Packages changed:
  MicroOS-release (20261018 -> 20261020)
  adobe-sourcecodepro-fonts (2.038 -> 2.042)
  cups (2.4.19 -> 2.4.20)
  dnf5
  gstreamer-plugins-bad
  kscreenlocker6
  ldacBT (2.0.2.5 -> 2.0.2.6)
  lerc (4.1.0 -> 4.2.0)
  libaom (3.13.1 -> 3.15.2)
  libconfig (1.8.1 -> 1.8.2)
  libzip (1.11.4 -> 1.12.1)
  live555 (2026.10.13 -> 2026.10.17)
  mozilla-nss (3.129 -> 3.130)
  ntfs-3g_ntfsprogs (2026.7.7 -> 2026.9.28)
  polkit (127 -> 128)
  sdbootutil (1+git20260929.26b6989 -> 1+git20261007.53bc127)
  selinux-policy (20261014 -> 20261019)
  systemd (261.3 -> 261.4)
  upower (1.91.4 -> 1.91.5)
  vlc

=== Details ===

==== MicroOS-release ====
Version update (20261018 -> 20261020)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== adobe-sourcecodepro-fonts ====
Version update (2.038 -> 2.042)

- Update to version 2.042 (uprights) / 1.062 (italics) / 1.026 (variable):
  * Re-compiled so static instances correspond to the Variable Font versions
- Drop obsolete Group and BuildRoot tags

==== cups ====
Version update (2.4.19 -> 2.4.20)
Subpackages: cups-client cups-config libcups2 libcupsimage2

- fix_mailto_validation.patch is
  "Fix: mailto notifier rejects valid email addresses
  containing dots"
  https://github.com/OpenPrinting/cups/pull/1745
  "Regression: mailto notifier rejects valid email addresses
  containing dots/periods"
  https://github.com/OpenPrinting/cups/issues/1744
- Version upgrade to 2.4.20:
  See https://github.com/openprinting/cups/releases
  CUPS 2.4.20 provides amount of bug fixes and security fixes:
  Assigned CVE ids:
  CVE-2025-55480 (bsc#1284277)
  CVE-2026-61702 (bsc#1284278)
  CVE-2026-87875 (bsc#1279945)
  CVE-2026-87876 (bsc#1279944)
  CVE-2026-55453 (bsc#1284275)
  CVE-2026-55467 (bsc#1284276)
  CVE-2026-105326 (bsc#1284274)
  Several fixes use GHSA id of security advisory
  due long waiting time for CVE ids from CNA.
  Due our changed policy the fixes referencing GHSA id are for:
  * vulnerabilities with CVSS < 7.0, which we take
    as lower priority vulnerabilities,
  * issues which require print admin rights for triggering them,
  * issues where its fix is security hardening patch/feature.
  Per our security policy, issues which require print admin rights,
  or are security hardening patches, are not taken as vulnerability
  and they reference a security advisory due convenience, see
  https://github.com/OpenPrinting/cups?tab=security-ov-file
  More details in CHANGES.md - excerpts:
  * SECURITY-5.7: The scheduler did not open temporary PPD files
    in exclusive mode (CVE-2026-55480)
  * SECURITY-5.5: The scheduler did not remove all job status
    attributes from a job creation request (GHSA-7j85-5r23-xhvh)
  * SECURITY-5.3: The scheduler did not validate the request
    language value (CVE-2026-61702)
  * SECURITY-4.6: Attribute names were not validated
    as proper keyword values (GHSA-w9hj-hq9p-m7f6)
  * SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly
    treated UTF-32 values as 64-bit (CVE-2026-87875)
  * SECURITY-4.1: Held jobs for temporary print queues could
    crash the scheduler (GHSA-qqm8-4q5h-jg55)
  * SECURITY-3.3: The backend did not sanitize IPP attribute
    strings (CVE-2026-55453)
  * SECURITY-3.3: The scheduler did not filter out group separators
    from job submissions (GHSA-wjc4-qhjr-5m5x)
  * SECURITY-3.0: Quota and policy operations did not treat
    usernames as case-sensitive (CVE-2026-87876)
  * SECURITY-3.0: The scheduler's startup permission checks
    were vulnerable to TOU attacks (GHSA-gj33-wxpv-6fgg)
  * SECURITY-2.5: The scheduler did not sanitize
    fax numbers (CVE-2026-55467)
  * SECURITY-2.5: The 'mailto' notifier did not sanitize
    the recipient address provided to the sendmail
    command (CVE-2026-105326)
  * SECURITY-2.3: The scheduler could crash when modifying
    a class (GHSA-pwg4-pv39-8c22)
  * Fixed handling of multiple PPD: keywords from filters
    (Issue #1562, related to CVE-2026-34980)
  Issues are those at https://github.com/OpenPrinting/cups/issues
- Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.20
- cups-2.4.19-CVE-2026-87875.patch
  is no longer needed because the issue is fixed upstream.
- avoid_C99_loop_initial_declarations.patch avoids
  "ppd-cache.c:2173:5: error: 'for' loop initial declarations
  are only allowed in C99 mode"
  which happens when building CUPS 2.4.20 on older SLE12
  https://github.com/OpenPrinting/cups/issues/1742

==== dnf5 ====
Subpackages: libdnf5-plugin-appstream libdnf5_2

- Own zsh-completion dirs.

==== gstreamer-plugins-bad ====
Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0

- Drop pkgconfig(webrtc-audio-coding-1) BuildRequires: Not needed
  nor used since 1.26.0.
- Replace pkgconfig(webrtc-audio-processing-1) with
  pkgconfig(webrtc-audio-processing-2) BuildRequires: Use current
  upstream preferd version of webrtc-audio-processing.

==== kscreenlocker6 ====
Subpackages: kscreenlocker6-imports libKScreenLocker6

- Update to respun 6.8.0 tarball that may avoid some authentication
  issues:
  * greeter: do not defer locked check to authenticator objects
  * worker: drop time check (kde#526194)

==== ldacBT ====
Version update (2.0.2.5 -> 2.0.2.6)

- Update to 2.0.2.6: no functional changes, upstream only
  re-shipped the bundled libldac tarball in the release
- Spec cleanup via spec-cleaner

==== lerc ====
Version update (4.1.0 -> 4.2.0)

- Update to version 4.2.0
  * Enforce size limits: input data and compressed blob limited to
    2 GB per band and 4 GB over all bands; oversized dimensions now
    report a new DimensionsTooLarge error instead of risking
    integer overflows from bogus blob headers
  * Coverity fixes and overflow checks
  * 4.1.1: fixed two security issues and minor bugs (no CVE IDs
    assigned upstream)
- Refresh pylerc-use-syslib.patch for the 4.2.0 sources
- Drop Group tag (spec-cleaner run)

==== libaom ====
Version update (3.13.1 -> 3.15.2)

- Update to version 3.15.2 (ABI compatible, soname unchanged):
  * 3.14.0: layered-image compression/quality gains, external rate
    control API (experimental), new tuning modes and codec controls.
  * 3.15.0: force-max-q option, low-complexity VOD decode mode,
    IntraBC RTC improvements, VMAF/PSNR and speed work.
  * 3.15.1/3.15.2: encoder bug fixes.
  * Security fixes:
  - CVE-2026-56208: heap-buffer-overflow in AV1 encoder LAP mode
    (boo#1268650)
  - CVE-2026-56209: bounds-check bypass in AV1E_SET_SVC_LAYER_ID
    (boo#1268651)
  - CVE-2026-56210: OOB heap read via unchecked SVC layer_id
    (boo#1268653)
  - CVE-2026-56211: out-of-range SVC layer selection
    (boo#1268655)
  - CVE-2026-13906: heap OOB read in
    av1_int_pro_motion_estimation
- Drop libaom-0001-Do-not-disable-_FORTIFY_SOURCE.patch:
  upstream no longer forces _FORTIFY_SOURCE=0.
- Rebase system-gtest.patch, libaom-cmake.patch to restructured
  cmake/ tree.
- Modernize spec file (drop Group tags).

==== libconfig ====
Version update (1.8.1 -> 1.8.2)
Subpackages: libconfig++15 libconfig15

- Update to release 1.8.2
  * Minor documentation updates

==== libzip ====
Version update (1.11.4 -> 1.12.1)

- update to 1.12.1:
  * Protect against denial of service attack
  (GHSA-m3wq-j48p-jxwh, actually fixed in 1.12)
  * Fix compile issues.
  * Fix adding and replacing files in torrentzip archives
  * Fix error handling in zip_source_filep_create()
- update to 1.12:
  * Keep order of local extra fields, even if an identical extra
    field is present in the central directory
  * Add zip_source_at_eof() and ZIP_SOURCE_AT_EOF
  * Consistently report CRC and decryption errors when reading
    exactly to end-of-file.
  * Remove Mbed TLS support - the required functions were made
    private
  * Securely clear passwords and key material before freeing it
  * Use SipHash hash function with per-table random keys. This
    prevents hash flooding attacks
  * Add compile time option to limit LZMA window size
  * Add more comprehensive fuzzers for metadata and write code
    paths
  * Fix zip_source_is_seekable()
  * Fix setting incorrect WinZIP AES version in some cases
  * Further improvements to overall stability and other minor
    adjustments have been made

==== live555 ====
Version update (2026.10.13 -> 2026.10.17)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia120

- Update to version 2026.10.17:
  * Matroska: guard the AAC codec-private config string allocation
    against oversized values (boo#1254419, CVE-2025-65406).
  * BasicTaskScheduler: honor FD_SETSIZE in the select loop instead
    of a hardcoded descriptor limit.
  * Spec cleanup: drop obsolete Group tags, use %make_build.

==== mozilla-nss ====
Version update (3.129 -> 3.130)
Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs

- update to NSS 3.130
  * bmo#2072042 - selfserv: drain connections before closing
  * bmo#2072396 - reduce core file detection frequency in CI runs
  * bmo#2074429 - applied clang-format on nss
  * bmo#2074515 - Include blapit.h to expose AES_BLOCK_SIZE and SHA_*_LENGTH
  * bmo#2073728 - remove some unused types and functions from lib/pki
  * bmo#2012680 - Testcases for DER_GetInteger error handling
  * bmo#2054712 - Don't accept post-handshake CertificateRequest in DTLS
  * bmo#1951159 - release the decoded certificate when
    CERT_NewTempCertificate fails
  * bmo#2072384 - remove unnecessary certs dependencies in CI graph
  * bmo#2072554 - add missing return in do_key_slot when no internal key slot
  * bmo#2072682 - initialize referenceCount in crlutil's CRL allocations
  * bmo#2072682 - take a reference in cmsutil's CMS decrypt-key callback
  * bmo#2072682 - release-assert softoken session and db reference counts
  * bmo#2072682 - release-assert stan object reference counts
  * bmo#2072682 - release-assert pk11wrap slot, module and symkey
    reference counts
  * bmo#2072682 - release-assert SSL reference counts
  * bmo#2072682 - release-assert CRL and GeneralNameList reference counts
  * bmo#2072682 - free never-live symkeys directly in pk11_getKeyFromList
  * bmo#2072682 - abort on detected key object double frees
  * bmo#2072633 - return CKR_HOST_MEMORY when PORT_NewArena fails in
    jpakesftk.c
  * bmo#2072389 - fix uninitialized SECItem.type in SECKEY_ConvertToPublicKey
  * bmo#2047359 - propagate the PKCS#12 max element length to nested decoders
  * bmo#2068001 - Switch NSS to WIN95 target and remove Windows fiber code
  * bmo#2030245 - Add Windows ARM64 build support to NSS
  * bmo#2019001 - Update policy for mlkem1024 named group and others
  * bmo#2061391 - perform session object removals under slot lock
  * bmo#2028690 - Keep the default input size limit in
    NSS_CMSMessage_CreateFromDER
  * bmo#2028690 - Thread element limits through the QuickDER decoder and
    raise them for CRLs
  * bmo#2028690 - Limit ASN.1 group element count and total streamed input
  * bmo#2028690 - Add SEC_QuickDERDecodeItemWithLimits
  * bmo#2028690 - Place a default size limit on ASN.1 decoder inputs
  * bmo#1951159 - populate NSSCertificate::id at creation
  * bmo#2064306 - avoid VLA in tls_ech_unittest.cc
  * bmo#2070118 - Change the error from decode_error to illegal_parameter
    for the case when update field in Key Update is neither
    update_requested nor update_not_requested
  * bmo#2064311 - Remove HPKE internals from public headers
  * bmo#2064306 - HPKE P-256 and P-384 KEMs
  * bmo#2070669 - NSS release process improvements
  * bmo#2070421 - Set _NSPR_BUILD_ for Windows builds
  * bmo#2064502 - add tsan build for NSS in treeherder
- fix LD_LIBRARY_PATH setting to not include the current wd

==== ntfs-3g_ntfsprogs ====
Version update (2026.7.7 -> 2026.9.28)
Subpackages: ntfs-3g ntfsprogs

- Update to version 2026.9.28 (including the 2026.9.18 security
  release; CVEs for its fixes are still pending, tracked by boo#):
  * Heap out-of-bounds read/write in ntfs_ie_add_vcn (boo#1281763),
    heap data corruption in ntfs_mapping_pairs_decompress
    (boo#1281762), heap buffer overflows in ntfs_external_attr_find
    (boo#1281761), ntfs_ea_check_wsldev (boo#1281760),
    ntfs_check_restart_area (boo#1281759), ntfs_same_sid
    (boo#1281757) and ntfs_acl_owner (boo#1281756), and
    denial-of-service in ntfs_inode_attach_all_extents (boo#1281758).
  * Guard against multiple creator-owner and creator-group ACEs
    during ACL inheritance; fix stale $MFTMirr data in ntfsresize.
  * Fix MST-fixup return-value regression, ntfslabel options
    starting with '-', and use-after-free/improper realloc cases.
- Drop patches adopted upstream:
  * 1_ntfs-3g_2026.7.7-SA_2026-06-1_05.patch
  * 2_ntfs-3g_2026.7.7-SA_2026-06-1_07.patch
  * 3_ntfs-3g_2026.7.7-SA_2026-06-1_08.patch
  * 4_ntfs-3g_2026.7.7-SA_2026-06-1_10.patch
  * 5_ntfs-3g_2026.7.7-SA_2026-06-1_11.patch
  * 6_ntfs-3g_2026.7.7-SA_2026-06-1_12.patch
  * 7_ntfs-3g_2026.7.7-SA_2026-06-1_19.patch
  * 8_ntfs-3g_2026.7.7-SA_2026-06-1_20.patch
- Soname bump: libntfs-3g.so.90 -> libntfs-3g.so.91.
- Spec cleanup: drop Group tags, use pkgconfig() BuildRequires,
  explicitly require gcc and make.
- Add CVE patch bundle:
  * bsc#1281763: 1_ntfs-3g_2026.7.7-SA_2026-06-1_05.patch
  * bsc#1281762: 2_ntfs-3g_2026.7.7-SA_2026-06-1_07.patch
  * bsc#1281761: 3_ntfs-3g_2026.7.7-SA_2026-06-1_08.patch
  * bsc#1281760: 4_ntfs-3g_2026.7.7-SA_2026-06-1_10.patch
  * bsc#1281759: 5_ntfs-3g_2026.7.7-SA_2026-06-1_11.patch
  * bsc#1281758: 6_ntfs-3g_2026.7.7-SA_2026-06-1_12.patch
  * bsc#1281757: 7_ntfs-3g_2026.7.7-SA_2026-06-1_19.patch
  * bsc#1281756: 8_ntfs-3g_2026.7.7-SA_2026-06-1_20.patch

==== polkit ====
Version update (127 -> 128)
Subpackages: libpolkit-agent-1-0 libpolkit-gobject-1-0 typelib-1_0-Polkit-1_0

- Update to version 128 (CVE-2026-4897 and CVE-2026-85498):
  * fix two authentication-helper input vulnerabilities (CVE-2026-4897
    bsc#1260859 and CVE-2026-85498 bsc#1278714).
  * Sanitize values written to syslog from authorization requests
  * Fix a use-after-free in the authentication agent's session handling
  * Revalidate the administrator behind cached auth_admin_keep authorizations
  * Fix agent cleanup races, resource leaks, and several error-path leaks
  * Support systemd watchdog notifications and locked system accounts with
    systemd 257+
  * Improve FreeBSD and Solaris portability, including tests without Linux user
    namespaces
  * Add a polkit-agent-helper manual page and expand contributor documentation
  * Remove the systemd service memory limits introduced in polkit 127
  * Updated translations.
- Update version dependencies according to meson.build.
- Drop patches fixed upstream:
  * 0001-Revert-memory-limits-in-systemd-unit-to-mitigate-mem.patch
  * 0001-CVE-2026-4897-getline-string-overflow.patch

==== sdbootutil ====
Version update (1+git20260929.26b6989 -> 1+git20261007.53bc127)
Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper sdbootutil-tukit

- Update to version 1+git20261007.53bc127:
  * doc: add raw-disk-image architecture document

==== selinux-policy ====
Version update (20261014 -> 20261019)
Subpackages: selinux-policy-targeted

- Update to version 20261019:
  * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095)
  * broaden ld.so.cache regex to include temporary files (bsc#1270243)

==== systemd ====
Version update (261.3 -> 261.4)
Subpackages: libsystemd0 libudev1 systemd-boot systemd-container udev

- Import commit f408418369c8d20f9025b39c03f4ece2a0ee7041 (merge of v261.4)
  This update includes the following fixes:
    a9f077a4f3 seccomp: also refuse sched_setattr() in RestrictRealtime= (bsc#1285434)
    1f8fca2185 nspawn: mask socket() arguments to 32 bits in the NETLINK_AUDIT filter (bsc#1284982)
    b9a6730266 seccomp: mask setns() nstype to 32 bits in RestrictNamespaces= (bsc#1284982)
    f739a5ac5a seccomp: mask socket() domain to 32 bits in RestrictAddressFamilies= (bsc#1284982)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/3255daee1572366b74fe92f002a3d60ecbb27103...f408418369c8d20f9025b39c03f4ece2a0ee7041
  Rebase 0001-Drop-or-soften-some-upstream-warnings.patch

==== upower ====
Version update (1.91.4 -> 1.91.5)
Subpackages: libupower-glib3

- Update to 1.91.5:
  * Prefer live sysfs threshold values over hwdb CHARGE_LIMIT
  * Keep keyboard backlight event IO active on ENODATA/EINTR
  * Hide device batteries that report being offline
  * Remove all BlueZ devices when the service vanishes
- Spec cleanup: drop obsolete Group tags, use pkgconfig()
  style BuildRequires

==== vlc ====
Subpackages: libvlc5 libvlccore9 vlc-noX vlc-plugins-desktop

- Add conditional for pkgconfig(vpl) BuildRequires and plugin,
  exclude %{arm} ppc64le %{ppc} s390x.
- Add conditional for pkgconfig(libnfs) BuildRequires and plugin,
  exclude %{arm}