchinfo incident="packagehub-86">
<issue tracker="cve" id="2025-68616">VUL-0: CVE-2025-68616: python-weasyprint: server-side request forgery (SSRF) protection bypass via HTTP redirects allows access to internal network resources</issue>
<issue tracker="bnc" id="1256936">VUL-0: CVE-2025-68616: python-weasyprint: server-side request forgery (SSRF) protection bypass via HTTP redirects allows access to internal network resources</issue>
<packager>dgarcia</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for python-weasyprint</summary>
<description>This update for python-weasyprint fixes the following issues:
Changes in python-weasyprint:
- CVE-2025-68616: Fixed a server-side request forgery in default fetcher (boo#1256936).
</description>
<package>python-weasyprint</package>
</patchinfo>

View File

@@ -1,222 +0,0 @@
<patchinfo incident="packagehub-87">
<issue tracker="cve" id="2025-68156"/>
<issue tracker="cve" id="2025-68161"/>
<issue tracker="cve" id="2024-51744"/>
<issue tracker="bnc" id="1239728">VUL-0: CVE-2025-29786: coredns: github.com/expr-lang/expr: memory exhaustion when unbounded input string is processed by Expr expression parser</issue>
<issue tracker="bnc" id="1256411">VUL-0: CVE-2025-68151: coredns: coredns: lack of resource-limiting controls in multiple CoreDNS server implementations allows an unauthenticated remote attacker to exhaust memory and crash the server</issue>
<issue tracker="bnc" id="1239294">VUL-0: CVE-2025-22868: coredns: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2</issue>
<issue tracker="cve" id="2025-58063"/>
<issue tracker="bnc" id="1249389">VUL-0: CVE-2025-58063: coredns: CoreDNS Lease ID Confusion</issue>
<issue tracker="bnc" id="1255345">VUL-0: CVE-2025-68156: coredns: github.com/expr-lang/expr/builtin: uncontrolled recursion in expression evaluation can cause a denial of service</issue>
<packager>amanzini</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for coredns</summary>
<description>This update for coredns fixes the following issues:
Changes in coredns:
- fix CVE-2025-68156 bsc#1255345
- fix CVE-2025-68161 bsc#1256411
- Update to version 1.14.0:
* core: Fix gosec G115 integer overflow warnings
* core: Add regex length limit
* plugin/azure: Fix slice init length
* plugin/errors: Add optional show_first flag to consolidate directive
* plugin/file: Fix for misleading SOA parser warnings
* plugin/kubernetes: Rate limits to api server
* plugin/metrics: Implement plugin chain tracking
* plugin/sign: Report parser err before missing SOA
* build(deps): bump github.com/expr-lang/expr from 1.17.6 to 1.17.7
- Update to version 1.13.2:
* core: Add basic support for DoH3
* core: Avoid proxy unnecessary alloc in Yield
* core: Fix usage of sync.Pool to save an alloc
* core: Fix data race with sync.RWMutex for uniq
* core: Prevent QUIC reload panic by lazily initializing the listener
* core: Refactor/use reflect.TypeFor
* plugin/auto: Limit regex length
* plugin/cache: Remove superfluous allocations in item.toMsg
* plugin/cache: Isolate metadata in prefetch goroutine
* plugin/cache: Correct spelling of MaximumDefaultTTL in cache and dnsutil
packages
* plugin/dnstap: Better error handling (redial &amp; logging) when Dnstap is busy
* plugin/file: Performance finetuning
* plugin/forward: Disallow NOERROR in failover
* plugin/forward: Added support for per-nameserver TLS SNI
* plugin/forward: Prevent busy loop on connection err
* plugin/forward: Add max connect attempts knob
* plugin/geoip: Add ASN schema support
* plugin/geoip: Add support for subdivisions
* plugin/kubernetes: Fix kubernetes plugin logging
* plugin/multisocket: Cap num sockets to prevent OOM
* plugin/nomad: Support service filtering
* plugin/rewrite: Pre-compile CNAME rewrite regexp
* plugin/secondary: Fix reload causing secondary plugin goroutine to leak
- Update to version 1.13.1:
* core: Avoid string concatenation in loops
* core: Update golang to 1.25.2 and golang.org/x/net to v0.45.0 on CVE fixes
* plugin/sign: Reject invalid UTF8 dbfile token
- Update to version 1.13.0:
* core: Export timeout values in dnsserver.Server
* core: Fix Corefile infinite loop on unclosed braces
* core: Fix Corefile related import cycle issue
* core: Normalize panics on invalid origins
* core: Rely on dns.Server.ShutdownContext to gracefully stop
* plugin/dnstap: Add bounds for plugin args
* plugin/file: Fix data race in tree Elem.Name
* plugin/forward: No failover to next upstream when receiving SERVFAIL or
REFUSED response codes
* plugin/grpc: Enforce DNS message size limits
* plugin/loop: Prevent panic when ListenHosts is empty
* plugin/loop: Avoid panic on invalid server block
* plugin/nomad: Add a Nomad plugin
* plugin/reload: Prevent SIGTERM/reload deadlock
- fix CVE-2025-58063 bsc#1249389
- Update to version 1.12.4:
* bump deps
* fix(transfer): goroutine leak on axfr err (#7516)
* plugin/etcd: fix import order for ttl test (#7515)
* fix(grpc): check proxy list length in policies (#7512)
* fix(https): propagate HTTP request context (#7491)
* fix(plugin): guard nil lookups across plugins (#7494)
* lint: add missing prealloc to backend lookup test (#7510)
* fix(grpc): span leak on error attempt (#7487)
* test(plugin): improve backend lookup coverage (#7496)
* lint: enable prealloc (#7493)
* lint: enable durationcheck (#7492)
* Add Sophotech to adopters list (#7495)
* plugin: Use %w to wrap user error (#7489)
* fix(metrics): add timeouts to metrics HTTP server (#7469)
* chore(ci): restrict token permissions (#7470)
* chore(ci): pin workflow dependencies (#7471)
* fix(forward): use netip package for parsing (#7472)
* test(plugin): improve test coverage for pprof (#7473)
* build(deps): bump github.com/go-viper/mapstructure/v2 (#7468)
* plugin/file: fix label offset problem in ClosestEncloser (#7465)
* feat(trace): migrate dd-trace-go v1 to v2 (#7466)
* test(multisocket): deflake restart by using a fresh port and coordinated cleanup (#7438)
* chore: update Go version to 1.24.6 (#7437)
* plugin/header: Remove deprecated syntax (#7436)
* plugin/loadbalance: support prefer option (#7433)
* Improve caddy.GracefulServer conformance checks (#7416)
- Update to version 1.12.3:
* chore: Minor changes to `Dockerfile` (#7428)
* Properly create hostname from IPv6 (#7431)
* Bump deps
* fix: handle cached connection closure in forward plugin (#7427)
* plugin/test: fix TXT record comparison for multi-chunk vs multiple records
* plugin/file: preserve case in SRV record names and targets per RFC 6763
* fix(auto/file): return REFUSED when no next plugin is available (#7381)
* Port to AWS Go SDK v2 (#6588)
* fix(cache): data race when refreshing cached messages (#7398)
* fix(cache): data race when updating the TTL of cached messages (#7397)
* chore: fix docs incompatibility (#7390)
* plugin/rewrite: Add EDNS0 Unset Action (#7380)
* add args: startup_timeout for kubernetes plugin (#7068)
* [plugin/cache] create a copy of a response to ensure original data is never
modified
* Add support for fallthrough to the grpc plugin (#7359)
* view: Add IPv6 example match (#7355)
* chore: enable more rules from revive (#7352)
* chore: enable early-return and superfluous-else from revive (#7129)
* test(plugin): improve tests for auto (#7348)
* fix(proxy): flaky dial tests (#7349)
* test: add t.Helper() calls to test helper functions (#7351)
* fix(kubernetes): multicluster DNS race condition (#7350)
* lint: enable wastedassign linter (#7340)
* test(plugin): add tests for any (#7341)
* Actually invoke make release -f Makefile.release during test (#7338)
* Keep golang to 1.24.2 due to build issues in 1.24.3 (#7337)
* lint: enable protogetter linter (#7336)
* lint: enable nolintlint linter (#7332)
* fix: missing intrange lint fix (#7333)
* perf(kubernetes): optimize AutoPath slice allocation (#7323)
* lint: enable intrange linter (#7331)
* feat(plugin/file): fallthrough (#7327)
* lint: enable canonicalheader linter (#7330)
* fix(proxy): avoid Dial hang after Transport stopped (#7321)
* test(plugin): add tests for pkg/rand (#7320)
* test(dnsserver): add unit tests for gRPC and QUIC servers (#7319)
* fix: loop variable capture and linter (#7328)
* lint: enable usetesting linter (#7322)
* test: skip certain network-specific tests on non-Linux (#7318)
* test(dnsserver): improve core/dnsserver test coverage (#7317)
* fix(metrics): preserve request size from plugins (#7313)
* fix: ensure DNS query name reset in plugin.NS error path (#7142)
* feat: enable plugins via environment during build (#7310)
* fix(plugin/bind): remove zone for link-local IPv4 (#7295)
* test(request): improve coverage across package (#7307)
* test(coremain): Add unit tests (#7308)
* ci(test-e2e): add Go version setup to workflow (#7309)
* kubernetes: add multicluster support (#7266)
* chore: Add new maintainer thevilledev (#7298)
* Update golangci-lint (#7294)
* feat: limit concurrent DoQ streams and goroutines (#7296)
* docs: add man page for multisocket plugin (#7297)
* Prepare for the k8s api upgrade (#7293)
* fix(rewrite): truncated upstream response (#7277)
* fix(plugin/secondary): make transfer property mandatory (#7249)
* plugin/bind: remove macOS bug mention in docs (#7250)
* Remove `?bla=foo:443` for `POST` DoH (#7257)
* Do not interrupt querying readiness probes for plugins (#6975)
* Added `SetProxyOptions` function for `forward` plugin (#7229)
- Backported quic-go PR #5094: Fix parsing of ifindex from packets
to ensure compatibility with big-endian architectures
(see quic-go/quic-go#4978, coredns/coredns#6682).
- Update to version 1.12.1:
* core: Increase CNAME lookup limit from 7 to 10 (#7153)
* plugin/kubernetes: Fix handling of pods having DeletionTimestamp set
* plugin/kubernetes: Revert "only create PTR records for endpoints with
hostname defined"
* plugin/forward: added option failfast_all_unhealthy_upstreams to return
servfail if all upstreams are down
* bump dependencies, fixing bsc#1239294 and bsc#1239728
- Update to version 1.12.0:
* New multisocket plugin - allows CoreDNS to listen on multiple sockets
* bump deps
- Update to version 1.11.4:
* forward plugin: new option next, to try alternate upstreams when receiving
specified response codes upstreams on (functions like the external plugin
alternate)
* dnssec plugin: new option to load keys from AWS Secrets Manager
* rewrite plugin: new option to revert EDNS0 option rewrites in responses
- Update to version 1.11.3+git129.387f34d:
* fix CVE-2024-51744 (https://bugzilla.suse.com/show_bug.cgi?id=1232991)
build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#6955)
* core: set cache-control max-age as integer, not float (#6764)
* Issue-6671: Fixed the order of plugins. (#6729)
* `root`: explicit mark `dnssec` support (#6753)
* feat: dnssec load keys from AWS Secrets Manager (#6618)
* fuzzing: fix broken oss-fuzz build (#6880)
* Replace k8s.io/utils/strings/slices by Go stdlib slices (#6863)
* Update .go-version to 1.23.2 (#6920)
* plugin/rewrite: Add "revert" parameter for EDNS0 options (#6893)
* Added OpenSSF Scorecard Badge (#6738)
* fix(cwd): Restored backwards compatibility of Current Workdir (#6731)
* fix: plugin/auto: call OnShutdown() for each zone at its own OnShutdown() (#6705)
* feature: log queue and buffer memory size configuration (#6591)
* plugin/bind: add zone for link-local IPv6 instead of skipping (#6547)
* only create PTR records for endpoints with hostname defined (#6898)
* fix: reverter should execute the reversion in reversed order (#6872)
* plugin/etcd: fix etcd connection leakage when reload (#6646)
* kubernetes: Add useragent (#6484)
* Update build (#6836)
* Update grpc library use (#6826)
* Bump go version from 1.21.11 to 1.21.12 (#6800)
* Upgrade antonmedv/expr to expr-lang/expr (#6814)
* hosts: add hostsfile as label for coredns_hosts_entries (#6801)
* fix TestCorefile1 panic for nil handling (#6802)
</description>
<package>coredns</package>
</patchinfo>

View File

@@ -1,32 +0,0 @@
<patchinfo incident="packagehub-96">
<issue tracker="cve" id="2026-22772"/>
<issue tracker="bnc" id="1256546">VUL-0: CVE-2025-47911: TRACKERBUG: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
<packager>dirkmueller</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for hauler</summary>
<description>This update for hauler fixes the following issues:
Changes in hauler:
- Update to version 1.4.1 (bsc#1256546, CVE-2026-22772):
* fixed typos for containerd imports (#493)
* fix and support containerd imports of `hauls` (#492)
* bump github.com/sigstore/fulcio (#489)
- Update to version 1.4.0:
* added/updated logging for `serve` and `remove` (#487)
* added/fixed helm chart images/dependencies features (#485)
* more experimental feature updates (#486)
* add experimental notes (#483)
* updated tempdir flag to store persistent flags (#484)
* delete artifacts from store (#473)
* path rewrites (#475)
* updated/fixed workflow dependency versions (#478)
- Update to version 1.3.2:
* bump to latest cosign fork release (#481)
* Bump golang.org/x/crypto in the go_modules group across 1 directory (#476)
</description>
<package>hauler</package>
</patchinfo>

View File

@@ -1,19 +0,0 @@
<patchinfo incident="packagehub-91">
<issue tracker="cve" id="2026-1220"/>
<issue tracker="bnc" id="1257011">VUL-0: CVE-2026-1220: chromium: Race in V8 (update to 144.0.7559.96)</issue>
<issue tracker="bnc" id="1256938">Chromium icon missing in Gnome on Leap 16</issue>
<packager>AndreasStieger</packager>
<rating>moderate</rating>
<category>security</category>
<summary>Security update for chromium</summary>
<description>This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 144.0.7559.96 (boo#1257011)
* CVE-2026-1220: Race in V8
- update INSTALL.sh to handle the addded tags in the desktop file (boo#1256938)
</description>
<package>chromium</package>
</patchinfo>

View File

@@ -1,28 +0,0 @@
<patchinfo incident="packagehub-92">
<packager>AndreasStieger</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for minisign</summary>
<description>This update for minisign fixes the following issues:
Changes in minisign:
- Bugfix:
* bugfix: duplicate command-line arguments [7dfdb3c]
- Security fix: [gpg.fail/trustcomment]
* Trusted comment injection (minisign) [6c59875]
* trim(): only trim trailing \r\n, reject straight \r characters
- Security fix: [gpg.fail/minisign]
* Trusted comment injection (minisign) [a10dc92]
* Bail out if the signature file contains unprintable characters
- Update to version 0.12
* Libsodium is now an optional dependency. When using the Zig
toolchain to compile Minisign, you can specify the
-Dwithout-libsodium flag to build and run without libsodium.
* Key identifiers are now zero-padded when printed.
</description>
<package>minisign</package>
</patchinfo>

View File

@@ -1,24 +0,0 @@
<patchinfo incident="packagehub-88">
<issue tracker="cve" id="2025-14422"/>
<issue tracker="cve" id="2025-14423"/>
<issue tracker="bnc" id="1255293">VUL-0: CVE-2025-14422: gimp: PNM File Parsing Integer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="bnc" id="1255296">VUL-0: CVE-2025-14425: gimp: JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-14425"/>
<issue tracker="bnc" id="1255295">VUL-0: CVE-2025-14424: gimp: XCF File Parsing Use-After-Free Remote Code Execution Vulnerability</issue>
<issue tracker="bnc" id="1255294">VUL-0: CVE-2025-14423: gimp: LBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability</issue>
<issue tracker="cve" id="2025-14424"/>
<packager>mgorse</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for gimp</summary>
<description>This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2025-14422: Fixed PNM File Parsing Integer Overflow (bsc#1255293)
- CVE-2025-14423: Fixed LBM File Parsing Stack-based Buffer Overflow (bsc#1255294)
- CVE-2025-14424: Fixed XCF File Parsing Use-After-Free (bsc#1255295)
- CVE-2025-14425: Fixed JP2 File Parsing Heap-based Buffer Overflow(bsc#1255296)
</description>
<package>gimp</package>
</patchinfo>

View File

@@ -1,132 +0,0 @@
<patchinfo incident="packagehub-89">
<packager>manfred-h</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for helmfile</summary>
<description>This update for helmfile fixes the following issues:
Changes in helmfile:
- Update to version 1.2.3:
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.32.2 to 1.32.3 by @dependabot[bot] in #2308
* build(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
by @dependabot[bot] in #2310
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.92.1 to 1.93.0 by @dependabot[bot] in #2307
* Add parameter to render helmfile as go template without .gotmpl
extension by @ronaldour in #2312
* build(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 by
@dependabot[bot] in #2315
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.93.0 to 1.93.2 by @dependabot[bot] in #2323
* build(deps): bump k8s.io/apimachinery from 0.34.2 to 0.34.3
by @dependabot[bot] in #2322
* build(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 by
@dependabot[bot] in #2317
* build(deps): bump k8s.io/client-go from 0.34.2 to 0.34.3 by
@dependabot[bot] in #2321
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.32.3 to 1.32.5 by @dependabot[bot] in #2320
* build(deps): bump helm.sh/helm/v3 from 3.19.2 to 3.19.3 by
@dependabot[bot] in #2325
* build(deps): bump helm.sh/helm/v4 from 4.0.1 to 4.0.2 by
@dependabot[bot] in #2326
* build(deps): bump actions/upload-artifact from 5 to 6 by
@dependabot[bot] in #2331
* build(deps): bump helm.sh/helm/v3 from 3.19.3 to 3.19.4 by
@dependabot[bot] in #2328
* build(deps): bump actions/download-artifact from 6 to 7 by
@dependabot[bot] in #2332
* build(deps): bump dessant/lock-threads from 5 to 6 by
@dependabot[bot] in #2330
* build(deps): bump helm.sh/helm/v4 from 4.0.3 to 4.0.4 by
@dependabot[bot] in #2329
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
from 1.93.2 to 1.94.0 by @dependabot[bot] in #2333
* bump helm version to 4.0.4 by @yxxhero in #2335
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.32.5 to 1.32.6 by @dependabot[bot] in #2336
* build(deps): bump github.com/zclconf/go-cty-yaml from 1.1.0
to 1.2.0 by @dependabot[bot] in #2340
* build(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 by
@dependabot[bot] in #2338
* fix: rewrite relative file:// chart dependencies to absolute
paths by @sstarcher in #2334
- Update to version 1.2.2:
* Fix AWS SDK debug logging by making it configurable (issue
#2270) by @aditmeno in #2290
* test: add integration test for issue #2291 (CRD preservation
with strategicMergePatches) by @aditmeno in #2292
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.32.1 to 1.32.2 by @dependabot[bot] in #2300
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
from 1.92.0 to 1.92.1 by @dependabot[bot] in #2299
* fix: resolve issues #2295, #2296, and #2297 by @aditmeno
in #2298
* build(deps): update Helm v4 to 4.0.1 and helm-secrets to
4.7.4 by @aditmeno in #2304
* feat: add print-env command by @dschmidt in #2279
- Update to version 1.2.1:
* build(deps): bump azure/setup-helm from 4.3.0 to 4.3.1 by
@dependabot[bot] in #2274
* build(deps): bump github.com/helmfile/vals from 0.42.4 to
0.42.5 by @dependabot[bot] in #2272
* build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0
by @dependabot[bot] in #2277
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.90.2 to 1.91.1 by @dependabot[bot] in #2284
* Fix four critical issues: environment merging, kubeVersion
detection, lookup() with kustomize, and Helm 4 color flags by
@aditmeno in #2276
* build(deps): bump go.uber.org/zap from 1.27.0 to 1.27.1 by
@dependabot[bot] in #2283
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.31.20 to 1.32.0 by @dependabot[bot] in #2282
* build(deps): bump actions/checkout from 5 to 6 by
@dependabot[bot] in #2287
* build(deps): bump k8s.io/client-go from 0.34.1 to 0.34.2 by
@dependabot[bot] in #2285
* Fix four critical bugs: array merging (#2281), AWS SDK logging
(#2270), helmDefaults skip flags (#2269), and OCI chart versions
(#2247) by @aditmeno in #2288
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.91.1 to 1.92.0 by @dependabot[bot] in #2286
- Update to version 1.2.0:
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.31.15 to 1.31.16 by @dependabot[bot] in #2242
* build(deps): bump github.com/hashicorp/go-getter from 1.8.2
to 1.8.3 by @dependabot[bot] in #2241
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.89.0 to 1.89.1 by @dependabot[bot] in #2240
* build(deps): bump github.com/containerd/containerd from 1.7.28
to 1.7.29 by @dependabot[bot] in #2249
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.89.1 to 1.90.0 by @dependabot[bot] in #2248
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.31.16 to 1.31.17 by @dependabot[bot] in #2245
* build(deps): bump golang.org/x/sync from 0.17.0 to 0.18.0 by
@dependabot[bot] in #2251
* build(deps): bump golangci/golangci-lint-action from 8 to 9 by
@dependabot[bot] in #2250
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.31.17 to 1.31.18 by @dependabot[bot] in #2253
* build(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 by
@dependabot[bot] in #2256
* build(deps): bump github.com/aws/aws-sdk-go-v2/config from
1.31.18 to 1.31.20 by @dependabot[bot] in #2259
* perf(app): Parallelize helmfile.d rendering and eliminate chdir
race conditions by @aditmeno in #2261
* build(deps): bump k8s.io/apimachinery from 0.34.1 to 0.34.2 by
@dependabot[bot] in #2264
* Issue-1883 fix by @zhaque44 in #2058
* feat: add Helm 4 support while maintaining Helm 3 compatibility
by @aditmeno in #2262
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.90.0 to 1.90.2 by @dependabot[bot] in #2258
</description>
<package>helmfile</package>
</patchinfo>

View File

@@ -1,72 +0,0 @@
<patchinfo incident="packagehub-93">
<issue tracker="cve" id="2025-58058"/>
<issue tracker="cve" id="2025-47911"/>
<issue tracker="cve" id="2025-58190"/>
<issue tracker="bnc" id="1251399">VUL-0: CVE-2025-47911: sbctl: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
<issue tracker="bnc" id="1251609">VUL-0: CVE-2025-58190: sbctl: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input</issue>
<issue tracker="bnc" id="1248949">VUL-0: CVE-2025-58058: sbctl: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory</issue>
<packager>jubalh</packager>
<rating>moderate</rating>
<category>security</category>
<summary>Security update for sbctl</summary>
<description>This update for sbctl fixes the following issues:
Changes in sbctl:
- Upgrade the embedded golang.org/x/net to 0.46.0
* Fixes: bsc#1251399, CVE-2025-47911: various algorithms with
quadratic complexity when parsing HTML documents
* Fixes: bsc#1251609, CVE-2025-58190: excessive memory consumption
by 'html.ParseFragment' when processing specially crafted input
- Update to version 0.18:
* logging: fixup new go vet warning
* workflows: add cc for cross compile
* workflow: add sudo to apt
* workflow: add pcsclite to ci
* workflow: try enable cgo
* go.mod: update golang.org/x/ dependencies
* fix: avoid adding bogus Country attribute to subject DNs
* sbctl: only store file if we did actually sign the file
* installkernel: add post install hook for Debian's traditional installkernel
* CI: missing libpcsclite pkg
* workflows: add missing depends and new pattern keyword
* Add yubikey example for create keys to the README
* Initial yubikey backend keytype support
* verify: ensure we pass args in correct order
- bsc#1248949 (CVE-2025-58058):
Bump xz to 0.5.14
- Update to version 0.17:
* Ensure we don't wrongly compare input/output files when signing
* Added --json supprt to sbctl verify
* Ensure sbctl setup with no arguments returns a helpful output
* Import latest Microsoft keys for KEK and db databases
* Ensure we print the path of the file when encountering an invalid PE file
* Misc fixups in tests
* Misc typo fixes in prints
- Update to version 0.16:
* Ensure sbctl reads --config even if /etc/sbctl/sbctl.conf is
present
* Fixed a bug where sbctl would abort if the TPM eventlog
contains the same byte multiple times
* Fixed a landlock bug where enroll-keys --export did not work
* Fixed a bug where an ESP mounted to multiple paths would not be
detected
* Exporting keys without efivars present work again
* sbctl sign will now use the saved output path if the signed
file is enrolled
* enroll-keys --append will now work without --force.
- Updates from version 0.15.4:
* Fixed an issue where sign-all did not report a non-zero exit
code when something failed
* Fixed and issue where we couldn't write to a file with landlock
* Fixed an issue where --json would print the human readable
output and the json
* Fixes landlock for UKI/bundles by disabling the sandbox feature
* Some doc fixups that mentioned /usr/share/
</description>
<package>sbctl</package>
</patchinfo>

View File

@@ -1,63 +0,0 @@
<patchinfo incident="packagehub-98">
<packager>os-autoinst-obs-workflow</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for openQA, os-autoinst, openQA-devel-container</summary>
<description>This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:
Changes in openQA:
- Update to version 5.1769068942.639067ee:
* Dependency cron 2026-01-22
* feat: Show limits on "Next &amp; Previous" tab within table
- Update to version 5.1768996386.e3f58202:
* fix: Avoid Perl warning if product spec contains undef values
* GenericBug: Add [QE] to the subject
* doc: Mention version lookup of mediums and special value `*`
* doc: Wrap section about medium types consistently at 80 characters
* doc: Remove surplus white-space
* chore: Improve indentation/wrapping of comment
* feat: Improve error message when product contains no templates
* tests: Improve/add tests for "no products found" case
* KernelBug: Extend the kernel bug template
* feat: Improve error message when falling back to version `*`
- Update to version 5.1768856318.847e4fc7:
* fix(systemd): prevent openqa-gru starting while mounts are unavailable
* fix(systemd): try restarts on failure to be more resilient
* feat: Show when "Next &amp; Previous" jobs are limited
* refactor: Format SQL code for "Next &amp; Previous" jobs more nicely
* refactor: Simplify determining latest job in "Next &amp; Previous" list
- Update to version 5.1768402729.462b3957:
* feat: optionally configure fake auth key+secret+expiration
Changes in os-autoinst:
- Update to version 5.1769153586.72cabd0:
* Replace remaining functions with subroutine signatures in 18-qemu.t
* Fix snapshot overlay mechanism to avoid duplication
* fix(dist): provide proper copyright headers in all spec-files
* fix(dist): try to fix os-autoinst-obs-auto-submit reverting content
* fix(dist): exclude unstable t/28-signalblocker.t in OBS checks
* Add documentation of APPEND variable
* Add undocumented KERNEL/INITRD to the supported variables
* os-autoinst-generate-needle-preview: Embed PNG
Changes in openQA-devel-container:
- Update to version 5.1769167363.fd9ad8d88:
* Update to latest openQA version
</description>
<package>openQA</package>
<package>openQA:openQA-devel-test</package>
<package>openQA:openQA-test</package>
<package>openQA:openQA-worker-test</package>
<package>openQA:openQA-client-test</package>
<package>os-autoinst</package>
<package>os-autoinst:os-autoinst-test</package>
<package>os-autoinst:os-autoinst-devel-test</package>
<package>os-autoinst:os-autoinst-openvswitch-test</package>
<package>openQA-devel-container</package>
</patchinfo>

View File

@@ -1,13 +0,0 @@
<patchinfo incident="packagehub-95">
<packager>letsfindaway</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for OpenBoard</summary>
<description>This update for OpenBoard fixes the following issues:
Changes in OpenBoard:
- update to release version 1.7.4
</description>
<package>OpenBoard</package>
</patchinfo>

View File

@@ -1,16 +0,0 @@
<patchinfo incident="packagehub-97">
<packager>os-autoinst-obs-workflow</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for os-autoinst-distri-opensuse-deps</summary>
<description>This update for os-autoinst-distri-opensuse-deps fixes the following issues:
Changes in os-autoinst-distri-opensuse-deps:
- Added dependency perl(Inline::Python)
- Added dependency mkisofs
- Added dependency jq
- Added dependency gzip
</description>
<package>os-autoinst-distri-opensuse-deps</package>
</patchinfo>

View File

@@ -1,126 +0,0 @@
<patchinfo incident="packagehub-99">
<packager>DocB</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for tryton, trytond, gnuhealth, trytond_account, gnuhealth-client, proteus, python-PyWebDAV3-GNUHealth, trytond_account_invoice, trytond_party, trytond_product, trytond_purchase, trytond_stock, trytond_stock_lot, trytond_stock_supply</summary>
<description>This update for tryton, trytond, gnuhealth, trytond_account, gnuhealth-client, proteus, python-PyWebDAV3-GNUHealth, trytond_account_invoice, trytond_party, trytond_product, trytond_purchase, trytond_stock, trytond_stock_lot, trytond_stock_supply fixes the following issues:
Changes in tryton:
- Version 7.0.31 - Bugfix Release
- Version 7.0.29 - Bugfix Release
Changes in trytond:
- Version 7.0.44 - Bugfix Release
- Version 7.0.43 - Bugfix Release
- Version 7.0.42 - Bugfix Release
- Version 7.0.40 - Bugfix Release
- Version 7.0.38 - Bugfix Release
- Version 7.0.37 - Bugfix Release
- Version 7.0.36 - Security Release for issue #14220
- Version 7.0.35 - Bugfix Release
- Version 7.0.34 - Bugfix Release
- Version 7.0.33 - Bugfix Release
Changes in gnuhealth:
- version 5.0.5
* optimizations to language files
* various fixes
* install_demo_database.sh added
- version 5.0.2
* inconsistent naming of package and directories, switch to local copy
* gnuhealth.keyring removed due to local copy
* Remove unused dependencies from health module
* Wrong cursor field teeth (dentistry module)
* remove pillow dependency from lab and dentistry
Changes in trytond_account:
- Version 7.0.23 - Bugfix Release
- Version 7.0.22 - Bugfix Release
- Version 7.0.21 - Bugfix Release
Changes in gnuhealth-client:
- version 5.0.1
* Fix issue #11. default settings for federation.gnhealth.org not working
* allow Python 3.14
Changes in proteus:
- Version 7.0.3 - Bugfix Release
- Version 7.0.2 - Bugfix Release
Changes in python-PyWebDAV3-GNUHealth:
- version 0.13.0
* no changelog provided
* source file renamed
Changes in trytond_account_invoice:
- Version 7.0.14 - Bugfix Release
Changes in trytond_party:
- Version 7.0.7 - Bugfix Release
Changes in trytond_product:
- Version 7.0.3 - Bugfix Release
Changes in trytond_purchase:
- Version 7.0.16 - Bugfix Release
- Version 7.0.15 - Bugfix Release
Changes in trytond_stock:
- Version 7.0.16 - Bugfix Release
- Version 7.0.15 - Bugfix Release
- Version 7.0.14 - Bugfix Release
Changes in trytond_stock_lot:
- Version 7.0.5 - Bugfix Release
- Version 7.0.4 - Bugfix Release
Changes in trytond_stock_supply:
- Version 7.0.5 - Bugfix Release
</description>
<package>tryton</package>
<package>trytond</package>
<package>gnuhealth</package>
<package>trytond_account</package>
<package>gnuhealth-client</package>
<package>proteus</package>
<package>python-PyWebDAV3-GNUHealth</package>
<package>trytond_account_invoice</package>
<package>trytond_party</package>
<package>trytond_product</package>
<package>trytond_purchase</package>
<package>trytond_stock</package>
<package>trytond_stock_lot</package>
<package>trytond_stock_supply</package>
</patchinfo>

View File

@@ -1,12 +0,0 @@
<patchinfo>
<packager>eroca</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for cni, cni-plugins</summary>
<description>This update for cni, cni-plugins fixes the following issues:
Introduce cni and cni-plugins.
</description>
<package>cni</package>
<package>cni-plugins</package>
</patchinfo>

Submodule proteus updated: 5ce25694d3...138e8be577

Submodule python-augeas deleted from edad9ed486

Submodule python-bson deleted from 8ac5655845

Submodule python-jsonlines deleted from 71ed37f7af

Submodule python-localzone deleted from 9542dae7a4

Submodule python-softlayer deleted from 6ff6f97894

2
ranger

Submodule ranger updated: 4d06d462ce...c408907879

2
sbctl

Submodule sbctl updated: ff582da4e2...c8315ff856

Some files were not shown because too many files have changed in this diff Show More