Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20260615 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: grub2 libstorage-ng (4.5.330 -> 4.5.331) mozilla-nss (3.123.1 -> 3.124) openSUSE-release (20260613 -> 20260615) perl-Crypt-OpenSSL-RSA (0.370.0 -> 0.410.0) perl-Net-DNS (1.540.0 -> 1.550.0) perl-Net-SSLeay (1.940.0 -> 1.960.0) python-certifi (2026.4.22 -> 2026.5.20) python-decorator (5.3.0 -> 5.3.1) python-pygit2 (1.19.2 -> 1.19.3) python-tornado6 (6.5.5 -> 6.5.7) python-zope.event (6.1 -> 6.2) === Details === ==== grub2 ==== Subpackages: grub2-arm64-efi grub2-arm64-efi-bls grub2-common grub2-snapper-plugin grub2-systemd-sleep-plugin - Fix the potential crash when enabling hardware acceleration for libgcrypt * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch - Fix 00-grub script deletes snapshot directory (bsc#1267884) * grub2-snapper-plugin.sh ==== libstorage-ng ==== Version update (4.5.330 -> 4.5.331) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#1079 - fixed error message - 4.5.331 ==== mozilla-nss ==== Version update (3.123.1 -> 3.124) Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-tools - update to NSS 3.124 * bmo#2032562 - Add test for PKCS7 digest array alignment. * bmo#2030093 - Add test for rejection of excessively large ASN.1 SEQUENCE OF in quickder. * bmo#2030994 - Add test for CMS content size validation. * bmo#2030995 - Add regression tests for DSAU signature decoding. * bmo#2031030 - Add test for S/MIME profile lookup on temp certs. * bmo#2031343 - Test case for post-handshake auth and many certificate requests. * bmo#2019233 - Add test for intra-arena ASan redzones. * bmo#2033058 - update nss_status flags one at a time. * bmo#2029803 - add defensive info->len check in PK11_HPKE_SetupS and PK11_HPKE_SetupR. * bmo#2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken. * bmo#2020596 - add runtime check on decoded resumption token session id. * bmo#2035882 - improve mach try error handling. * bmo#2030798 - clang format. * bmo#2030798 - add comprehensive SECItem and SECItemArray tests. * bmo#2033058 - add bugzilla_cf_status_nss.py script. * bmo#2033057 - regenerate some recent release notes. * bmo#2033057 - fix bug list output by release note and email scripts. * bmo#2031190 - test removal from trust domain email cache. * bmo#2033208 - fix "testing if key corruption is detected in attribute" failures with sqlite-3.53.0. * bmo#2035348 - build sqlite3 shell for Windows CI runners. * bmo#2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI * bmo#2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test. * bmo#2034258 - add CLAUDE.md and .mcp.json. * bmo#2034244 - add a mach try command. * bmo#2031042 - remove dead condition in sec_asn1d_check_and_subtract_length * bmo#2030374 - avoid integer truncation in nssCKObject_GetAttributes * bmo#2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf * bmo#2029765 - avoid refcount over-release in nssTokenObjectCache error path [@ nssToken_Destroy]. * bmo#2029883 - sdb: enforce that metaData's id key is unique when reading * bmo#2023478 - improve handling of escape sequences in pk11uri_ParseAttributes * bmo#2030570 - use correct data for ID comparison in transfer_uri_certs_to_collection * bmo#2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit. * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max. * bmo#2034157 - set previous-nss-release for abicheck. * bmo#2032389 - Skip `PR_Sleep` yield for non-blocking sockets in `ssl3_SendApplicationData`. * bmo#2033650 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock * bmo#2030985 - Remove CRMF from testing and manifests. * bmo#2026711 - Remove unused RSA blind signature implementation from freebl - add explicit sqlite3 BuildRequires to fix tests ==== openSUSE-release ==== Version update (20260613 -> 20260615) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== perl-Crypt-OpenSSL-RSA ==== Version update (0.370.0 -> 0.410.0) - Rebase Crypt-OpenSSL-RSA.patch - updated to 0.410.0 (0.41) see /usr/share/doc/packages/perl-Crypt-OpenSSL-RSA/Changes ==== perl-Net-DNS ==== Version update (1.540.0 -> 1.550.0) - updated to 1.550.0 (1.55) see /usr/share/doc/packages/perl-Net-DNS/Changes ==== perl-Net-SSLeay ==== Version update (1.940.0 -> 1.960.0) - Remove test-32_x509_get_cert_info-allow-single-colon.patch (fixed upstream) - updated to 1.960.0 (1.96) see /usr/share/doc/packages/perl-Net-SSLeay/Changes 1.96 2026-03-21 - New stable release incorporating all changes from developer releases 1.95_01 to 1.95_03. - Summary of major changes since version 1.94: - Net::SSLeay now officially supports all stable releases of OpenSSL 3.3 - 3.6 and LibreSSL 3.9 - 4.2, including the vendor-supplied version of OpenSSL 3 on VMS. - Several libssl functions allowing for the control of supported signature algorithms are now exposed. 1.95_03 2026-03-20 - In 67_sigalgs.t, load the certificates and keys before forking to avoid a failure on MSWin32. 1.95_02 2026-03-18 - Support SSL_CTX_set1_sigalgs_list and SSL_CTX_set1_client_sigalgs_list. Contributed by Wes Malone. - Support SSL_set1_sigalgs_list, SSL_set1_client_sigalgs_list, SSL_get_sigalgs and SSL_get_shared_sigalgs, and add the function SSL_CTX_set_cert_cb. - Add test file 67_sigalgs.t for the sigalgs functions. 1.95_01 2026-02-05 - Skip NPN tests when NPN is disabled in OpenSSL instead o assuming NPN is always enabled. Reported by GitHub user dilyanpalauzov ÐилÑн ÐалаÑзов. - Update GitHub Actions CI workflow. A number of test jobs were broken because some GitHub runners were discontinued, changes in QEMU setup, changes in Cygwin, etc. - Adjust test 32_x509_get_cert_info.t to match formatting changes in OpenSSL 3.4.0 and 3.4.1. Thanks to Sebastian Andrzej Siewior for the patches. - OpenSSL 3.9.0 and later remove EVP_add_digest(). Thanks to Derrik Pates for the report and patch. - Increase timeout in 62_threads-ctx_new-deadlock.t to allow the test to pass on very slow platforms. - Add missing documentation for STACK_OF() free functions sk_X509_free and sk_X509_INFO_free. Contributed by Marc Reisner - Add $prefx/lib/64 to lib paths in Makefile.PL for Illumos. Contributed by Marcel Telka. - Support vendor-supplied OpenSSL 3.x on VMS and update %ENV modification in test 10_rand.t to work on VMS. Contributed by Craig Barry. - Compiler -D switches Makefile.PL sets are no longer added to the MakeMaker CCFLAG attribute because of portability reasons. The switches are now passed either via WriteMakefile() or appending them to 'perl Makefile.PL ...' DEFINE argument. CCFLAG problem diagnosed by Craig Barry. Fixes by Craig Barry and Heikki Vatiainen. - Update GitHub Actions CI testing: - Perl on Ubuntu 24.04: Add Perl 5.38, 5.40 and 5.42, add OpenSSL 3.3, 3.4 and 3.5 minor releases, add LibreSSL 3.9, 4.0 and 4.1 release branches. - Alpine Linux: Remove 3.15, 3.16 and 3.17. Add 3.19, 3.20, 3.21 and 3.22. - Freebsd: Add 14.3 and replace 13.2 with 13.5. - OpenBSD: Add 7.6 and 7.7. Remove 7.2 and 7.3. - NetBSD: Add 10.1 and replace 9.3 with 9.4. - Update test 62_threads-ctx_new-deadlock.t to work with LibreSSL 4.1.0. ==== python-certifi ==== Version update (2026.4.22 -> 2026.5.20) Subpackages: python311-certifi python313-certifi - update to 2026.5.20: * remove O=Chunghwa Telecom Co., Ltd. OU=ePKI Root Certification Authority ==== python-decorator ==== Version update (5.3.0 -> 5.3.1) - update to 5.3.1: * Added license SPDX identifier to pyproject.toml (reported by * Christian Lackas). ==== python-pygit2 ==== Version update (1.19.2 -> 1.19.3) - update to 1.19.3: * Memory fixes #1368 #1417 #1443 * Fix Repository.ident #1461 * Documentation and annotation fixes #410 #1289 #1323 #1333 #1458 #1460 ==== python-tornado6 ==== Version update (6.5.5 -> 6.5.7) - Update to 6.5.7: [#]# Security fixes * CurlAsyncHTTPClient now fully resets the curl object before reusing it. This prevents incorrectly reusing options from a previous request, specifically including client SSL and credentials used for accessing proxies. * SimpleAsyncHTTPClient now strips the Authorization and Cookie headers from the request when following a redirect to a different origin. This matches the default behavior of CurlAsyncHTTPClient. Applications that need different behavior here can set follow_redirects=False and handle redirects manually. CVE-2026-49853 * SimpleAsyncHTTPClient now enforces max_body_size on the decompressed size of the response, rather than the compressed size. This prevents a denial-of-service attack via a very large compressed response. CVE-2026-49855 * Fixed a bug in the C extension that could have read up to three bytes past the end of an input array. CVE-2026-49854 * OpenIDMixin has improved parsing for the check_authentication response. [#]# Bug fixes * CurlAsyncHTTPClient has been updated to use non-deprecated APIs, avoiding deprecation warnings with recent versions of pycurl. - Refreshed patch ignore-resourcewarning-doctests.patch - Drop patch fix-tests-with-curl-8-19.patch, merged upstream. ==== python-zope.event ==== Version update (6.1 -> 6.2) - update to 6.2: * Move package metadata from setup.py to pyproject.toml. * Allow setuptools < 82 as build system.
