Packages changed: Mesa Mesa-drivers MicroOS-release (20260914 -> 20260915) alsa bash-completion (2.12.0 -> 2.17.0) container-selinux (2.250.0 -> 2.251.0) cups glibc gvfs (1.60.2 -> 1.60.3) libgcrypt (1.12.3 -> 1.12.4) libpng16 librist (0.2.11 -> 0.2.20) newt opencv runc (1.4.3 -> 1.5.1) === Details === ==== Mesa ==== Subpackages: Mesa-libEGL1 Mesa-libGL1 libgbm1 - llvm23.patch: fix build with LLVM 23 - Enable the rocket Gallium driver (Rockchip NPUs) on aarch64 and build the Teflon TensorFlow Lite delegate; ship libteflon.so in new subpackage Mesa-teflon-delegate ==== Mesa-drivers ==== Subpackages: Mesa-dri Mesa-vulkan-device-select libvulkan_lvp - llvm23.patch: fix build with LLVM 23 - Enable the rocket Gallium driver (Rockchip NPUs) on aarch64 and build the Teflon TensorFlow Lite delegate; ship libteflon.so in new subpackage Mesa-teflon-delegate ==== MicroOS-release ==== Version update (20260914 -> 20260915) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== alsa ==== - Fix Denial of Service via off-by-one stack buffer overflow (CVE-2026-90781, bsc#1280204): 0001-Fix-theoretical-one-byte-buffer-overrun.patch 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch ==== bash-completion ==== Version update (2.12.0 -> 2.17.0) - update to 2.17.0: * Support -P prefix in _comp_compgen. * Add -f in _filedir to manually suffix / to directories. * New completions: free, fsnotifywait, fsnotifywatch, nload, tmux, fprintd-*, slabtop. * Vastly expanded 3rd-party fallback completion loaders (including asdf, caddy, cosign, delta, jj, just, k9s, tofu, tldr, trash-cli, uv, uvx, zola, and many others). * Added and updated file/archive associations (unzip, zipinfo, bsdtar, wine, xv) for .apk, .apkm, .apks, .xapk, .crx, .hap, .ipa, .vsix, .webp, .pnm, .ogx, .oga. * Enable .java filename completion for the java command. Complete commands and variable assignments in env. * Greatly expanded subcommand, protocol, and argument completions in ip, curl, openssl, ssh-keygen, ssh-keyscan, ssh-copy-id, tar, aptitude, coreutils, set, and others. * Support Python 3.13 versioned executables. * Bug Fixes: - Avoid nounset, localvar_inherit, and pathname expansion errors in various completions. - Always quote special characters in _filedir completions. - Correct cd pattern matching and cdable_vars validation. - Try calling magick for ImageMagick 7 in convert. - Fix remote file/path quoting and backslash issues in ssh, scp, rsync, and sshfs. - Improve BSD-style compatibility/arguments for openssl, patch, truncate, and rsync. - Bash 5.3 compatibility fixes (GLOBSORT and compgen -V). - Cache GNU tar help parsing for improved performance. - drop patches (already merged upstream): * tar-completion.patch * bug1246923.patch ==== container-selinux ==== Version update (2.250.0 -> 2.251.0) - Update to version 2.251.0: * Allow spc_t permissions for container_runtime_domain directory management * Allow sshd_session_t to launch containers * Add missing contexts for Docker's containerd-snapshotter * Add container_runtime_nnp_domtrans interface ==== cups ==== Subpackages: cups-client cups-config libcups2 libcupsimage2 - cups-2.4.19-CVE-2026-87875.patch is based on https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 adapted to CUPS 2.4.19 to fix CVE-2026-87875 "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq bsc#1279945 "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound can be reached via the SNMP supply-description parsing" ==== glibc ==== Subpackages: glibc-locale glibc-locale-base - strfmon-right-just.patch: stdlib: Fix right-justification in strfmon (CVE-2026-19499, bsc#1276892, BZ #34510) - tdelete-oob-write.patch: misc: Fix out-of-bounds array write in tdelete (CVE-2026-19542, bsc#1276946, BZ #34506) - sjisx-pending-char-reset.patch: iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117, bsc#1277921, BZ #34556) - eucjisx-pending-char-reset.patch: iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489, bsc#1277922, BZ #34568) - libio-fopen-ccs.patch: libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling (CVE-2026-18374, bsc#1277262, BZ #34574) - Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247). ==== gvfs ==== Version update (1.60.2 -> 1.60.3) Subpackages: gvfs-backends - Update to version 1.60.3: + CVE-2026-88924: admin: Set socket ownership before creation + trash: Fix metadata handling when restoring or emptying + dav: Fix response body leaks to prevent hangs + Some other fixes + Updated translations. - Add gvfs-CVE-2026-84268.patch: sftp: Clamp `read_reply` count to requested buffer size (bsc#1278158, CVE-2026-84268). - Add gvfs-CVE-2026-84270.patch: mtp: Validate read size returned by device (bsc#1278156, CVE-2026-84270). ==== libgcrypt ==== Version update (1.12.3 -> 1.12.4) - Update to 1.23.4: * Fix build problem with some compiler versions related to SM4 instructions * Fix padding in cSHAKE found by NIST ACVP conformance vectors * Fix RSA PSS handling of huge salt lengths * Validate the length of hashed input for RSA PSS * Improve RSA OAEP decoder correctnes by validating an all-zero padding ==== libpng16 ==== - Fix build on armv6 by really disabling neon support ==== librist ==== Version update (0.2.11 -> 0.2.20) - Update to 0.2.20: * Added support for Nettle 4.0 (bsc#1257934) * Enable the test suite. * Lots of new features, bug fixes and security audits between versions 0.2.11 and 0.2.20, for a full list of changes, see: - code.videolan.org/rist/librist/tags * Remove librist-const-correctness.patch fixed upstream * Add patches: - librist-EAP-headers.patch - librist-skip-multicast-tests-in-buildenvs.patch ==== newt ==== - Fix new home of the project - remove python2 support - remove dependency on old macros.python3 - drop rpmlintrc ==== opencv ==== - Enable jxl and avif support - python-opencv requires python-numpy ==== runc ==== Version update (1.4.3 -> 1.5.1) - Require libpathrs >= 0.2.6 to resolve panic errors in the failure path of user code execution. - Update to 1.5.1. Upstream changelog is available from . - libpathrs is now used by default in runc. Though still optional, we enable it for our builds because it provides better security hardening and upstream currently plans to make it required by runc 1.6.