Packages changed:
  389-ds (3.3.1+8c2711bd6 -> 3.3.1+28b6d8afc)
  binutils
  cracklib-dict-full (2.8.12 -> 2.10.3)
  ethtool (7.1 -> 7.2)
  gettext-runtime
  ghostscript
  grub2
  java-25-openjdk (25.0.4.1 -> 25.0.5.0)
  libevent (2.1.12 -> 2.1.13)
  libimobiledevice-glue (1.3.2+git0.20250604 -> 1.3.3+git0.20261005)
  libmaxminddb (1.13.3 -> 1.14.1)
  libsolv (0.7.40 -> 0.7.41)
  libstorage-ng (4.5.365 -> 4.5.366)
  libzypp (17.38.16 -> 17.38.17)
  live555 (2026.10.23 -> 2026.10.24)
  ndctl (84 -> 85)
  openSUSE-release (20261027 -> 20261028)
  parted
  patterns-games
  rsync
  salt
  samba (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb)
  socat
  speex
  squashfs (4.6.1 -> 4.7.5)
  xfsdump (3.2.0 -> 3.3.0)
  xfsprogs (6.19.0 -> 7.2.0)
  zypper (1.14.101 -> 1.14.102)

=== Details ===

==== 389-ds ====
Version update (3.3.1+8c2711bd6 -> 3.3.1+28b6d8afc)
Subpackages: lib389 libsvrcore0

- bsc#1284028 - CVE-2026-86344 - incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion
- bsc#1284034 - CVE-2026-86345 - smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses
- Update to version 3.3.1+28b6d8afc:
  * Issue 7919 - Coordinate PDU writer handoff and buffered reads
  * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
  * Issue 8001 - RFE - log total number of entries in each backend
  * Issue 8017 - Server can hang at shutdown after an aborted import (#8026)
  * Issue 7879 - Outbound SASL bind waits forever while holding krb5_lock (#7881) (#7926)
  * Issue 7827 - Preserve dsEntryDN case from DN cache (#7828)
  * Issue 7877 - UI - add view raw entry action (#7878)
  * Issue 7915 - UI - Reindexing single attribute does not show progress in modal (#7916) (#7930)
  * Issue 7953 - dsrate - should use server's ldif directory location (#7954)
  * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922)
  * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
  * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
  * Issue 7905 - man: fix dropped line in 99user.ldif(5) example (#7906)
  * Issue 7742 - memory leak in schema replication (#7894)
  * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
  * Issue 7744 - memory leak in search referral handling (#7884)
  * Issue 7702 - memory leak in send_specific_attrs() (#7883)
  * Issue 7745 - memory leak in replication replica init (#7892)
  * Issue 7887 - Prevent password reuse when changing multiple passwords (#7888)
  * Issue 4598 - Copy attribute syntax hashtables to each worker thread (#5693)
  * Issue 7835 -  rdn can be NULL when passed to bdb_has_spaces() in bdb_upgradedn_producer()
  * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
  * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
  * Issue 7863 - remove redundant strcmp's in schema superset checking
  * Issue 7506 - CLI/UI - Add option to list accounts by status (#7818)
  * Issue 7627 - When it exists configured matching rule for an (#7628)
  * Issue 7832 - remove instance monitor directory when server is removed (#7839)
  * Issue 7772 - double-free when processing an invalid Session Tracking control (#7773)
  * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
  * Issue 7823 - CI: stabilize test_controltype_expired_grace_limit (#7824)
  * Issue 7815 - Support nsslapd-attribute-name-exceptions when adding entries

==== binutils ====
Subpackages: libctf-nobfd0 libctf0 libsframe3

- Add a couple more CVE fixes that meanwhile got upstream:
  * bsc#1280611 aka CVE-2026-91781 aka PR34449
  * bsc#1280605 aka CVE-2026-90828 aka PR34450
  * bsc#1275936 aka CVE-2026-19582 no PR
  * bsc#1275267 aka CVE-2026-19548 no PR
- Also fixed already:
  * bsc#1282138 aka CVE-2026-15003 aka PR34053
- Add patches for the above:
  binutils-fix-cve19582.diff, binutils-fix-cve19548.diff,
  binutils-fix-pr34450.diff, binutils-fix-pr34449.diff

==== cracklib-dict-full ====
Version update (2.8.12 -> 2.10.3)

- Switch wordlist Source URLs from ftp:// to http:// (ftp is not
  reachable from the build environment); three wordlists
  re-downloaded with identical content (gzip header only)
- Update to 2.10.3, following the cracklib 2.10.3 package
  (boo#1160062): rebuild the dictionaries with its current
  tools. No wordlist changes.
- Spec cleanup (spec-cleaner pass)

==== ethtool ====
Version update (7.1 -> 7.2)

- Update to release 7.2
  * Feature: support for KSZ87xx PHY tunables (--{get,set}-phy-tunable)
  * Fix: cmis: fix printing of Tx bias current (-m)
  * Fix: cmis: fix printing of channel-level flags (-m)
  * Fix: cmis: fix printing of CDB EPL pages (-m)
  * Fix: printing of transmitter technology for CMIS transceivers (-m)
  * Fix: avoid undefined behavior with CMIS transceivers (-m)
  * Fix: add missing CMIS transmitter technologies (-m)
  * Fix: printing of attenuation and wavelength (-m)
  * Fix: printing of link length (-m)
  * Fix: sfpid: print all implemented options (-m)
  * Fix: sfpid: print all compliance codes (-m)
  * Fix: qsfp: print all compliance codes (-m)
  * Fix: module-eeprom: clamp data length to attribute payload size (-m)
  * Fix: validate module EEPROM offset and length (-m)
  * Fix: rss: bound hash function masks in text and JSON output (-x)
  * Fix: fbnic: fix off-by-one shift in reg dump parser (-d)
  * Fix: fbnic: Fix various TX and RX CSR fields decoding (-d)
  * Fix: fbnic: Fix register dump names and bit labels (-d)

==== gettext-runtime ====
Subpackages: envsubst libtextstyle0

- Add ldconfig calls to the gettext-tools scriptlets: the package
  ships libgettextpo.so.0 but never ran ldconfig for it; the calls
  join the existing %post and a new %postun
- Add gettext-spit-shebang.patch: /usr/bin/spit used an
  /usr/bin/env python3 shebang, name the interpreter directly
- Extend the frozen gettext-linkdupes.sh hardlink list to cover
  the examples and data files added since it was generated
  (hello-go, hello-go-http, hello-c++20, hello-objc-gnome2, the
  GNOME m4 files, the shared po/LINGUAS files and the nls.m4
  pair under /usr/share); the list stays frozen and is extended
  by hand rather than replaced by live %fdupes runs, because a
  BuildRequires on fdupes would create a build loop (its
  dependency chain reaches back into gettext)
- Drop the stale removal of gettext.jar from %install: no jar is
  built since the Java support was dropped, and the line missed
  the buildroot prefix
- Fix the libtextstyle0 summary wording (text styling)
- Drop the deprecated Group: tags
- rpmlintrc: drop the filters for the fixed gettext-tools ldconfig
  findings and the gettext-csharp filters (that package is built
  from a different source package)
- The remaining rpmlint error, non-devel-file-in-devel-package
  for libgettextpo.so.0 in gettext-tools, is a checker problem,
  not a package defect: gettext-tools is the designated devel
  package for libgettextpo (it ships the headers, the unversioned
  symlink and Provides: gettext-devel). It is tracked on the
  rpmcrab side and is deliberately not restructured or filtered
  in this package

==== ghostscript ====
Subpackages: ghostscript-x11

- Build --without-local-brotli to not use the brotli sources
  in Ghostscript but the system brotli library to avoid
  CVE-2026-111497: ghostscript: brotli: "Brotli decoder
  out-of-bounds write permits remote code execution"
  (bsc#1287815)

==== grub2 ====
Subpackages: grub2-common grub2-i386-pc grub2-snapper-plugin grub2-systemd-sleep-plugin grub2-x86_64-efi grub2-x86_64-efi-bls

- Fix out-of-bound memory write and uninitialized read in
  add_multiple_nvme_bootdevices() when adding boot device to PowerPC
  OpenFirmware's boot list (bsc#1284464)
  * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch
  * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch
  * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch
- Fix memory leak in error path, add missing error return check in
  grub_initrd_component(), ensure NULL check before memset() in
  grub_cryptokey_discard() (bsc#1284464)
  * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch
  * 0002-discard-cached-key-before-entering-grub-shell-and-ed.patch
  * Fix-the-size-calculation-for-the-synthesized-initrd.patch
- Fix out-of-bound memory write in add_multiple_dm_multipath_bootdevices() when
  adding boot device to PowerPC OpenFirmware's boot list
  * 0001-ieee1275-support-dm-multipath-bootlist.patch
- Rebase patches
  * 0002-Restrict-cryptsetup-key-file-permission-for-better-s.patch
  * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch

==== java-25-openjdk ====
Version update (25.0.4.1 -> 25.0.5.0)
Subpackages: java-25-openjdk-headless

- Update to upstream tag jdk-25.0.5+8 (Octobre 2026 CPU)
  * Security fixes
    + JDK-8383530: Enhance Javadoc Searching
    + JDK-8383689, CVE-2026-87255, bsc#1286483: Enhance Vector
    Processing
    + JDK-8383679, CVE-2026-87294, bsc#1286490: Enhance Certificate
    Name Checks
    + JDK-8383439, CVE-2026-83395, bsc#1286479: Enhance HTTP Client
    Response Handling
    + JDK-8386783: WebRowSet empty elements read value of previous
    element
    + JDK-8383301, CVE-2026-83387, bsc#1286478: Enhance WebRowSets
    + JDK-8380715, CVE-2026-83374, bsc#1286472: Enhance PKCS5
    padding
    + JDK-8384654, CVE-2026-87367, bsc#1286943: Enhance Template
    Handling
    + JDK-8384736, CVE-2026-91379, bsc#1286498: Enhance JShell
    8387235: JShell tests failing
    + JDK-8382378, CVE-2026-83378, bsc#1286475: Improve C2 loop
    transformations
    + JDK-8383699, CVE-2026-87290, bsc#1286484: Enhance XPath
    Expressions
    + JDK-8383047, CVE-2026-83380, bsc#1286476: Enhance LDAP logins
    + JDK-8384468: Enhance jpackage Packaging
    + JDK-8384021, CVE-2026-101516, bsc#1286395: Enhance
    Certificate Constraint Checking
    + JDK-8387152, CVE-2026-91462, bsc#1286547: Enhance krb5 tokens
    + JDK-8387238, CVE-2026-91464, bsc#1286550: Enhance Kerberos
    validation
    + JDK-8386013: Enhance EventListenerList
    + JDK-8382407: Enhance LDAP Lookups
    + JDK-8390400, CVE-2026-91487, bsc#1286551: Enhance C2
    comparisons
    + JDK-8385209, CVE-2026-91394, bsc#1286507: Enhance HTTP client
    caching
    + JDK-8386535, CVE-2026-91453, bsc#1286545: Improve HTTP headers
    + JDK-8386923, CVE-2026-91461, bsc#1286546: Enhance TLS
    Extensions
    + JDK-8387217, CVE-2026-91463, bsc#1286549: Enhance krb5 client
    + JDK-8386515, CVE-2026-91451, bsc#1286542: Enhance HTTP server
    parsing
    + JDK-8373677: Clear text HttpServer connection could fail fast
    if receiving SSL ClientHello
    + JDK-8384872, CVE-2026-91332, bsc#1286491: Enhance HTTP Client
    + JDK-8383756, CVE-2026-87292, bsc#1286486: Enhance Network
    Clients
    + JDK-8383745, CVE-2026-87291, bsc#1286485: Enhance HTTP Server
    + JDK-8384165, CVE-2026-91333, bsc#1286492: Improve ciphertext
    handling
    + JDK-8383281: Enhance MD5 Digesting
    + JDK-8384664, CVE-2026-91335, bsc#1286494: Enhance Image
    Handling
    + JDK-8384746, CVE-2026-91380, bsc#1286500: Enhance Preferences
    + JDK-8386552, CVE-2026-91418, bsc#1286539: Enhance GIF loading
    + JDK-8385476, CVE-2026-91400, bsc#1286517: Enhance MIDI file
    handling
    + JDK-8384688, CVE-2026-91375, bsc#1286497: Enhance jmod
    handling
    + JDK-8387075: RemoteHostImpl constructor correction (jstatd)
    + JDK-8386525, CVE-2026-91452, bsc#1286544: Enhance HTTP Server
    Handler
    + JDK-8386187, CVE-2026-91415, bsc#1286537: Enhance font
    rendering
    + JDK-8385260, CVE-2026-91398, bsc#1286515: Enhance SOCKS5
    support
    + JDK-8385249, CVE-2026-91397, bsc#1286513: Enhance diagnostic
    sessions
    + JDK-8384930, CVE-2026-91374, bsc#1286496: Enhance jstatd
    + JDK-8384771, CVE-2026-91373, bsc#1286495: Enhance TLS
    handshakes
    + JDK-8384455: Enhance DataFlavor
    + JDK-8384445, CVE-2026-91334, bsc#1286493: Enhance JPEG loading
    + JDK-8384031, CVE-2026-83400, bsc#1286480: Enhance XML
    Processing
    + JDK-8383076, CVE-2026-83381, bsc#1286477: Enhance SASL
    Authentication
    + JDK-8382178, CVE-2026-83376, bsc#1286474: Enhance TLS
    certificate handling
  * Other fixes
    + JDK-8386273: Some javax/sound/sampled tests fail on systems
    with high CPU core number and running with high concurrency
    + JDK-8392072: Follow-on fix for Improve certification checking
    + JDK-8391256: TestZoneTextPrinterParser.java assertion fails
    with expected: <Mountain Standard Time> but was: <Mountain
    Daylight Time>
    + JDK-8388214: (tz) Update Timezone Data to 2026c
    + JDK-8390380: Cherry-pick metazone changes from CLDR to support
    tzdata2026c for JDK update releases
    + JDK-8390388: Cherry-pick tz attributes from newer CLDR data
    for jdk25u and earlier
    + JDK-8372044: Implementation Review Based on ML-KEM Security
    Considerations
    + JDK-8381379: Support std/dstOffset attributes in CLDR's
    metazone definitions
    + JDK-8387874: Timeout when running test
    BulkCipherDisabledAlgorithms
    + JDK-8387124: Incomplete algorithm decomposition for TLS 1.3
    cipher suites in SSLAlgorithmDecomposer
    + JDK-8380223: Refactor test/jdk/sun/util/resources TestNG tests
    ... changelog too long, skipping 242 lines ...
    + not needed any more

==== libevent ====
Version update (2.1.12 -> 2.1.13)

- libevent.keyring updated, fetched from keyserver
- Updated to 2.1.13 stable
  Security Fixes (evtag, evrpc):
  - CVE-2026-63383: Fix an out-of-bounds read in decode_tag_internal.
    (GHSA-fj29-64w6-73h6 bsc#1276000)
  - CVE-2026-63384: Fix an integer overflow in evtag_unmarshal_header.
    (GHSA-45c6-qx49-89m8 bsc#1276001)
  Security Fixes (evhttp):
  - CVE-2026-63379: Discard HTTP trailers, to prevent header smuggling attacks.
    (GHSA-2gmv-p5m7-98p6 bsc#1275995)
  - CVE-2026-63382: Restrict HTTP header parsing to prevent request smuggling.
    (GHSA-q39v-w2g7-gr8j bsc#1275999)
  - CVE-2026-63385, CVE-2026-63382: Treat CRLF and %00 more strictly in
    HTTP headers, to prevent parser mismatch attacks.
    (See GHSA-q39v-w2g7-gr8j, GHSA-jcwh-pvf2-73p2, bsc#1275999 bsc#1276002)
  - CVE-2026-63388: Fix a heap out-of-bound write that could occur when using
    AF_UNIX sockets and compiling libevent with -DNDEBUG.
    (GHSA-cvq5-vrvr-j338 bsc#1276004)
  Security fixes (evbuffer, bufferevent):
  - CVE-2026-63381: Fixed a dangling pointer in evbuffer_add_reference.
    (GHSA-c2pj-cg4r-88c8 bsc#1275997)
  Security fixes (evdns):
  - CVE-2026-63387: Fix an out-of-bounds write in dnsname_to_labels
    when building a DNS response of 2^16 bytes.
    (GHSA-58rx-7448-jw47 bsc#1276003)
  Security fixes (example code):
  - Avoid using strcpy() in sample/http-server.c.
    (GHSA-5rgj-2c58-7jrc)
  Other fixes:
  - Backport fixes for numerous compiler warnings.
  - Backport fixes for compilation with openssl 3 and later.

==== libimobiledevice-glue ====
Version update (1.3.2+git0.20250604 -> 1.3.3+git0.20261005)

- Update to version 1.3.3+git0.20261005:
  * Update NEWS for release
  * Update soversion for release
  * utils: Correct ctype(3) usage
  * socket: Improve portability by replacing OS-specific macros
    with AC_CHECK_HEADERS
  * endianness.h: Default to little endian
  * Add atexit call to (empty) deinit function to prevent
    stripping off initializer code
  * Add FUNDING
  * [github-actions] Update build workflow to use windows-latest
  * socket: Use const void* instead of void* in signature of socket_send()

==== libmaxminddb ====
Version update (1.13.3 -> 1.14.1)

- update to 1.14.1
  * Fixed a -Wsign-compare warning in MMDB_open() that broke builds with
  - Werror on platforms where ssize_t is 32 bits, such as i686.
- version 1.14.0
  * Bounded the resources that MMDB_get_entry_data_list() spends decoding a
    single entry. A crafted database could nest data-section pointers to shared
    targets so that decoding one entry cost exponential time and memory, or point
    many times at one large value so that a caller copying the result materialized
    far more data than the file holds. The decoder now follows the Reader Resource
    Limits section of the MaxMind DB specification. Each call is limited to 65,536
    values and 2 MiB of string and bytes payload, in addition to the existing
    recursive-decoder depth limit of 512. See the MMDB_get_entry_data_list()
    documentation for details.
  - Exceeding a limit returns the new MMDB_DECODER_LIMIT_ERROR status. A
    full-list failure leaves the output set to NULL.
  - MMDB_get_value(), MMDB_vget_value(), and MMDB_aget_value() now return
  - MMDB_DECODER_LIMIT_ERROR instead of MMDB_INVALID_DATA_ERROR when they
    skip a subtree past the depth limit.
  - MMDB_open() returns MMDB_INVALID_METADATA_ERROR when metadata processing
    exceeds a decoder limit.
  - The limits can be raised when building the library with
  - DMAXIMUM_DATA_STRUCTURE_DEPTH, -DMAXIMUM_DATA_STRUCTURE_VALUES, and
  - DMAXIMUM_DATA_STRUCTURE_BYTES.
  * Fixed an out-of-bounds read in MMDB_lookup_sockaddr() when callers passed a
    sockaddr with an unsupported address family. The function now rejects any
    family other than AF_INET and AF_INET6 with
    MMDB_INVALID_NETWORK_ADDRESS_ERROR.
  * Fixed metadata parsing for files that end immediately after the
    \xAB\xCD\xEFMaxMind.com marker. Such files are now rejected as invalid
    metadata instead of allowing a zero-length metadata section to reach the
    decoder.
  * Fixed search-tree validation for records that point into the 16-byte separator
    before the data section. These records are now rejected as corrupt instead of
    being exposed as apparent data entries with underflowed offsets.
  * MMDB_read_node() now returns MMDB_CORRUPT_SEARCH_TREE_ERROR instead of
    MMDB_SUCCESS with MMDB_RECORD_TYPE_INVALID record types when a node's
    child record is invalid.

==== libsolv ====
Version update (0.7.40 -> 0.7.41)
Subpackages: libsolv-tools-base libsolv1 ruby-solv

- improved speed of repo_add_solv, should now be more that 20%
  faster in many cases
- repo_add_solv hardening to catch corrupt solv files earlier
- hardened apkv3 code [bsc#1284786] [bsc#1284995]
  [CVE-2026-104622] [CVE-2026-104624]
- fixed repo_conda xml parsing [bsc#1284786] [CVE-2026-104621]
- support pre-sizing of id hashes (pool_presize_idhashes,
  pool_get_idcounts solv_read_idcounts)
- new POOL_FLAG_NOWHATPROVIDESSHRINK pool flag to disable
  shrinking if speed matters more then memory usage
- bump version to 0.7.41

==== libstorage-ng ====
Version update (4.5.365 -> 4.5.366)
Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1

- Translated using Weblate (Swedish) (bsc#1149754)
- 4.5.366

==== libzypp ====
Version update (17.38.16 -> 17.38.17)

- Fix hanging eventloop in case setupHandle fails.
  This may happen e.g. due to a failing curlSetupOption call as
  result of a miss configured option value.
- zypp.conf: Add download.min_download_speed_time (60 sec) (fixes
  [#751])
- version 17.38.17 (35)

==== live555 ====
Version update (2026.10.23 -> 2026.10.24)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia122

- Update to version 2026.10.24:
  * In "RTPInterface::handleRead()", if we're reading from a TCP socket, call
    "getpeername()" to set our "fromAddress", because the "recvfrom()" call
    won't set it.
  * Added a check to "AC3AudioStreamParser" for a buffer overflow that probably
    won't happen, but to be safe...
  * Began replacing some calls to "sprintf()" (that were perfectly safe, but
    caused some compilers to emit warning messages) with calls to "snprintf()".

==== ndctl ====
Version update (84 -> 85)

- Update to version 85
  * daxctl: Add support for famfs mode
  * cxl/list: apply bus and port filters to anonymous memdevs
  * cxl/region: prevent partial teardown on out-of-order destroy-region
  * cxl/list: show region locked status to user

==== openSUSE-release ====
Version update (20261027 -> 20261028)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== parted ====
Subpackages: libparted-fs-resize0 libparted2 parted-lang

- Drop Obsoletes: libparted0 from libparted2. The libparted.so.0
  and libparted.so.2 file sets are disjoint, so the generations
  are co-installable as the shared library packaging policy
  intends; the obsoletes only forced removal of the older
  generation, and also drew the obsolete-not-provided warning.
- baselibs.conf: run /sbin/ldconfig in %post and %postun of the
  generated libparted2 and libparted-fs-resize0 -32bit packages;
  they previously carried no ldconfig scriptlets at all.
- Drop the Group tags and the BuildRoot tag (ignored by rpm).
- Convert BuildRequires: pkg-config to pkgconfig, and drop the
  %doc marker from the info files (spec-cleaner conversions).

==== patterns-games ====

- games pattern: drop the requirement on the x11 pattern
  entirely. X11 desktop patterns already require the x11
  pattern themselves, and a games install must not pull an
  X stack onto Wayland-only systems

==== rsync ====

- Add rsync-direct-interpreters.patch: use direct interpreter
  paths, #!/bin/bash for rsync-ssl and #!/usr/bin/perl for
  rsyncstats, instead of /usr/bin/env lookups. The scripts
  then declare a proper interpreter dependency rather than
  relying on PATH resolution at runtime.
- Do not ship rsyncstats twice: the support documentation
  is copied without it, the script is installed once in
  /usr/bin.
- Drop the unused rsyncd.rc source and the empty init.d and
  xinetd.d directory creation; the daemon runs through the
  systemd units.
- Drop the grep and sed post requirements, no scriptlet of
  this package calls either tool.
- Spec cleanup per the packaging guidelines: drop the
  obsolete Group tag and write the library build
  requirements in pkgconfig form.

==== salt ====
Subpackages: python313-salt salt-master salt-minion

- Ignore network status when comparing docker networks
- Fix Git state comment formatting
- Fix surogateescape encoding typo in openscap module
- Prevent schedule loss during master connection loss (bsc#1280583)
- Added:
  * fix-docker-tests-785.patch
  * repair-git-state-comment-formatting-788.patch
  * fix-surogateescape-typo-in-openscap-module-790.patch
  * prevent-schedule-loss-when-minion-loses-master-conne.patch

==== samba ====
Version update (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb)
Subpackages: libldb2 libldb2-32bit python3-ldb samba-ad-dc-libs samba-ad-dc-libs-32bit samba-client samba-client-32bit samba-client-lang samba-client-libs samba-client-libs-32bit samba-dcerpc samba-gpupdate samba-ldb-ldap samba-libs samba-libs-32bit samba-libs-python3 samba-python3 samba-winbind samba-winbind-libs samba-winbind-libs-32bit samba-winbind-libs-lang

- Update to 4.25.1
  * CVE-2026-109411: Access control bypass via vfs_ceph_rgw
    case-insensitive open; (bso#16276); (bsc#1286540);
  * CTDB: Cannot find device "<iface>@<link>": need to extract real
    interface names; (bso#16274).
  * generate_unique_u64() may not protect against veto_value;
    (bso#16200).
  * Rename with ReplaceIfExists to a target differing only in case
    creates a duplicate instead of replacing; (bso#16261).
  * Samba 4.25.0 fails to build on macOS; (bso#16263).
  * Python smbconf transaction_start() lacks a talloc stack frame
    with CTDB; (bso#16258).
  * Linux i686 build fails on dynamic_lookup; (bso#16265).
  * vfs_acl_xattr crashes on zero-sized flistxattr queries;
    (bso#16287).
  * Dynamic interface support in smbd is racy; (bso#16235).
  * CTDB database operations can be run against incorrect nodes;
    (bso#16254).
  * A node can be banned because it tries to run recovery after
    losing the cluster lock; (bso#16273).
  * All backend log should honor global log level "log level = ";
    (bso#15857).
  * fruit:time machine max size can only be set to an integer and
    is ignored if user sets a float; (bso#15324).

==== socat ====

- Add socat-chain-ssl-l-race.patch

==== speex ====

- Fix out-of-bounds write in speex_bits_read_whole_bytes()
  (CVE-2026-116741, bsc#1288101):
  speex-CVE-2026-116741.patch
- Refresh speex-no-build-date.patch to be applied with -p1

==== squashfs ====
Version update (4.6.1 -> 4.7.5)

- Update to 4.7.5:
  * Mksquashfs now reads files in parallel (-small-readers,
  - block-readers, -single-reader options), much faster on SSDs
    and network filesystems; "fragment block stall" eliminated,
    improving performance by 20% or more
  * Rewritten help system using the full terminal width with pager
    support and -help-all/-help-section/-help-option selectors
  * New reproducible-image options: -repro, -repro-time, plus
  - mkfs-time/-inode-time/-root-time inode variants
  * Mksquashfs/Sqfstar can stream the filesystem to stdout
    (-stream) and fix it up afterwards (-fix); sparse file
    reading greatly sped up via SEEK_DATA
  * New Align action, -force-file-mode/-force-dir-mode,
  - numeric-owner, -mem/-mem-percent for unsquashfs and more
  * Bug fixes: possible filesystem corruption with sparse files,
    broken -max-depth, pseudo-file definition issues, -offset
    regression, tar-file cache leak in sqfstar
  * Many more fixes and improvements; see upstream's release notes
    for the full list
- Rebase squashfs-64k.patch (pad to 64K for ppc64 alignment) to
  4.7.5, covering the new streamed-filesystem superblock padding
  and the rewritten help texts; squashfs-thread-limit refreshed
  for the reworked initialise_threads().
- Adjust packaged docs to the new upstream layout (README.md,
  CHANGES.md).

==== xfsdump ====
Version update (3.2.0 -> 3.3.0)

- Update to 3.3.0:
  * xfsrestore: only process subtrees that are selected, fixing
    an assertion failure in cumulative restores where the initial
    restore used the subtree (-s) option
  * Fix permissions on files installed by libtoolize (build fix)
- Refresh keyring: add new upstream maintainer key (Andrey
  Albershteyn); upstream signing key rotated from Carlos Maiolino
- Spec cleanup (spec-cleaner): drop Group tag, use pkgconfig()
  BuildRequires, %license for COPYING
- Fix BuildRequires: restore autoconf (regenerating configure
  needs it), keep only the pkgconfig() providers the sources
  use (libattr, ncurses), add gcc/make

==== xfsprogs ====
Version update (6.19.0 -> 7.2.0)
Subpackages: libhandle1

- update to 7.2.0
  - xfs_quota, xfs_spaceman, libfrog: hoist xfsquotactl into libfrog
    with quotactl_fd and mount-fd support, so xfs_quota can open the
    filesystem mountpoint directly for quota operations and
    xfs_spaceman's makecfg can reuse the same code path
  - mkfs, xfs_admin, xfs_spaceman, xfs_db: allow specifying and
    printing mkfs default options via a configuration file; mkfs also
    upgrades autofsck earlier automatically
  - xfs: fix an off-by-one in rtrefcount btree root level validation, a
    reflink-flag clearing issue with INO1_WRITTEN during exchange-range,
    a memory leak in xfs_dqinode_metadir_create(), a 32-bit pointer
    arithmetic bug, an exchmaps reservation limit check, and growfs
    delta computation not returning the updated block count
  - xfs: report case sensitivity via fileattr_get
  - xfs_copy: always align I/O to at least the page size, and log the
    errno on write failures
  - man: document that XFS_IOC_FS[G|S]ETXATTR can't be used on special
    files
- update to 7.1.1
  - fiemap: add a nosync option
  - xfs_scrub: fix spacemap scan for the data volume
  - mdrestore: fix extent length overflow in the v2 restore path
  - xfs_healer: install targets one at a time (build fix)
- update to 7.1.0
  - xfs: zero directory data block padding and header regions on write
    verification and at init, avoiding exposure of stale data
  - xfs_scrub: dozens of correctness and crash fixes across rtgroups,
    zoned and realtime filesystem handling, spacemap scans, media
    verification and work estimation; notably an integer overflow, a
    crash when reporting clean health, and several memory/scan-item
    leaks
  - mkfs: fix PQUOTA/GQNOENFORCE conflict, hardlink detection, symlink
    length checks, a PATH_MAX check and protofile handling in directory
    import; fix filesystem/log size units
  - libfrog: fix a buffer overflow in getparents' path_to_string
  - xfs_healer, xfs_healer_start: fix a getmntent race in weakhandle,
    statmount buffer sizing, listmount checks on --check, and
    monitor-fd aliasing; allow AF_UNIX socket access for xfs_healer
    instances
  - xfs_db: dump zoned filesystem superblock fields
  - xfs_scrub_all, xfs_scrub_media_fail: reduce security lockdowns that
    broke postfix mail notifications, and fix broken command-line
    array construction
- update to 7.0.1
  - xfs_healer, libfrog: fix build/runtime on targets missing the
    HAVE_LISTMOUNT flag or statmount kernel support (missing flags and
    fallback stubs) -- a portability fix for the health-monitoring code
    introduced in 7.0.0
- update to 7.0.0
  - xfs_healer: new self-healing background daemon that monitors mounted
    filesystems for health events (metadata corruption, I/O errors,
    shutdowns) and automatically triggers spot or full repairs, picking
    repair mode from the autofsck fsproperty; adds a per-mount
    xfs_healer_start service to start it automatically
  - xfs_io: add listmount, statmount and a media verify command; monitor
    filesystem health events
  - xfs_scrub: use the new media-verify ioctl for phase 6 media scanning,
    extend it to cover the log region, raise media verification IO
    limits, and report truncated devices as media errors
  - mkfs: enable online repair by default when all backrefs are enabled
  - xfs_repair: don't fail on INCOMPLETE attrs in leaf blocks
  - xfs_scrub_all: fix a deadlock when lsblk produces a lot of output
  - xfs_scrub: drop the bogus warning about mixed bidirectional
    codepoints in names, warn about unicode variation selectors instead
  - xfs_quota: display default limits for users with zero usage

==== zypper ====
Version update (1.14.101 -> 1.14.102)
Subpackages: zypper-log zypper-needs-restarting

- list-patches: Show issue numbers that were not found
  (bsc#1275036, fixes #655)
- Use RunCommand to execute the pager.
- security: replace shell-based pager execution with execvp.
- patch: Allow to select optional patches by category
  (bsc#1283249)
  Explicitly selecting optional patches by --category must imply
  - -with-optional. Otherwise the without-optional default would
  sort out the requested patches.
- version 1.14.102