Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20260915 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: Mesa Mesa-drivers alsa bash-completion (2.12.0 -> 2.17.0) cnf (0.9.0~0 -> 0.9.1) container-selinux (2.250.0 -> 2.251.0) cups dLeyna (0.8.4 -> 0.8.5) discount (3.0.1.2 -> 3.0.2.0) glibc gnome-maps (50.4 -> 50.5) gstreamer-plugins-ugly (1.28.6 -> 1.28.7) gvfs (1.60.2 -> 1.60.3) libgcrypt (1.12.3 -> 1.12.4) libpng16 librist (0.2.11 -> 0.2.20) linux-glibc-devel newt nvidia-open-driver-G07-signed nvidia-open-driver-G07-signed-cuda (610.57.04_k7.2.5_1 -> 615.71.09_k7.2.5_1) openSUSE-release (20260914 -> 20260915) opencv ovmf python-argparse-manpage python-pip (26.2 -> 26.2.1) simdutf (9.1.0 -> 9.1.2) yast2-trans (84.87.20260424.fdcdc295f0 -> 84.87.20260906.c2bec94659) === Details === ==== Mesa ==== Subpackages: Mesa-libEGL1 Mesa-libGL1 libgbm1 - llvm23.patch: fix build with LLVM 23 - Enable the rocket Gallium driver (Rockchip NPUs) on aarch64 and build the Teflon TensorFlow Lite delegate; ship libteflon.so in new subpackage Mesa-teflon-delegate ==== Mesa-drivers ==== Subpackages: Mesa-dri Mesa-libva Mesa-vulkan-device-select libvulkan_lvp - llvm23.patch: fix build with LLVM 23 - Enable the rocket Gallium driver (Rockchip NPUs) on aarch64 and build the Teflon TensorFlow Lite delegate; ship libteflon.so in new subpackage Mesa-teflon-delegate ==== alsa ==== Subpackages: libasound2 libatopology2 - Fix Denial of Service via off-by-one stack buffer overflow (CVE-2026-90781, bsc#1280204): 0001-Fix-theoretical-one-byte-buffer-overrun.patch 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch ==== bash-completion ==== Version update (2.12.0 -> 2.17.0) - update to 2.17.0: * Support -P prefix in _comp_compgen. * Add -f in _filedir to manually suffix / to directories. * New completions: free, fsnotifywait, fsnotifywatch, nload, tmux, fprintd-*, slabtop. * Vastly expanded 3rd-party fallback completion loaders (including asdf, caddy, cosign, delta, jj, just, k9s, tofu, tldr, trash-cli, uv, uvx, zola, and many others). * Added and updated file/archive associations (unzip, zipinfo, bsdtar, wine, xv) for .apk, .apkm, .apks, .xapk, .crx, .hap, .ipa, .vsix, .webp, .pnm, .ogx, .oga. * Enable .java filename completion for the java command. Complete commands and variable assignments in env. * Greatly expanded subcommand, protocol, and argument completions in ip, curl, openssl, ssh-keygen, ssh-keyscan, ssh-copy-id, tar, aptitude, coreutils, set, and others. * Support Python 3.13 versioned executables. * Bug Fixes: - Avoid nounset, localvar_inherit, and pathname expansion errors in various completions. - Always quote special characters in _filedir completions. - Correct cd pattern matching and cdable_vars validation. - Try calling magick for ImageMagick 7 in convert. - Fix remote file/path quoting and backslash issues in ssh, scp, rsync, and sshfs. - Improve BSD-style compatibility/arguments for openssl, patch, truncate, and rsync. - Bash 5.3 compatibility fixes (GLOBSORT and compgen -V). - Cache GNU tar help parsing for improved performance. - drop patches (already merged upstream): * tar-completion.patch * bug1246923.patch ==== cnf ==== Version update (0.9.0~0 -> 0.9.1) Subpackages: cnf-bash cnf-zsh - Update to version 0.9.1: * Translated using Weblate (German, Spanish, Georgian) * Pass a properly terminated string to fopen - Improve version determination in _service: * ~ made it older (0.9.0~0 < 0.9.0), use the correct + instead * Adjust the versionrewrite regex to omit +0 ==== container-selinux ==== Version update (2.250.0 -> 2.251.0) - Update to version 2.251.0: * Allow spc_t permissions for container_runtime_domain directory management * Allow sshd_session_t to launch containers * Add missing contexts for Docker's containerd-snapshotter * Add container_runtime_nnp_domtrans interface ==== cups ==== Subpackages: cups-client cups-config libcups2 libcupsimage2 - cups-2.4.19-CVE-2026-87875.patch is based on https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 adapted to CUPS 2.4.19 to fix CVE-2026-87875 "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq bsc#1279945 "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound can be reached via the SNMP supply-description parsing" ==== dLeyna ==== Version update (0.8.4 -> 0.8.5) - Update to version 0.8.5: + server: Fix double-free in action callback ==== discount ==== Version update (3.0.1.2 -> 3.0.2.0) - Update to version 3.0.2.0: * CVE-2026-4833: uncontrolled recursion in compile() on deeply nested input, leading to stack exhaustion and crash; the parser now caps nesting depth (default 200, tunable via --with-recursion). * Changes from version 3.0.1.3: keep contents of adjacent blockquote chunks together, fenced code handling fixes. - Drop Group: tags (deprecated). ==== glibc ==== Subpackages: glibc-devel glibc-extra glibc-gconv-modules-extra glibc-locale glibc-locale-base - strfmon-right-just.patch: stdlib: Fix right-justification in strfmon (CVE-2026-19499, bsc#1276892, BZ #34510) - tdelete-oob-write.patch: misc: Fix out-of-bounds array write in tdelete (CVE-2026-19542, bsc#1276946, BZ #34506) - sjisx-pending-char-reset.patch: iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117, bsc#1277921, BZ #34556) - eucjisx-pending-char-reset.patch: iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489, bsc#1277922, BZ #34568) - libio-fopen-ccs.patch: libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling (CVE-2026-18374, bsc#1277262, BZ #34574) - Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247). ==== gnome-maps ==== Version update (50.4 -> 50.5) - Update to version 50.5: + Fix showing secondary icon for recent and favorite places in initial search results + Updated translations. ==== gstreamer-plugins-ugly ==== Version update (1.28.6 -> 1.28.7) - Update to version 1.28.7: + No changes, version bump only. ==== gvfs ==== Version update (1.60.2 -> 1.60.3) Subpackages: gvfs-backend-afc gvfs-backend-goa gvfs-backend-gphoto gvfs-backend-samba gvfs-backends gvfs-fuse - Update to version 1.60.3: + CVE-2026-88924: admin: Set socket ownership before creation + trash: Fix metadata handling when restoring or emptying + dav: Fix response body leaks to prevent hangs + Some other fixes + Updated translations. - Add gvfs-CVE-2026-84268.patch: sftp: Clamp `read_reply` count to requested buffer size (bsc#1278158, CVE-2026-84268). - Add gvfs-CVE-2026-84270.patch: mtp: Validate read size returned by device (bsc#1278156, CVE-2026-84270). ==== libgcrypt ==== Version update (1.12.3 -> 1.12.4) - Update to 1.23.4: * Fix build problem with some compiler versions related to SM4 instructions * Fix padding in cSHAKE found by NIST ACVP conformance vectors * Fix RSA PSS handling of huge salt lengths * Validate the length of hashed input for RSA PSS * Improve RSA OAEP decoder correctnes by validating an all-zero padding ==== libpng16 ==== - Fix build on armv6 by really disabling neon support ==== librist ==== Version update (0.2.11 -> 0.2.20) - Update to 0.2.20: * Added support for Nettle 4.0 (bsc#1257934) * Enable the test suite. * Lots of new features, bug fixes and security audits between versions 0.2.11 and 0.2.20, for a full list of changes, see: - code.videolan.org/rist/librist/tags * Remove librist-const-correctness.patch fixed upstream * Add patches: - librist-EAP-headers.patch - librist-skip-multicast-tests-in-buildenvs.patch ==== linux-glibc-devel ==== - use https url ==== newt ==== - Fix new home of the project - remove python2 support - remove dependency on old macros.python3 - drop rpmlintrc ==== nvidia-open-driver-G07-signed ==== Subpackages: nvidia-open-driver-G07-signed-kmp-64kb nvidia-open-driver-G07-signed-kmp-default - moved the conditional to %prep section; required going back from %autosetup to %setup due to missing -M and -m %autosetup options on SLE15-SP6 - Fixing-build-against-SLE16.1-Kernel.patch - re-enable CXL support by moving to old internal kernel interface, which we still use for our CXL backport on SLE16.1 (bsc#1280057) - Fixing-build-against-SLE16.1-Kernel.patch * Fixing build of 615.71.09 driver against SLE16.1 Kernel - update CUDA variant to 615.71.09 ==== nvidia-open-driver-G07-signed-cuda ==== Version update (610.57.04_k7.2.5_1 -> 615.71.09_k7.2.5_1) Subpackages: nvidia-open-driver-G07-signed-cuda-kmp-64kb nvidia-open-driver-G07-signed-cuda-kmp-default - moved the conditional to %prep section; required going back from %autosetup to %setup due to missing -M and -m %autosetup options on SLE15-SP6 - Fixing-build-against-SLE16.1-Kernel.patch - re-enable CXL support by moving to old internal kernel interface, which we still use for our CXL backport on SLE16.1 (bsc#1280057) - Fixing-build-against-SLE16.1-Kernel.patch * Fixing build of 615.71.09 driver against SLE16.1 Kernel - update CUDA variant to 615.71.09 ==== openSUSE-release ==== Version update (20260914 -> 20260915) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== opencv ==== - Enable jxl and avif support - python-opencv requires python-numpy ==== ovmf ==== Subpackages: qemu-uefi-aarch64 - Add unversioned "virt" machine in riscv64 ovmf descriptor (bsc#1280108) ==== python-argparse-manpage ==== - Add patch support-python-315.patch: * Support Python 3.15 argparse changes. ==== python-pip ==== Version update (26.2 -> 26.2.1) - update to 26.2.1: * Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ==== simdutf ==== Version update (9.1.0 -> 9.1.2) - Update to version 9.1.2: + minor improvements to base64 decoding. ==== yast2-trans ==== Version update (84.87.20260424.fdcdc295f0 -> 84.87.20260906.c2bec94659) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20260906.c2bec94659: * Translated using Weblate (German) * Translated using Weblate (Danish) * Translated using Weblate (Danish) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Danish) * Translated using Weblate (Danish) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Slovak) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Lao) * Translated using Weblate (Ukrainian) * Translated using Weblate (Ukrainian) * Translated using Weblate (Ukrainian) * Translated using Weblate (Ukrainian) * Translated using Weblate (French) * Translated using Weblate (Danish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) ... changelog too long, skipping 5 lines ... * Translated using Weblate (French)
